Draft — have reviewed
Privacy notice
Last updated: 12 November 2026. [PLACEHOLDER: update this date whenever the policy changes.]
Draft — have reviewed. This page is a working draft and has not yet been checked by a solicitor or other qualified adviser. Fill in every [PLACEHOLDER], have the text reviewed, then remove this notice before you take payments.
In this policy, "we", "us" and "Magoriums" mean [PLACEHOLDER: legal name, e.g. "Jacob Hampson, a sole trader" or "Magoriums Ltd, company number 00000000, registered in England and Wales"], trading as Magoriums, of [PLACEHOLDER: geographic address, not a PO box]. Email: [PLACEHOLDER: email, e.g. hello@magoriums.com].
This notice explains what personal information we collect when you visit magoriums.com, buy from us, or ask us to buy your cards, plus why we collect it, who we share it with and what your rights are. We are the controller of this information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
ICO registration (data protection fee) reference: [PLACEHOLDER: ZA000000, or delete if the ICO self-assessment says you are exempt].
1. What we collect
- Orders: name, delivery and billing address, email, phone number (if given), what you bought, and when and how much you paid. Card details are entered on our payment provider's secure page. We never see or store your full card number.
- Selling enquiries and collection purchases: name, email, what you want to sell, photos you send us and our correspondence. If we buy from you, we also collect your bank details to pay you, plus your address if we send you postage labels. We may ask your age, because we only buy from people aged 18 or over, or with a parent or guardian's consent.
- Emails and messages: anything you send us by email or through social media and marketplace messages.
- Website data: our host keeps short-lived technical logs (IP address, browser, pages requested and the time) for security and to keep the site running. We do not use advertising or tracking cookies. See our cookie policy.
- Marketing: your email, if you sign up to updates. [PLACEHOLDER: delete if there is no newsletter.]
2. Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Taking and delivering your order, refunds and returns, customer service | Contract (Art. 6(1)(b)) |
| Replying to a selling enquiry, making an offer and paying you for cards we buy | Steps at your request before a contract, and the contract itself (Art. 6(1)(b)) |
| Keeping accounting and tax records for HMRC, and meeting consumer-law duties | Legal obligation (Art. 6(1)(c)) |
| Preventing fraud and checking that cards are genuine; keeping the website secure; handling disputes and chargebacks | Legitimate interests (Art. 6(1)(f)): protecting our business and customers |
| Answering general questions; improving our stock and service | Legitimate interests (Art. 6(1)(f)) |
| Emails about new stock or offers | Consent, or for past customers the "soft opt-in" under PECR reg. 22 for similar products. You can unsubscribe at any time with one click. |
We do not make decisions about you based solely on automated processing, and we do not sell your personal information.
3. Who we share it with
We share only what each service needs. These providers act as our processors (they handle data on our instructions), unless marked as independent controllers.
| Provider | What for | Location |
|---|---|---|
| Cloudflare, Inc. (Cloudflare Pages, DNS and Email Routing) | Website hosting, security and forwarding email sent to @magoriums.com | Global network, incl. USA |
| Formspree, Inc. | Receiving the selling-enquiry form and passing it to us by email | USA |
| [PLACEHOLDER: Stripe Payments Europe Ltd / Shopify] | Taking card payments and preventing fraud. The payment provider is also an independent controller for its own legal and fraud-prevention duties. | [PLACEHOLDER] |
| [PLACEHOLDER: email provider, e.g. Google Workspace / Gmail] | Our email inbox | [PLACEHOLDER] |
| Royal Mail Group Ltd [PLACEHOLDER: other couriers] | Delivering your order (name, address, and sometimes email or phone for delivery updates) | UK |
| [PLACEHOLDER: accounting software, e.g. Xero / QuickBooks / FreeAgent] and our accountant | Bookkeeping and tax returns | [PLACEHOLDER] |
| Marketplaces (eBay, Cardmarket, Vinted, TikTok Shop, Whatnot) | If you buy from us on a marketplace, it is an independent controller of your data under its own privacy notice. We receive what we need to fulfil the order. | Various |
We may also disclose information if the law requires it (for example, to HMRC or the police), or to protect our legal rights.
4. International transfers
Some providers above process data outside the UK, mainly in the USA. Where they do, we rely on UK "adequacy" regulations (including the UK–US data bridge for certified US companies), or on the ICO's International Data Transfer Agreement or Addendum built into the provider's data processing terms. [PLACEHOLDER: confirm the mechanism for each provider from its DPA.] You can ask us for details.
5. How long we keep it
| Information | How long |
|---|---|
| Order, payment and purchase records (including cards we buy from you) | At least 5 years after the 31 January Self Assessment deadline for the tax year they relate to, as HMRC requires. [PLACEHOLDER: 6 years from the end of the financial year if you trade as a limited company.] |
| Selling enquiries that do not lead to a purchase | 12 months from our last contact |
| General emails and messages | 2 years from our last contact, unless they relate to an order |
| Bank details of people we have paid | Deleted from our records 12 months after the last payment, except where they form part of our accounting records |
| Marketing list | Until you unsubscribe. We then keep only your address on a suppression list so we never email you again. |
| Website security logs | As set by our host. These are short-lived. |
6. Your rights
You have the right to:
- access a copy of your personal information;
- have inaccurate information corrected;
- have information erased, where we no longer need it or are not legally required to keep it;
- restrict or object to our use of your information (including any use based on legitimate interests), and stop direct marketing at any time;
- data portability: receive the information you gave us in a machine-readable format, where we rely on contract or consent;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email [PLACEHOLDER: email]. It is free, and we will reply within one month. That can be extended by up to two more months for complex requests, in which case we will tell you. We may need to confirm your identity first.
7. Complaints
If you are unhappy with how we have handled your information, please tell us first at [PLACEHOLDER: email] so we can try to put it right. We will acknowledge your complaint within 30 days.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:
- Online: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
8. Children
Our shop is for adults and for younger collectors buying with a parent or guardian's involvement. We do not knowingly collect information from children under 13 without a parent's consent, and we only buy cards from under-18s with a parent or guardian's consent.
9. Changes
We will update this notice when our services or providers change, and we will change the date at the top when we do.