Privacy Policy

01Who is responsible for your data

The data controller for this website and for orders placed through it is THE TCG SHOP LTD, trading as Level Merchant. We are registered in England and Wales under company number 15583242, our VAT number is GB 470192305, and our registered office is at 47 Hollywood Lane, Hollywood, Birmingham, England, B47 5PT.

We do not have a separate data protection officer, because we are a small family business; instead, privacy questions are answered by the people who run the shop. You can reach us using the details below.

• Email: [email protected]
• Telephone: +44 121 496 0735
• Post: 47 Hollywood Lane, Hollywood, Birmingham, England, B47 5PT

02What we collect

When you place an order we collect your name, email address, telephone number and delivery address, together with the items you bought and the delivery option you chose. If you write to us, we keep the conversation so that we can help you properly if you get in touch again.

We do not collect or store full card numbers. Payments are made through a secure link handled by our payment providers, who tell us only whether the payment succeeded and, where relevant, the last few digits of the card so that we can match a refund. Our website also uses a small number of cookies, described in our Cookie Policy.

03How and why we use it

Data protection law asks us to explain the lawful basis for each use. Most of what we do is needed to perform our contract with you; some of it is required by law; and a little of it relies on your consent, which you can withdraw at any time.

• Processing and delivering your order, sending the payment link and dispatch updates (contract).
• Handling returns, refunds and questions about missing pieces (contract).
• Keeping sales and VAT records as required by HMRC (legal obligation).
• Preventing fraud and keeping our website secure (legitimate interests).
• Optional website analytics, only if you accept them in the cookie banner (consent).

04Who we share it with

We share only what is necessary with the companies that help us run the shop: our payment providers to take payment, our couriers to deliver your parcel, and the hosting and email services that keep the website and our inbox working. Each of them may use your data only to provide their service to us.

We never sell your personal data, and we never pass it to other businesses for their own marketing. We may disclose information if the law requires it, for example to answer a lawful request from the police or HMRC.

05How long we keep it

Order records, invoices and the details needed to support them are kept for 6 years after the end of the financial year in which the sale took place, because accounting and tax law require it. Customer service emails are normally kept for 2 years after the last contact and then deleted.

Favourites you save on our website are stored in your own browser, not on our systems, so they stay with you until you clear them. Analytics information, where you have consented, is kept in aggregated form only.

06Your rights

Under the UK GDPR you have a number of rights over your personal data. To use any of them, simply email [email protected] and tell us what you would like. We will respond within one month and there is normally no charge.

• Access: ask for a copy of the data we hold about you.
• Rectification: ask us to correct anything inaccurate or incomplete.
• Erasure: ask us to delete your data where we no longer need it.
• Restriction: ask us to pause using your data while a concern is looked into.
• Portability: receive your data in a common, machine-readable format.
• Objection: object to processing based on our legitimate interests.

07Security, changes and complaints

Our website is served over an encrypted connection, access to order information is limited to the people who need it, and we choose service providers who take security seriously. No system is perfect, but if something did go wrong we would act quickly and tell you where the law requires.

If you are unhappy with how we have handled your data, please talk to us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. We will post any changes to this policy on this page, with a new date at the top.