Privacy Policy

1. Data Controller

The Data Controller for the processing of personal data is:

TcgSellers is committed to protecting users' privacy in compliance with the General Data Protection Regulation (GDPR) EU 2016/679 and applicable Italian law.

2. Data We Collect

2.1 Store Data (TcgSellers Management Software)

To provide the store management service, we collect the following data:

• Identification data: email, password (encrypted), store name, physical address, phone number
• Geolocation data: the store's GPS coordinates (for the map on PlayerHub)
• Business data: store logo, product inventory, sales data, transactions, prices
• Event data: tournaments organized, participation, results
• Store Credit data: players' digital credit balance, transaction history

2.2 Player Data (PlayerHub App)

Players using the PlayerHub app provide:

• Account data: email, password (encrypted), first name, last name, avatar
• Preferences: favorite games, card wishlist
• Interactions: followed stores, Store Credit balance per store, event registrations
• Device token: for push notifications (Firebase Cloud Messaging)

3. Purposes of Processing and Legal Basis

Your personal data is processed for the following purposes:

4. Cookies and Tracking Technologies

TcgSellers uses cookies and similar technologies to ensure the platform works correctly.

4.1 Technical Cookies (Strictly Necessary)

These cookies are essential for the site to function and do not require consent:

• Session cookies: keep you authenticated while browsing
• Preference cookies: store language and user preferences (localStorage)

4.2 Analytics Cookies

With your consent, we use:

• Google Analytics 4 (ID: G-G987SV9NQB): to analyze traffic and improve the user experience. The IP address is anonymized (anonymize_ip: true).

4.3 Managing Preferences

You can change your cookie preferences via the banner shown on your first visit. To withdraw consent for analytics cookies, you can delete cookies from your browser or use the cookie banner settings on the site.

5. Data Sharing and Third-Party Services

TcgSellers does not sell your personal data to third parties. Data may only be shared with the following service providers, acting as Data Processors:

Transfers outside the EU: Some services (Google Analytics, Firebase) involve data transfers to the United States. These transfers are protected by the Standard Contractual Clauses (SCC) approved by the European Commission and the EU-US Data Privacy Framework.

6. Data Retention Periods

Your personal data is retained for the time necessary to fulfill the purposes for which it was collected:

• Active account data: for the entire duration of the contract (monthly subscription or free app use)
• Deleted account data: data is removed within 30 days of the deletion request, unless otherwise required by law
• Tax and accounting data: 10 years from the end of the contract (legal obligation)
• Weekly backups (Dropbox): kept for 4 weeks, then automatically overwritten
• Access and security logs: 12 months

7. Data Security

TcgSellers adopts appropriate technical and organizational measures to protect personal data from unauthorized access, loss, destruction or accidental disclosure:

• HTTPS encryption: all communications between the user and the server are protected by an SSL/TLS certificate
• Encrypted passwords: passwords are hashed with bcrypt/argon2 algorithms, never stored in plain text
• Automatic weekly backups: to protect against accidental data loss
• Access control: data access is restricted to authorized personnel with strong authentication
• Monitoring and logging: logging of anomalous activity to detect unauthorized access
• Regular updates: security patches and software updates applied continuously

8. User Rights (GDPR)

In accordance with the GDPR, you have the following rights over your personal data:

• Right of access (Art. 15 GDPR): request a copy of your personal data held by us
• Right to rectification (Art. 16 GDPR): correct inaccurate or incomplete data
• Right to erasure "right to be forgotten" (Art. 17 GDPR): request the removal of your data, unless otherwise required by law
• Right to restriction (Art. 18 GDPR): temporarily restrict processing in specific circumstances
• Right to data portability (Art. 20 GDPR): receive your data in a structured, machine-readable format (CSV, JSON)
• Right to object (Art. 21 GDPR): object to processing based on legitimate interest (e.g. marketing)
• Right to withdraw consent (Art. 7 GDPR): withdraw consent to analytics cookies or push notifications at any time
• Right to lodge a complaint: file a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali): www.garanteprivacy.it

9. Privacy in the PlayerHub App

PlayerHub is a free mobile app for TCG players, available on iOS and Android. This section describes the app's specific data processing.

9.1 Features and Data Collected

• Store discovery: map of nearby TcgSellers stores (uses the stores' public GPS coordinates, not your location)
• Store Credit: view the digital credit balance you hold at TcgSellers stores
• Events: tournament calendar, registrations, results
• Wishlist: save the cards you're looking for and get notified when a store makes them available

9.2 Push Notifications

Push notifications are sent via Firebase Cloud Messaging. Notifications are:

• •Targeted and manual: sent by the store to specific groups of players (e.g. "New Modern tournament", "Cards you were looking for are available")
• •Optional: you can disable them from the app or device settings at any time

9.3 Data Shared Between Store and Player

TcgSellers stores can see the following data of PlayerHub players who interact with them:

• •First name, last name, avatar (if the player takes part in the store's events)
• •Store Credit balance specific to that store
• •Wishlist (only if the player follows the store)

Stores CANNOT see your email, password, or your data relating to other stores.

9.4 Minors (under 16)

PlayerHub may only be used by minors under 16 with the consent of a parent or legal guardian. If we become aware of data collected from minors without parental consent, we will delete it immediately.