What we do with your data

Who's responsible

LoadedTCG is operated by Loaded Dice Ltd (company number 12429789, VAT GB 342132248), Unit C4, Windmill Parc, Hayes Road, Sully, Vale of Glamorgan, CF64 5AD. We're the data controller for anything described here. Email customerservice@loadeddice.uk about any of it.

What we collect, and why

If you ask for an alert

When you ask to be told about a price, a release date or a restock, we store your email address, what you asked about, the price you set if you set one, the page you asked from, and the time. We keep that both in our own database and in Klaviyo, the service that sends the email.

We do that because you asked us to — it's the thing you signed up for, and we can't send it otherwise.

If you sign in and track a collection

Signing in happens on Loaded Dice, not here. You type your password into Shopify's own login screen and it never reaches this site — all we get back is an identifier saying which customer you are. We don't receive or store your password, your name, your address or your order history.

Against that identifier we store the cards you tell us you own: which card, how many, the condition if you say, what you paid if you say, and the date. We also record what the whole collection was worth once a day, because a value with no history isn't much use.

We do that because you asked us to — it's the feature you signed in for. You can delete all of it from the collection page whenever you like, and it goes straight away.

Marketing, separately

The alert and marketing are two different permissions and we treat them that way. The box offering news and offers is unticked, and stays unticked unless you tick it. Only if you tick it do we record marketing consent, and only then do you join the mailing list. We keep a record of when you gave that consent and which page you gave it on, because that's the evidence that you did.

Every marketing email has an unsubscribe link, and it works immediately.

If you offer us cards to buy

A buylist submission tells us what you're selling, and we store it: your email address, your name and postcode if you give them, your phone number if you give it, the list of cards, any photographs you attach, and what you'd like to be paid in. Photographs are held in Cloudflare's object storage; everything else sits in the same database as the rest of the site.

We use it to quote for your cards and, if you accept, to arrange getting them and paying you — the ordinary business of the transaction you started. We may ask for identification on a high-value purchase; that's how a shop avoids handling stolen collections, and we keep only what we need to show the check was done.

If you send cards for grading

A grading submission tells us what you'd like graded, and we store it: your email address, your name and phone number if you give them, the list of cards and what you reckon each is worth, and which service you picked. You get a private link to watch its progress; anyone with that link can see the submission, so it goes to your address and nowhere else.

We photograph every card, front and back, before it leaves the shop. That is not optional and it is not for marketing. The grading company will not assess a card's condition when it arrives with them — their policy says any defect found at that point is treated as having already been there — and once you hand cards over, the law puts the burden on us to show we looked after them. Without a photograph neither you nor we could prove what a card looked like when it changed hands. You can see those photographs on your own tracking page; they are held in Cloudflare's object storage in the EU, like the buylist ones.

The list of cards and their declared values goes to the grading company along with the cards themselves, because that is what a submission is. Your contact details do not — we are the customer on their side of it.

Sending us a list doesn't sign you up to anything. It isn't consent to marketing and we don't treat it as such.

Your IP address

When you submit a form we count submissions against your IP address, to stop the form being used for spam. That count is held for one hour and then deleted automatically. We don't use it for anything else and we don't build a profile from it.

Server logs

The site runs on Cloudflare, which handles requests and keeps short-lived operational logs — the ordinary business of serving a web page and blocking attacks on it.

Analytics

None. This site currently runs no analytics of any kind — no Google Analytics, no tracking pixels, nothing counting you. If that changes, this section changes with it: it's generated from the same setting that would switch analytics on.

Cookies

We set one cookie of our own, and only if you sign in: a session cookie that remembers which Loaded Dice customer you are so the collection page can show you your cards. It holds nothing but that identifier and an expiry, it's signed so it can't be altered, and signing out deletes it. There's no basket and nothing else remembered about you between visits. Cloudflare may set strictly necessary cookies to keep the site up and fend off attacks. Nothing here sets an advertising or tracking cookie.

Who else sees it

• Cloudflare — hosting, the database, object storage for buylist and grading photographs, and the spam checks. Our infrastructure.
• Klaviyo — sends the alerts and any marketing you've agreed to. Klaviyo is based in the United States, so your email address is transferred outside the UK; that transfer relies on the safeguards in Klaviyo's data processing terms.

We don't sell your data, we don't share it for anyone else's marketing, and the services that provide our card prices and release dates never receive anything about you — that traffic goes the other way.

Links to Loaded Dice take you to a different site with its own privacy notice. Following one tells the shop you arrived from here; it doesn't carry your email address or anything else about you.

How long we keep it

• Alerts — until the alert has been sent, or until you ask us to remove it. Ask and it's gone within 30 days.
• Marketing consent — for as long as you're subscribed, plus a record of the consent itself afterwards so we can show it was given and when.
• Buylist submissions — a quote we didn't go ahead with is deleted after six months. Where we did buy your cards, we keep the record as long as the law requires us to keep records of a purchase — but not the photographs, which go after six months either way. A purchase record does not need pictures.
• Grading submissions — the record and the photographs are kept for six months after the job finishes, then deleted. Six months rather than six weeks because the photographs are the evidence if anything is ever disputed about a card's condition, and that argument can surface late.
• Your collection — for as long as you keep it. You can delete the whole thing yourself from the collection page, at any time, and it goes immediately along with its value history. We don't keep a copy.
• Spam counts — one hour.

Your rights

You can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, object to what we're doing with it, or withdraw consent at any time. Email customerservice@loadeddice.uk and we'll deal with it within a month.

If we get it wrong you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.

Children

This site isn't aimed at children and we don't knowingly collect data from anyone under 13. If you think we have, tell us and we'll delete it.

Changes

If this notice changes, the date at the top changes with it. If a change is significant and we hold your email address, we'll tell you rather than quietly editing the page.