Privacy Policy
Last updated: 24 October 2026
This policy explains what personal data TatakaiCards collects when you use tatakaicards.com, why, and what rights you have over it, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
TatakaiCards is the trading name of Tatakai Cards Ltd, a company registered in Northern Ireland with company number NI744309. Tatakai Cards Ltd is the data controller for the personal data described in this policy. You can contact us about privacy matters at contactus@tatakaicards.com.
Belfast, BT36 6EN, United Kingdom.
2. What we collect
| When | What we collect |
|---|---|
| Placing an order | Name, email, delivery address, postcode, country, and the items and value of your order. |
| Starting checkout | A security check run by Cloudflare (Turnstile) confirms the order is being placed by a person and not an automated program. To do this, Cloudflare receives technical data about your browser and device, including your IP address. |
| Paying at checkout | Your card payment is handled entirely by Stripe. We never see or store your full card number. |
| Asking to be emailed when checkout opens | Your email address, when you gave it, and whether you also asked for restock and new set emails. |
| Asking to be emailed when a sold-out box is back | Your email address, the box, and when you asked. |
| Before your order ships | Photos of the box we're sending you (the box only, no personal details), kept with your order record. |
| Contacting us | Whatever you include in your message (e.g. name, email, order number). |
| Browsing the site | Standard technical data your browser sends to any website (e.g. IP address, browser type) via our hosting provider's server logs. We don't use tracking or advertising cookies (see Section 6). |
3. Why we use it, and our legal basis
- To fulfil your order (take payment, arrange shipping, send order confirmations): necessary to perform our contract with you.
- To handle returns, refunds, and customer service queries: necessary to perform our contract with you, and our legitimate interest in resolving issues fairly.
- To email you once when online checkout opens, if you asked us to: your consent.
- To email you about restocks and new sets, only if you ticked the box asking for this: your consent.
- To email you once when a sold-out box is back in stock, if you asked us to: your consent.
- You can withdraw any of these at any time on our unsubscribe page or by emailing us, and we'll delete your address.
- To send you photos of your box before it ships, and to check any claim that a box was resealed, fake or damaged: necessary to perform our contract with you, and our legitimate interest in handling claims fairly.
- To prevent fraud and keep the site secure: our legitimate interest in protecting the business and our customers.
- To meet our legal obligations, such as keeping records for tax purposes: necessary for legal compliance.
4. Who we share it with
We share the minimum data needed with the following processors to run the shop. None of them are permitted to use your data for their own marketing purposes:
- Stripe: payment processing.
- Royal Mail: your name, delivery address and email address, to ship your order and send you tracking updates.
- PrintNode: to print shipping labels for UK orders.
- Google Sheets: internal order record-keeping.
- Resend: our email delivery provider, used to send order confirmations, photos of your box, the email when checkout opens, back-in-stock emails, and restock and new set emails if you asked for them.
- Hostinger: our website and database hosting provider.
- Cloudflare: the security check at checkout (Turnstile), used to block automated abuse.
We do not sell your personal data to anyone, and we don't share it with advertisers or data brokers.
5. International transfers
Some of the providers above (including Stripe and Cloudflare) may process data outside the UK, including in the United States. Where this happens, we rely on their compliance with UK-approved safeguards, such as the UK International Data Transfer Addendum or an adequacy decision covering that country.
6. Cookies
We don't use tracking, analytics or advertising cookies. Your basket, your light or dark theme choice and the fact you've seen the cookie notice are kept in your browser's own storage on your device, and aren't sent to us. If you pay for an order, Stripe's payment page may set its own cookies, which are covered by Stripe's privacy policy. The security check at checkout is run by Cloudflare and may store what it needs to work in your browser, which is covered by Cloudflare's privacy policy.
7. How long we keep it
Order and payment records are kept for as long as required by UK tax law (currently at least 6 years from the end of the relevant tax year). Photos of your box are kept with your order record for the same period. If you asked to be emailed when checkout opens, we delete your address once that email has been sent, unless you also asked for restock and new set emails; then we keep it until you unsubscribe. A back-in-stock request is deleted once we've emailed you that the box is back, or when you unsubscribe. If you contact us with a query, we keep that correspondence for as long as reasonably needed to resolve it and for a short period afterwards in case you follow up.
8. Your rights
Under UK GDPR, you have the right to:
- Ask us what personal data we hold about you, and get a copy of it (right of access).
- Ask us to correct inaccurate or incomplete data (right to rectification).
- Ask us to delete your data, where we're not required to keep it for legal reasons like tax records (right to erasure).
- Ask us to restrict how we use your data in certain circumstances (right to restriction).
- Receive your data in a portable format, or ask us to send it to another provider (right to data portability).
- Object to us using your data for certain purposes, including marketing (right to object).
- Withdraw consent at any time where we rely on it.
To use any of these rights, email contactus@tatakaicards.com. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), though we'd appreciate the chance to sort things out directly first.
9. Keeping your data secure
We use reasonable technical measures to protect your data, including encrypted connections (HTTPS), secure session handling, and restricting access to order data to what's needed to run the shop. No method of transmission or storage is ever 100% secure, but we take this seriously and act quickly on anything that looks wrong.
10. Children
If you are under 18, you may only order from us with a parent or guardian, who must place the order or give their permission. We do not knowingly collect personal data from anyone under 18 without that. If you believe a child has given us personal data without a parent or guardian's permission, email contactus@tatakaicards.com and we will delete it.
11. Changes to this policy
We may update this policy from time to time, for example if we start using a new service or the law changes. The date at the top shows when it was last updated.