Skip to content
Sign in

Legal

Privacy Policy

Last updated:

This explains what personal data TCG Drop holds, why, and your rights over it.

1. Who is responsible

DoniCodes Ltd (trading as TCG Drop), company no. 17358107, registered office 128 City Road, London, EC1V 2NX, is the data controller for the platform. Contact: hello@tcgdrop.co.uk.

2. What we collect

  • Account details: email address, name, display name, and - if you link Discord - your Discord ID and avatar.
  • Activity: your claims, orders, memberships and participation (for example leaderboard scores).
  • If you run a store: when you accept the TCG Drop Store Agreement for it, the name and role you type to sign it, the business's name (and company number), your account's email address, and the IP address and browser you accepted from; and the emails we send you about the agreement. For the yearly report UK digital platform rules require (section 3), the seller's details those rules ask for: for a sole trader, your legal name, home address, date of birth and National Insurance number; for a company, its legal name, address and company number; any VAT number; and the bank account the store's payouts go to.
  • Technical basics: sign-in cookies, and security logs that include the IP address each request comes from. We use essential cookies only - no advertising or tracking cookies, which is why there is no cookie banner.
  • Anonymous usage statistics: we use cookieless page-view analytics (Vercel Web Analytics) to understand how the site is used. It sets no cookies, does not track you across sites, and cannot identify you - visitors are counted with an anonymised identifier that changes daily.

Payment card details are collected and held by Stripe, our payment provider - they never touch our systems.

3. Why we use it

  • To run the platform - your account, claims, drops and memberships (performance of our contract with you).
  • To fulfil your orders: when you claim or buy from a store, we share the details the store needs (your name and what you ordered) with that store, so it can prepare and hand over your items. Once shared, the store is an independent controller of that information for running its own business.
  • To process payments through Stripe.
  • To keep a record of our agreements with stores: who accepted which agreement for a store, and when, and what we told the store about it (performance of our contract with the store, and our legitimate interest in being able to show what was agreed).
  • To keep a record of your memberships: the key facts and terms we showed and emailed you, what you agreed to pay, and the emails we sent you about your membership (the law on subscriptions requires us to give you this information, and we have a legitimate interest in being able to show we did).
  • To meet legal duties: sellers' (stores') details and platform income are reported to HMRC annually under UK digital platform reporting rules. This applies to stores, not to buyers (legal obligation). The law requires us to collect these details; if a store doesn't give them, we may suspend its online payments until it does.
  • To keep the platform safe - fraud and abuse prevention (legitimate interests).

4. Who processes it for us

We use a small set of established providers to run the platform: Supabase (database and authentication), Vercel (hosting), Stripe (payments), Resend (sending our emails, sign-in codes included) and Google (our email inbox). Each processes data under its standard data processing agreement, with UK GDPR safeguards applying to any international transfers.

When you open the sign-in or sign-up page, Cloudflare Turnstile checks that you're a person rather than an automated script (usually without asking you anything), so that only people can ask for an email code. It sees your IP address and technical details of your browser and device. Cloudflare processes these for us to run the check, and also uses them as a controller in its own right to improve how it detects automated traffic, as its Turnstile privacy addendum describes.

5. How long we keep it

Your account data is kept while your account exists. Transaction records are kept for six years after the transaction, as required for business and tax records, even if you delete your account. A store's agreement records (each acceptance, and the emails we sent about the agreement) are kept for at least six years after the agreement ends, even if the account that accepted it is deleted. Membership records (what we showed and emailed you about a membership, and what you agreed to) are kept for at least six years after the membership ends, even if you delete your account. A store's platform reporting records (the details we reported to HMRC, how we checked them, and each year's report) are kept for five years after the end of the last year they're used for, as those rules require, even if the store's account is deleted. Everything else is deleted when your account is.

6. Your rights

You can access and correct your details in your account settings, and delete your account (and its data, other than the transaction, agreement, membership and platform reporting records above) from settings at any time. You also have UK GDPR rights to request a copy of your data, correction, deletion and restriction - contact us and we will respond promptly. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).