Privacy policy

Last Updated: August 2026

Quick Summary (TL;DR)
  • Who we are: TCGLane, an online trading card retail store.
  • Why we collect data: To pack and ship your orders, process secure payments, and prevent fraud.
  • Your biggest right: You can ask us to completely delete your data or show you what we have stored at any time by emailing support@tcglane.com.
  • Data Retention: Your order records are securely kept for 6 years to satisfy UK HMRC tax auditing requirements.


1. Identity of the Data Controller
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller is:
  • Business Name: TCGLane
  • Contact Email: support@tcglane.com
  • Physical Address: 5 Cedar Walk, Marston Road, Stafford, ST16 3BU, United Kingdom


2. Lawful Bases for Processing Your Data
Under the UK GDPR, we must have a valid legal reason to process your personal data. We rely on the following bases:
  • Performance of a Contract: Necessary to process payments, fulfill your orders, arrange shipping with couriers, and handle returns or customer support inquiries.
  • Legitimate Interests: Necessary for our core business infrastructure, including website analytics, preventing malicious fraudulent activity, securing our storefront, and understanding how customers navigate our site.
  • Consent: Used strictly for marketing emails or text alerts if you have explicitly checked an opt-in box at checkout. You can instantly withdraw this consent at any time.
  • Legal Obligation: Necessary to comply with our statutory financial, accounting, and tax bookkeeping duties under UK corporate law.


3. Full Categories of Personal Information We Collect
We process several types of data depending on how you use our storefront:
  • Identity and Contact Data: Includes your legal first name, last name, email address, telephone number, billing address, and physical delivery address.
  • Financial and Transaction Data: Includes details about payments made to us and details of products you have purchased from us. Note: All card processing is encrypted securely via Shopify Payments, and we never view or store your full raw credit or debit card numbers.
  • Technical and Device Data: Includes your internet protocol (IP) address, your login details, browser type and version, time zone setting, operating system, and platform tracking tokens.
  • Usage Data: Includes details about how you navigate our store, items you add to your shopping cart, items added to Wishlist's, and search terms you enter on our Site.


4. Methods of Data Collection
We collect personal information through these distinct channels:
  • Direct Interaction: Information you type into fields when creating an account, placing an order, subscribing to newsletters, or emailing our support team.
  • Automated Technologies: As you browse our website, technical usage data is collected automatically via standard browser cookies, web pixels, and server logs.
  • Third-Party Sources: We receive payment verification data from our clearing gateways and delivery confirmation status alerts from our postal couriers.


5. Data Disclosures and Third-Party Sharing
We share your personal information with necessary service providers who enable our e-commerce platform to run:
  • Shopify Inc.: Our e-commerce platform provider that hosts our database and processes transactions.
  • Delivery and Postal Partners: Royal Mail and contracted courier networks who require your name and address to deliver physical packages.
  • Payment Processors: Fully PCI-compliant gateways who securely process transactions.


6. International Data Transfers
Because our store is built on Shopify, your personal information will be transmitted to and stored outside of the United Kingdom, specifically on secure servers in Canada and the United States. To safeguard your information, these transfers are protected by legally approved mechanisms, including Shopify’s corporate Standard Contractual Clauses (SCCs) and Data Processing Agreements approved by the UK government.


7. Data Retention Schedule
We do not hold data indefinitely. We keep your information only as long as necessary to handle your purchases or customer service requests. However, under UK tax legislation (HMRC), we are legally mandated to preserve all core transaction logs, financial records, and invoice data for a minimum of 6 years following the end of the tax year in which the sale occurred. Following this window, legacy customer files are permanently purged.


8. Your Legal Rights and How to Exercise Them
Under the UK GDPR, you hold specific statutory rights regarding your data:
  • Right of Access: You can demand a complete file of all personal data we hold about you.
  • Right to Rectification: You can command us to immediately update or correct incorrect profiles.
  • Right to Erasure ("Right to be Forgotten"): You can request that we permanently delete your customer profile and account information (unless we are overridden by the 6-year HMRC tax hold rule).
  • Right to Restrict or Object: You have an absolute right to object to direct marketing or ask us to restrict how we process your online behavioural footprint.
  • Right to Data Portability: You can request that we export your data in a clean, machine-readable format to move to another digital service.
How to Exercise Your Rights: To make a formal request, simply email us at support@tcglane.com with the subject line "Data Subject Request". We do not charge a fee for this, and under law, we must verify your identity and fulfil your request within 30 calendar days.


9. Regulatory Complaints
If you believe your personal data has been handled incorrectly, please contact us first so we can fix the issue. However, you maintain the legal right to bypass us and lodge an official complaint directly with the UK data protection regulatory authority:
  • Supervisory Body: Information Commissioner's Office (ICO)
  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  • Official Website: https://ico.org.uk