Privacy notice

Who we are

Trading Card Lane is the controller of the personal data described here. Trading Card Lane is operated by Ermal, a sole trader, based in London. Contact us about privacy at [email protected].

Sellers on Trading Card Lane are independent businesses or individuals. When you buy from a seller, they receive your name, delivery address and order details so they can send your cards, and they are responsible for how they use that information.

What we collect

• Account details: name, email address, password (we only keep a secure hash), saved delivery addresses.
• Orders and payments: what you bought or sold, prices, postage, delivery and tracking details. Card details are entered directly with Stripe; we never see or store your full card number, only a summary such as the card brand and last four digits.
• Sellers: shop details, listings, and the identity and bank details Stripe collects to verify you and pay you (held by Stripe).
• Live Verified captures: photos and short videos taken on a seller's phone, with the capture time, the one-time code, browser details and a keyed hash of the IP address.
• Messages, disputes and reviews you write.
• Username and forum activity: the username you choose (shown publicly on your forum posts, reviews and in auction bid history instead of your name), your forum posts and the images you add to them, and reports you send about posts (the person reported never sees who reported them).
• Technical data: IP address, browser and device type, and the cookies described in our cookie notice.
• Consent records: what you chose in the cookie banner and when, so we can prove it.

How we use it and why

UK GDPR requires a lawful basis for each use:

Some auction decisions are automatic: 2 non-payment strikes within 90 days suspend bidding for 30 days, and 3 within 365 days ban bidding. You can ask for any such decision to be reviewed by a person by emailing us.

Who we share it with

• Sellers you buy from: your name, delivery address and order details.
• Stripe (payments and seller payouts) processes payment data on our behalf. For identity checks, fraud prevention and its own legal duties, Stripe acts as an independent controller under its own privacy policy.
• Service providers acting as our processors: Render (hosting, in the EU), Cloudflare (file storage, email delivery, security).
• Advertising and analytics platforms chosen by a seller, only with your consent (see below).
• HMRC and other authorities where the law requires it, including seller income reporting.

We don't sell personal data.

Sellers' advertising tags

Sellers can connect their own Meta Pixel, Google Analytics or Google Ads, and TikTok Pixel accounts to their shop. These tags load on that seller's shop pages, and on checkout and order-confirmation pages for that seller's items, only after you accept analytics or marketing cookies. Each seller's tags only receive events about that seller's own products and orders.

When you've given consent at checkout, we also send the purchase event (order reference, items, value, and identifiers such as the advertising cookie ID, IP address and browser details) from our servers to the platforms that seller has connected, so the seller can measure their ads. If you haven't consented, nothing is sent.

For collecting and passing on this data, we and the seller share responsibility as joint controllers: we decide how the tags work and only load them with consent; the seller decides to use them and which ad accounts receive the data. Once received, the seller and the ad platform (Meta, Google or TikTok) are each responsible for their own use under their own privacy policies. You can contact us to exercise your rights for this processing and we'll coordinate with the seller.

Store newsletters

Some sellers let you sign up to their newsletter on their shop. The seller is the controller of their subscriber list: they decide to collect it and how they email you. Trading Card Lane is their processor: we collect your email address on their behalf, send the one email that asks you to confirm, store the list and the record of your consent (what you agreed to, when, and on which page), and let the seller download it. We never use a seller's list for our own marketing, and we don't send newsletters ourselves.

To stop abuse, we also keep a short log of sign-up requests with keyed hashes of the email and IP address. For that log we are the controller, on the basis of legitimate interests (preventing spam and protecting our email delivery).

Every newsletter confirmation and every seller email should carry an unsubscribe link, and our unsubscribe link always works, even if the shop is suspended. To have your email deleted from a seller's list, contact the seller (their shop's policies page shows how), or email us and we'll pass it on.

Seller income reporting to HMRC

Under the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023, we must collect information about sellers and report it to HMRC each year. We report a seller for a calendar year (1 January to 31 December, UK time) when they make 30 or more sales, or receive more than £1,700.00 (the €2,000 threshold in pounds), counting paid orders and leaving out cancelled and fully refunded ones.

The report includes the seller's name and address, bank account identifier, the number of sales, the amounts paid and the fees we kept per quarter, and the tax details below. Stripe's identity checks give us the name, address and bank details. We only ask sellers for what we don't already hold, and only once their sales in a year reach 25 or £1,400.00:

• sellers who sell as individuals: date of birth, a National Insurance number or Unique Taxpayer Reference (UTR), the country where they are resident for tax, and their tax identification number there if it isn't the UK;
• limited companies: company registration number (from their application), UTR, and VAT number if VAT-registered.

We store the date of birth and tax references encrypted, show them back to the seller with all but the last 3 characters hidden, and only our administrators can see them in full, to prepare the report. We email up to two reminders. If a seller reaches the reporting threshold and hasn't given the details 60 days after the first reminder, we hold their payouts until they do; no order is cancelled or refunded because of this. Sellers below the threshold aren't reported. Each reported seller can see what we report in their seller dashboard, and we send them a copy by 31 January. HMRC may share the report with other tax authorities.

We keep this information for as long as the law requires (currently 6 years after the reporting year), then delete it.

International transfers

Our main systems are hosted in the UK and EU. Some providers, including Stripe, Cloudflare and the advertising platforms sellers connect, process data in other countries such as the United States. Where they do, transfers are covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO's International Data Transfer Agreement or Addendum.

How long we keep it

• Account details: while your account is open, then deleted within 90 days of closure unless needed below.
• Orders, payments and payouts: 6 years after the end of the financial year (tax and accounting law).
• Seller tax information and HMRC reports: as long as the law requires (currently 6 years after the reporting year).
• Live Verified captures: while the listing exists, and for 2 years after a sale as dispute evidence.
• Disputes and messages: 6 years after they close.
• Sign-in sessions: 30 days. Cookie consent records: 2 years.
• Store newsletters: sign-ups never confirmed are deleted when the confirmation link expires after 7 days; unsubscribed addresses are kept for 24 months so the seller can respect the opt-out, then deleted; the sign-up request log is deleted after 48 hours. Subscribed addresses are kept until you unsubscribe or the seller deletes them.

Your rights

You have the right to:

• get a copy of your data, and have it corrected or deleted;
• restrict or object to our use of it, including any use based on legitimate interests;
• receive data you gave us in a portable format;
• withdraw consent at any time, for cookies using Cookie settings.

Email [email protected] and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes and contact

We'll update the date at the top when this notice changes, and tell account holders by email about significant changes.