This privacy policy explains what personal information Obsidia TCG collects when you use obsidiatcg.co.uk, why we collect it, who we share it with and the choices you have. We’re an online trading card shop based in Doncaster, UK, and we’re the controller of your personal information under UK data protection law (the UK GDPR and the Data Protection Act 2018).

If you have a question or want to make a request about your information, email sales@obsidiatcg.co.uk or use our contact page.

Table of Contents

Information we collect

When you place an order

Your name, billing and delivery addresses, email address, phone number and the details of your order. Payments are handled by our payment provider, so we don’t see or store your full card details.

When you create an account

Your name, email address and password (stored in encrypted form), any addresses you save and your order history. Creating an account is optional: you can check out as a guest.

When you contact us

Your name, email address, phone number if you choose to give it, and your message, whether you use our contact form or email us. Messages sent through the contact form are stored in our website’s admin area and emailed to our inbox.

When you browse the site

Our hosting provider records technical information such as your IP address, browser type and the pages you request, to keep the site running and secure. The shop also uses cookies, which are explained below.

How we use your information

To process and deliver your orders and help with any questions about them. We need this to carry out our contract with you.
To reply to your messages and enquiries. This is in our legitimate interest, or part of our contract with you if it’s about an order.
To keep the records the law requires, such as tax and accounting records.
To keep the site secure and prevent fraud and spam, which is in our legitimate interest.
To see which websites and searches bring customers to our shop, using the order attribution information described under Cookies.

We don’t send you marketing emails unless you’ve agreed to receive them, and we never sell your personal information.

We only share your information with the services we need to run the shop:

Website hosting: our website is hosted by Namecheap (EasyWP).
Email: our email is provided by Namecheap (Spacemail), so order emails and contact-form messages pass through it.
Payments: the payment provider you use at checkout processes your payment under its own privacy policy.
Delivery: the courier or postal service delivering your order receives your name, address and, where needed, your contact details.
WhatsApp: if you tap the WhatsApp chat button, your conversation takes place on WhatsApp (owned by Meta) under its own privacy policy.
Authorities and advisers: HMRC or other authorities when the law requires it, and our professional advisers, such as accountants.

Some of these providers may store or process information outside the UK. When they do, they must use the safeguards that UK data protection law requires, such as adequacy regulations or approved contract clauses.

How long we keep it

Orders: order and invoice records are kept for up to six years, to meet UK tax record-keeping rules.
Accounts: your account stays open until you ask us to close it. Your order records are then kept as above.
Messages: contact-form messages and emails are kept for up to two years after our last conversation, unless they relate to an order.

Cookies

Cookies are small files that your browser saves when you visit a website. We use:

Basket and checkout cookies (woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_): these remember what’s in your basket and are essential for the shop to work.
Account cookies (wordpress_logged_in_ and related cookies): these keep you signed in if you have an account.
Order attribution cookies (sbjs_ cookies): these record how you arrived at our shop, such as the website or search engine that sent you, so we can see which ones bring customers. If you place an order, this information is saved with it.

You can block or delete cookies in your browser settings. If you block the essential cookies, the basket and checkout won’t work.

Your rights

Under UK data protection law, you have the right to:

ask for a copy of the personal information we hold about you;
ask us to correct information that’s wrong or incomplete;
ask us to delete your information, unless we need to keep it, for example for tax records;
ask us to limit how we use your information, or object to us using it;
ask for your information in a format you can take elsewhere;
withdraw your consent at any time, where we rely on it.

To use any of these rights, email sales@obsidiatcg.co.uk. We’ll reply within one month and may ask you to confirm your identity first.

If you’re unhappy with how we’ve handled your information, please tell us so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) on its data protection complaints page.

Keeping your information safe

Our website uses an encrypted (HTTPS) connection, account passwords are stored in encrypted form and only authorised people can access our admin area.

Changes to this policy

We’ll update this page if the way we use personal information changes. This policy was last updated on 9 October 2026.

Privacy Policy