Privacy policy
1. Privacy policy
General Information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data means any information by which you can be personally identified.
Detailed information regarding data protection can be found in our Privacy Policy set out below.
Data Collection on this Website
Who is responsible for data collection on this website?
The processing of data on this website is carried out by the website operator.
The operator's contact details can be found in the section entitled "Information about the Data Controller" within this Privacy Policy.
How do we collect your data?
Some data is collected when you provide it to us.
This may include, for example, information that you enter into a contact form.
Other data is collected automatically, or after you have given your consent, when you visit this website through our IT systems.
This mainly includes technical data such as:
Internet browser
Operating system
Time of page access
This data is collected automatically as soon as you access this website.
What do we use your data for?
Some of the data is collected to ensure that the website is provided without errors.
Other data is used in anonymised form and without cookies for the statistical evaluation of website usage.
What rights do you have regarding your data?
You have the right at any time to obtain, free of charge, information about:
the origin of your stored personal data;
the recipients of your personal data; and
the purpose for which your personal data is processed.
You also have the right to request the correction or deletion of your personal data.
Where you have given your consent to data processing, you may withdraw that consent at any time with effect for the future.
Furthermore, under certain circumstances, you have the right to request restriction of the processing of your personal data.
You also have the right to lodge a complaint with the competent supervisory authority.
Should you have any questions regarding data protection, you may contact us at any time.
Web Analytics
When visiting this website, usage is evaluated statistically in anonymised form and without cookies using Vercel Web Analytics. Individual visitors are not identified. Details can be found in section "5. Web Analytics with Vercel Web Analytics".
2. Hosting
We host the content of our website with the following provider:
Vercel Inc.
340 S Lemon Ave #4133
Walnut, CA 91789
USA
Vercel also processes your data in the USA, among other places. As a legal basis for data processing by recipients based in third countries, Vercel relies on Standard Contractual Clauses (Article 46(2) and (3) GDPR). Through these clauses, Vercel commits to maintaining the European level of data protection when processing your data, even where that data is stored or processed in the USA.
3. General Information and Mandatory Information
Data Protection
The operators of this website take the protection of your personal data very seriously.
We process your personal data confidentially and in accordance with the applicable data protection legislation, including the General Data Protection Regulation (GDPR), and this Privacy Policy.
Whenever you use this website, various types of personal data are collected.
Personal data means any information by which you can be personally identified.
This Privacy Policy explains:
which personal data we collect;
how we collect it;
why we process it; and
for what purposes it is used.
Please note that data transmission over the Internet (for example, communication by email) may be subject to security vulnerabilities.
Complete protection of data against access by third parties cannot be guaranteed.
Information about the Data Controller
The Data Controller responsible for processing personal data on this website is:
Memory Card – Cards & Collectibles
Jasmin Nitz
Brucknerstrasse 31a, 22083 Hamburg, Germany
Telephone:
+49 176 42146890
Email: support@memorycardtcg.com
The Data Controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data (such as names, email addresses or similar information).
Data Retention
Unless a more specific retention period has been stated within this Privacy Policy, your personal data will remain with us until the purpose for processing no longer applies.
If you exercise your legitimate right to erasure or withdraw your consent to processing, your personal data will be deleted unless we are legally entitled or obliged to retain it for other lawful reasons (for example, retention obligations under tax or commercial law).
In such cases, deletion will take place once those legal grounds no longer apply.
Legal Basis for Data Processing
Where you have given your consent to the processing of your personal data, we process your personal data on the basis of Article 6(1)(a) GDPR and, where special categories of personal data pursuant to Article 9(1) GDPR are processed, on the basis of Article 9(2)(a) GDPR.
Where you have expressly consented to the transfer of personal data to third countries, processing is additionally carried out on the basis of Article 49(1)(a) GDPR.
Where you have consented to the storage of cookies or to access information stored on your device (for example through device fingerprinting), processing is also carried out pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
You may withdraw your consent at any time with future effect.
Where your data is required for the performance of a contract or in order to take steps prior to entering into a contract, we process your data pursuant to Article 6(1)(b) GDPR.
Where processing is necessary to comply with a legal obligation, we process your data pursuant to Article 6(1)(c) GDPR.
Processing may also be carried out on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR.
The specific legal basis applicable in each individual case is explained in the relevant sections of this Privacy Policy.
Recipients of Personal Data
As part of our business activities, we cooperate with various external service providers.
In certain cases, it is necessary to transfer personal data to these external parties.
We only disclose personal data where:
this is necessary for the performance of a contract;
we are legally obliged to do so;
we have a legitimate interest pursuant to Article 6(1)(f) GDPR; or
another legal basis permits such disclosure.
Where we use data processors, personal data is transferred solely on the basis of a valid Data Processing Agreement (DPA).
