Privacy Notice

For the purposes of the UK GDPR, the controller of personal data described in this notice is Coastal Cards (we, us, our).

We have not appointed a data protection officer. Enquiries about this notice, and requests to exercise the rights described in clause 12, should be made using the contact methods published from time to time on the About page.

We have not published an Information Commissioner's Office registration number on this website. If and when such a number is allocated and we are required to state it, it will appear on this page.

This notice applies to personal data processed when you visit this website, use browser storage features on it, send us a message about stock or about selling cards to us, open a shareable basket link, download an event calendar file, attend an in-person meeting or fair date arranged through this site, or sell or trade goods to us.

It does not apply to websites, applications, or messaging platforms that we do not control. If you contact us through WhatsApp, email, social media, or a similar service, that provider processes your data under its own terms and privacy notice.

This notice should be read with the Terms of Use. If there is any inconsistency as to how a contract is formed or how goods are sold, the Terms of Use prevail. This notice prevails on the subject of personal data.

Depending on how you deal with us, we may process: (a) identifiers and contact details you choose to send, such as a name, telephone number, email address, or messaging handle; (b) the content of your messages, including any list of items, notes, and photographs you attach, including messages started from the Sell to us or Coming soon pages; (c) information about a proposed or completed in-person transaction, including items discussed, prices agreed, and the payment method used; (d) identity, ownership, and source-of-funds information where we request it in connection with a purchase from you or otherwise in connection with financial crime duties; (e) technical data generated by your browser or by our hosting and measurement providers, such as IP address, approximate location derived from IP address, device and browser type, pages viewed, referring URL, and timestamps; and (f) accessibility, theme, filter, sort, density, recently viewed, and list preferences stored in your browser.

If you copy or share a basket link, the link may contain product identifiers and quantities in the web address. Anyone you send that link to can see those identifiers. We do not receive that link unless you send it to us.

We do not ask you to send payment-card numbers through this website. You must not type payment credentials into notes or messages on or via this site.

We do not knowingly seek special category data. Please do not send it.

This website stores certain information on your device so that the site functions as designed. That information remains on your device unless you send it to us or your browser transmits it as part of ordinary web traffic.

The storage presently used includes: coastal-theme (colour theme); coastal-a11y (accessibility preferences); coastal-sort and coastal-density (stock list layout); coastal-filters (saved extra filters); coastal-ask-list (your basket of items and any note); coastal-recently-viewed (product slugs you have opened); coastal-last-visit (when you last browsed stock, for a new-items hint); coastal-visit-baseline (slugs seen on an earlier visit, for that same hint); coastal-catalogue-return (where to go back to from a product page); coastal-stock-scroll (stock list scroll position in this browser); and coastal-copy-hint-dismissed (whether a first-visit copy hint has been closed).

Your basket and recently viewed items are not transmitted to us by the act of compiling them. We receive a basket only if you copy it, share it, or send it. Clearing site data in your browser deletes that local information. We cannot retrieve it for you.

This local storage is used to provide the service you request, to remember choices you have made, and to avoid repeating hints. It is not used to serve third-party advertising on this site.

This website is hosted by Vercel. Vercel processes technical data as our processor in order to deliver the site, keep it secure, and diagnose faults.

We use Vercel Analytics and Vercel Speed Insights to understand how the site is used and how quickly it loads. Those products may collect usage and performance information such as page views, referring pages, device category, and aggregated performance metrics. They are operated so that we can keep the stock list available and improve it. They are not used by us to serve advertising.

We do not operate a marketing pixel, advertising network, or social-media retargeting tag on this site. Social links on the site send you to those services, which then process data under their own notices.

We do not presently display a consent banner. Where storage or access is strictly necessary to provide a service you have requested, or where a particular measurement technology does not require consent under the Privacy and Electronic Communications (EC Directive) Regulations 2003, we may use it on that basis. If a particular technology would require consent under those Regulations, we will not use it until an appropriate mechanism is in place. You should read those Regulations yourself. This notice does not summarise them.

If you message us, we use the communication to deal with your enquiry, to indicate whether an item appears still to be available, to discuss a possible purchase of your cards, to arrange an in-person inspection and collection or fair attendance, and to keep a record of what was discussed.

If a sale, purchase, or trade proceeds, we may retain such details as are reasonably required to evidence the transaction, title, payment, and any identity or source-of-funds checks we have carried out.

Public event dates shown on this site are limited to name, date, and location. Costs and internal notes stay in our business records and are not published.

