Privacy policy

Effective from: 20 May 2026.

Last updated: 28 June 2026.

This Privacy Policy explains how Rare Reserve TCG Ltd, trading as Rare Reserve ("we", "us", "our"), collects, uses, shares and protects your personal data when you visit our online shop, place an order, or otherwise interact with us. We sell sealed trading-card products and related accessories to customers in the United Kingdom, and we are committed to handling your personal data responsibly and in line with UK data protection law.

Who we are

Rare Reserve TCG Ltd is the data controller responsible for your personal data. We are registered in England and Wales under company number 17243695, with our registered office at 66 Paul Street, London EC2A 4NA.

If you have any questions about this policy or about how we handle your personal data, you can contact us at enquiries@rarereservetcg.com or by writing to us at the registered address above.

The personal data we collect

Depending on how you use our shop, we may collect and process the following categories of personal data:

  • Identity and contact details, such as your name, email address, postal/delivery address, and telephone number.
  • Order and transaction details, such as the products you buy, order value, order history, and delivery information.
  • Limited payment-related information. We do not store full payment card numbers. Card data is handled securely by our payment processor under PCI-DSS standards, and we may receive only limited details such as the card type, the last four digits of the card, and confirmation that a payment succeeded.
  • Account and login details, if you create an account with us, including your login credentials and account preferences.
  • Communications with us, such as emails, contact-form messages, customer-service enquiries, and product reviews.
  • Technical and usage data collected automatically via cookies and similar technologies, such as your IP address, device and browser information, and how you use and navigate our website.
  • Marketing preferences, including your choices about whether you wish to receive marketing communications from us.

How we collect your personal data

We collect personal data in the following ways:

  • Directly from you, for example when you place an order, create an account, contact us, leave a review, or sign up to receive marketing communications.
  • Automatically, through cookies and similar technologies when you use our website, which collect technical and usage data.
  • From third parties, for example from our payment processor, which confirms payment and may provide limited card details, and from other service providers who help us operate our shop.

How and why we use your personal data

We use your personal data for the purposes set out below. For each purpose we have identified the lawful basis under Article 6 of the UK GDPR that allows us to use your data in that way.

  • To process and fulfil your orders, take payment, arrange delivery, and manage your account. Lawful basis: performance of a contract with you.
  • To provide customer service and respond to your enquiries and communications. Lawful basis: performance of a contract, or our legitimate interests in supporting and communicating with our customers.
  • To prevent and detect fraud, and to keep our website and systems secure. Lawful basis: our legitimate interests in protecting our business and our customers.
  • To operate, analyse, maintain and improve our shop and the products and services we offer. Lawful basis: our legitimate interests in running and improving our business.
  • To send marketing communications to our existing customers about similar products and offers. Lawful basis: our legitimate interests in promoting our business, relying on the "soft opt-in" under the Privacy and Electronic Communications Regulations (PECR) for marketing emails, subject always to your right to object.
  • To send marketing emails to new subscribers, and to set non-essential cookies (such as analytics and advertising cookies). Lawful basis: your consent.
  • To keep tax, accounting and other business records, and to comply with our other legal and regulatory obligations. Lawful basis: compliance with a legal obligation.

Where we rely on legitimate interests, we have considered the impact on you and your rights, and we only rely on this basis where our interests are not overridden by your interests or fundamental rights and freedoms.

We do not make decisions about you based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you. If this changes, we will update this policy and tell you about the logic involved, the significance of the processing, and the likely consequences for you.

Marketing and your right to object

We may send you marketing communications where you have given us your consent, or where the "soft opt-in" under PECR applies. The soft opt-in means that you are an existing customer who bought (or negotiated to buy) a similar product from us, that we offered you an opt-out at the point we collected your details, and that we include an opt-out in every message we send. Where we rely on your consent, for example when you sign up to our newsletter, we obtain it through a clear, unticked opt-in, and you can withdraw it at any time.

You have an absolute right to object to direct marketing at any time. If you no longer wish to receive marketing from us, you can opt out by clicking the unsubscribe link in any marketing email, or by contacting us at enquiries@rarereservetcg.com. Once you opt out or withdraw your consent, we will stop sending you marketing communications.

Cookies

Our website uses cookies and similar technologies to make the site work, to remember your preferences, and (with your consent) to analyse how the site is used and to support advertising. Essential cookies are needed for the website to function. Non-essential cookies, such as analytics and advertising cookies, are only set with your consent, in line with the Privacy and Electronic Communications Regulations (PECR).

We use a cookie-consent banner so that you can accept or reject non-essential cookies, and you can change your cookie preferences at any time through the banner or your browser settings.

Who we share your personal data with

We share personal data only where necessary and with appropriate protections in place. We may share your data with the following categories of recipient:

  • Our e-commerce platform, Shopify, which hosts and operates our online shop.
  • Payment processors, including Shopify Payments and the payment methods shown at checkout, who handle payment securely.
  • Delivery and courier providers, such as Royal Mail, to deliver your orders.
  • Email and customer-communication providers, who help us send order updates and other communications.
  • Analytics and advertising providers, such as Google Analytics and Google Ads.
  • Our reviews provider, Trustpilot.
  • Professional advisers and authorities, where we are required to share data by law or to establish, exercise or defend legal claims.

International transfers

Some of our service providers, such as Shopify and Google, may process personal data outside the United Kingdom. Where this happens, we make sure that appropriate safeguards are in place to protect your data, such as the UK adequacy regulations or the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. This ensures that your personal data continues to receive a level of protection consistent with UK data protection law.

Data retention

We keep your personal data only for as long as we need it for the purposes set out in this policy, and to meet our legal obligations. In general:

  • We keep order and transaction records, including the information needed for tax and accounting, for around seven years to meet UK tax and consumer-law record-keeping requirements.
  • We keep marketing data until you opt out of marketing or withdraw your consent.
  • We keep account data for as long as your account remains active.

When we no longer need your personal data, we will securely delete or anonymise it.

Security

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse or alteration. We also require the service providers who process data on our behalf to maintain appropriate safeguards.

Your rights

Under UK data protection law you have a number of rights in relation to your personal data:

  • The right to access the personal data we hold about you.
  • The right to have inaccurate or incomplete personal data corrected (rectification).
  • The right to have your personal data erased in certain circumstances.
  • The right to restrict our processing of your personal data in certain circumstances.
  • The right to data portability, allowing you to obtain and reuse certain data we hold about you.
  • The right to object to our processing of your personal data, including an absolute right to object to direct marketing at any time.
  • The right to withdraw your consent at any time where we rely on consent to process your data.
  • Rights relating to automated decision-making and profiling.

You can exercise any of these rights free of charge by contacting us at enquiries@rarereservetcg.com. We will respond within one month of receiving your request. If your request is complex or you have made a number of requests, we may extend this by up to two further months, and we will let you know if we need to do so. In most cases there is no charge, but we may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive.

Children

Our shop is intended for adults and we do not intend to collect personal data from children. Under the Data Protection Act 2018, children in the UK can consent to online services from the age of 13. If you believe a child has provided us with their personal data, please contact us and we will take appropriate steps to delete it.

Complaints

If you have any concerns about how we handle your personal data, we would encourage you to contact us first so that we can try to resolve them. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk. Making a complaint to the ICO does not affect any other legal rights or remedies you may have.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. Any changes will be posted on this page, and we encourage you to check the "Last updated" date at the top of this policy to stay informed.

Contact us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Rare Reserve TCG Ltd. Email: enquiries@rarereservetcg.com. Registered office: 66 Paul Street, London EC2A 4NA.