Where joint processing takes place, a Joint Controller Agreement pursuant to Article 26 GDPR is concluded.
Withdrawal of Your Consent
Many data processing operations are only possible with your explicit consent.
You may withdraw any consent you have previously given at any time.
Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal took effect.
Right to Object (Article 21 GDPR)
Where your personal data is processed on the basis of Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right, at any time, to object to the processing of your personal data on grounds relating to your particular situation.
This also applies to profiling based on those provisions.
The applicable legal basis for the processing can be found in this Privacy Policy.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where processing is required for the establishment, exercise or defence of legal claims (Article 21(1) GDPR).
Right to Object to Direct Marketing
Where your personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes.
This also applies to profiling where it is related to direct marketing.
If you object, your personal data will no longer be used for direct marketing purposes (Article 21(2) GDPR).
Right to Lodge a Complaint
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority.
This applies in particular to the supervisory authority of:
your habitual place of residence;
your place of work; or
the place of the alleged infringement.
This right is without prejudice to any other administrative or judicial remedy available to you.
Right to Data Portability
You have the right to receive personal data that we process automatically on the basis of your consent or in fulfilment of a contract in a structured, commonly used and machine-readable format.
You also have the right to request that such data be transmitted directly to another data controller, where technically feasible.
Right of Access, Rectification and Erasure
Within the limits of the applicable legal provisions, you have the right at any time to obtain, free of charge, information about your stored personal data, including:
its origin;
its recipients; and
the purpose of processing.
You also have the right to request the rectification or erasure of your personal data.
Should you have any questions regarding your personal data, you may contact us at any time.
Right to Restriction of Processing
You have the right to request restriction of the processing of your personal data.
You may contact us at any time to exercise this right.
The right to restriction applies in particular in the following circumstances:
where you contest the accuracy of your personal data while we verify its accuracy;
where processing is unlawful and you request restriction instead of erasure;
where we no longer require your personal data, but you require it for the establishment, exercise or defence of legal claims;
where you have objected pursuant to Article 21(1) GDPR and it has not yet been determined whether our legitimate grounds override yours.
Where processing has been restricted, your personal data may, apart from storage, only be processed:
with your consent;
for the establishment, exercise or defence of legal claims;
to protect the rights of another natural or legal person; or
for important reasons of public interest recognised by the European Union or a Member State.
SSL / TLS Encryption
For security reasons and to protect the transmission of confidential content—such as orders or enquiries that you send to us—this website uses SSL or TLS encryption.
You can recognise an encrypted connection when your browser's address bar changes from http:// to https://, and a padlock icon appears in your browser.
Where SSL or TLS encryption is enabled, any data transmitted to us cannot be read by third parties.
4. Data Collection on this Website
Cookies and Browser Storage
This website only stores technically necessary information on your device (cookies or your browser's storage). We do not use cookies or similar technologies for statistics, audience measurement, tracking or advertising. Consent (a cookie banner) is therefore not required.
The following items are stored:
• Customer account login: Auth.js cookies (including session and CSRF tokens). The helper cookies are kept until you close your browser; the login cookie for up to 30 days.
• Shopping cart and redeemed voucher: your browser's Local Storage; until you empty the cart or clear your browser storage.
• Selected language: cookie "NEXT_LOCALE"; until you close your browser (session cookie).
• Back navigation in the shop (last visited page): your browser's Session Storage; until you close the browser tab.
• Confirmation of the cookie notice: your browser's Local Storage; until you clear your browser storage.
• Help bubble in the bottom right corner ("Can't find what you're looking for?"): your browser's Session Storage and Local Storage. We only note when your visit began, whether the bubble has already been shown and, if you close it, that it should not appear on its own for 7 days. This information stays on your device and is not transmitted to us. The visit and display information is kept until you close the browser tab; the note that you closed the bubble for up to 7 days (or until you clear your browser storage).
When you pay, you are redirected to the website of our payment provider Stripe. Stripe sets its own cookies there and is responsible for them (see section "7. Orders, Payment and Email Delivery").
The legal basis is Section 25(2) No. 2 TDDDG (storage is necessary for us to provide the service you have expressly requested) and Article 6(1)(b) and (f) GDPR. Our legitimate interest lies in providing the website without technical errors.
You can configure your browser to notify you when cookies are set, to allow cookies only in individual cases, to block cookies in specific cases or generally, and to delete cookies automatically when the browser is closed. If you disable cookies or browser storage, the functionality of this website may be limited (for example, login and shopping cart will no longer work).
Contact Form
If you submit an enquiry via our contact form, the information you provide, together with your contact details, will be stored for the purpose of processing your enquiry and responding to any follow-up questions.
We will not disclose this information without your consent.
Where your enquiry relates to the performance of a contract or pre-contractual measures, processing is carried out pursuant to Article 6(1)(b) GDPR.