We are presently arranging a dedicated business telephone line. Until that number is published on the About page, we do not invite calls to an unpublished number, and we do not collect telephone numbers except where you choose to send one.

We process personal data only where a lawful basis under the UK GDPR applies. Depending on the activity, that basis may be: (a) legitimate interests, namely operating an informational stock list, keeping the site secure, measuring and improving it, answering enquiries, arranging in-person collection, and protecting our stock and the integrity of our trading, where those interests are not overridden by your interests or fundamental rights; (b) steps taken at your request prior to entering a contract, and performance of a contract formed in person in accordance with the Terms of Use; (c) compliance with a legal obligation, including obligations that may arise under the Proceeds of Crime Act 2002, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, tax legislation, or a court or competent authority; or (d) consent, where we ask for it and you give it. You may withdraw consent where that is the basis, without affecting processing already lawfully carried out.

You should read Article 6 of the UK GDPR yourself. This notice does not restate it.

Where you sell or trade goods to us, or in any other case where we reasonably consider it appropriate, we may request identification, evidence of title, and information about the source of funds or goods. We may record that information and the outcome of any check.

We may refuse, delay, or terminate a proposed transaction if we are not satisfied as to identity, title, or the lawfulness of the funds or goods, or if we reasonably consider that proceeding would be inconsistent with our duties. We may do so without giving a detailed reason where the law restricts what we may say.

Those checks are described further in the Terms of Use. You should read the Proceeds of Crime Act 2002 and the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 yourself. This notice does not summarise them.

We may disclose personal data to: (a) our hosting, analytics, and infrastructure providers, presently including Vercel; (b) messaging and email providers you choose to use when contacting us; (c) professional advisers, such as accountants or solicitors, where required; (d) a bank or payment counterparty to the extent needed to receive or verify a payment you have made or that we have made to you; and (e) a competent authority, court, or law-enforcement body where required or permitted by law.

We do not sell personal data. We do not share it with advertisers for their independent marketing.

Our hosting and measurement providers may process data in, or access it from, countries outside the United Kingdom, including the United States.

Where personal data is transferred to a third country, we rely on such transfer mechanism as is lawful at the time, which may include an adequacy regulation or standard contractual clauses with supplementary measures. You should read Chapter V of the UK GDPR yourself. This notice does not restate it.

Browser storage remains until you clear it, or until the site no longer uses that key.

Messages and transaction records are kept for as long as reasonably necessary to deal with the enquiry, to evidence the transaction, to meet legal, accounting, or financial-crime requirements, and to establish, exercise, or defend legal claims. Retention periods vary with the nature of the record and the limitation period that may apply.

Technical logs kept by our host are retained according to that provider's configuration and our need to diagnose faults and protect the site.

Subject to the conditions and exemptions in the Data Protection Act 2018 and the UK GDPR, you may have the right to request access to personal data we hold about you, to request rectification, erasure, or restriction, to object to processing based on legitimate interests, and, where the conditions are met, to data portability.

Those rights are not absolute. We may refuse a request where an exemption applies, including where disclosure would prejudice the prevention or detection of crime, or where we cannot identify you from the information you provide.

You should read the Data Protection Act 2018 and the UK GDPR yourself. This notice does not summarise your rights. To make a request, use the contact methods on the About page. We may need to verify your identity. We aim to respond within one month, or to tell you if more time is needed as permitted by law.

You also have the right to complain to the Information Commissioner's Office. Details are published at https://ico.org.uk/ . Taking that step does not affect any other remedy you may have.

This website is a stock list for a trading-card business. It is not directed at children. We do not knowingly seek to collect personal data from children through this site. If you believe we have done so, contact us using the About page and we will delete it where we are not required to retain it.

We do not use personal data for solely automated decision-making that produces legal or similarly significant effects concerning you, including profiling of that kind.

We take such technical and organisational measures as we reasonably consider appropriate to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. No method of transmission or storage is completely secure. You should take care when sending messages over public networks.

We may revise this notice at any time. The date at the head of this page is the date of the current version. Continued use of the website after a revision constitutes notice of the revised terms of processing for that use. Processing already carried out remains subject to the notice in force at the time of that processing, except where the law requires otherwise.

Questions about this notice, and requests to exercise data-protection rights, should be sent using the contact methods published on the About page.

Until a business telephone number and a usual premises address are published there, those details are not available. Company number, VAT number, and registered office will be stated once Companies House registration is complete and those details are published.