In all other cases, processing is based either on our legitimate interest in handling enquiries efficiently pursuant to Article 6(1)(f) GDPR or on your consent pursuant to Article 6(1)(a) GDPR, where consent has been requested.
Your data will remain with us until:
you request its deletion;
you withdraw your consent; or
the purpose for processing no longer applies (for example, once your enquiry has been fully resolved).
Mandatory statutory retention periods remain unaffected.
Contact by Email or Telephone
If you contact us by email, telephone or fax, your enquiry, together with any personal data arising from it (such as your name and the content of your enquiry), will be stored and processed for the purpose of handling your request.
We will not disclose this information without your consent.
Processing is carried out pursuant to:
Article 6(1)(b) GDPR, where necessary for contractual or pre-contractual purposes;
Article 6(1)(f) GDPR, where based on our legitimate interest in responding efficiently to enquiries; or
Article 6(1)(a) GDPR, where processing is based on your consent.
Your personal data will be retained only for as long as necessary to process your enquiry or as required by applicable statutory retention obligations.
5. Web Analytics with Vercel Web Analytics
To improve our offering we use Vercel Web Analytics provided by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, with whom we also host this website (see section "2. Hosting").
According to Vercel, Vercel Web Analytics works without cookies and without storing information on your device. Visitors are not tracked across websites and are not stored by IP address. Counting relies only on a hash value derived from the request, which is automatically discarded after 24 hours at the latest. Only aggregated statistics are evaluated.
The following data may be collected: page visited (URL) and time, referrer (where the visit came from), approximate geolocation (country, region, city), operating system and version, browser and version, and device type (mobile, tablet, desktop). Customer account and checkout pages are not recorded.
The legal basis is our legitimate interest in the statistical evaluation and improvement of our offering (Article 6(1)(f) GDPR). Because no information is stored on or read from your device, consent under Section 25 TDDDG is not required. You may object to this processing at any time by contacting us (see "Information about the Data Controller"). Vercel also processes data in the USA; the basis is the Standard Contractual Clauses referred to in section 2.
6. Newsletter
Newsletter Subscription
If you subscribe to our newsletter, we require your email address together with information that enables us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter.
No further data is collected unless you provide it voluntarily.
Your data will be used exclusively for sending the requested newsletter and will not be disclosed to third parties.
The processing of the data entered into the newsletter subscription form is carried out solely on the basis of your consent pursuant to Article 6(1)(a) GDPR.
You may withdraw your consent at any time by clicking the "Unsubscribe" link included in every newsletter.
Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.
Your data will remain stored until you unsubscribe from the newsletter or until the purpose of processing no longer applies.
Following your unsubscribe request, your email address may be retained on a suppression list (blacklist) to ensure that you do not receive future newsletters.
This processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR.
You may object to this processing where your interests override our legitimate interests.
7. Orders, Payment and Email Delivery
Payment processing (Stripe)
Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. When paying you are redirected to Stripe's website. Stripe sets its own cookies there (including for fraud prevention) and is responsible for them; information is available at https://stripe.com/privacy. We pass on to Stripe the data required for the payment (name, email address, billing and delivery address, order amount). The legal basis is Article 6(1)(b) GDPR.
Email delivery (Resend)
We use the service Resend (Resend, Inc., USA) to send order confirmations, invoices and the newsletter. Your email address and the content of the message are processed for this purpose. Data is transferred to the USA on the basis of the EU-US Data Privacy Framework (adequacy decision of the European Commission) and, additionally, on the basis of Standard Contractual Clauses. The legal basis is Article 6(1)(b) GDPR or, for the newsletter, your consent (Article 6(1)(a) GDPR, double opt-in, revocable at any time via the link in every email).
8. Linked Services (Twitch, Discord, Instagram)
Our website contains links to Twitch, Discord and Instagram. No content from these providers is embedded. Data is only transferred to the respective provider once you click a link; their privacy policies apply there. Our server queries the live status of our Twitch channel; your IP address is not transmitted to Twitch in the process.
International Data Transfers
Please note that your personal data may be transferred to, stored in and processed in countries outside your country of residence.
Your personal data may also be processed by our employees, service providers and business partners located in those countries.
Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on recognised transfer mechanisms, including:
the European Commission's Standard Contractual Clauses (SCCs);
equivalent transfer mechanisms approved under UK data protection law; or
transfers to countries that have been recognised by the relevant authorities as providing an adequate level of data protection.
Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy at any time to ensure that it remains compliant with current legal requirements or to reflect changes to our services.
The version published on this website at the time of your visit shall apply.
Contact
If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact:
Memory Card – Cards & Collectibles
Email:
support@memorycardtcg.com
---
Quellen: https://www.e-recht24.de und teilweise erstellt mit dem Datenschutz Generator von AdSimple.