Privacy policy
We take care of your personal data and openly explain what we store, why and for how long.
Last updated: November 2026 · Applies to anistoretcg.dk
🏢 Data controller
The data controller responsible for processing your personal data is:
AnistoreTCG
CVR: 46346408
E-mail: tw@anistoretcg.dk
Website: anistoretcg.dk
📋 What we collect
When you buy
- Name, delivery address and any chosen parcel shop (for delivery)
- E-mail (for the order confirmation and tracking e-mail)
- Phone number (for PostNord's delivery notification)
- Card details are entered with Stripe and are never seen or stored by us
When you withdraw from a purchase
- Order number, e-mail and what you write to us when you withdraw
When you sign up for the newsletter
- E-mail and language
- Time of sign-up and confirmation (evidence of your consent)
When you write to us (contact or "Sell your cards")
- Name, e-mail and optionally phone number
- The content of your message, e.g. the list of cards you want to sell
When you visit the site
- Our web host records technical logs (IP address and time) for operations and security
- To prevent form abuse we briefly store a hashed (unreadable) version of your IP address
⚖️ Purpose and legal basis
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Order processing and delivery | Art. 6(1)(b) – performance of a contract | 5 years after the end of the financial year (Bookkeeping Act) |
| Order confirmation, status and tracking e-mails | Art. 6(1)(b) – performance of a contract | As the order |
| Customer service and complaints | Art. 6(1)(b) and (c) – contract and legal obligation | Until the complaint period ends |
| Handling withdrawals | Art. 6(1)(c) – legal obligation | As the order |
| Newsletter | Art. 6(1)(a) – consent (double opt-in) | Until you unsubscribe |
| Contact and sell offers | Art. 6(1)(f) – legitimate interest in answering you | Up to 12 months after the last contact |
| Protecting the forms against abuse | Art. 6(1)(f) – legitimate interest in secure operation | At most 24 hours (hashed IP) |
🍪 Cookies and browser storage
We only use what is necessary for the shop to work. That does not require consent, which is why we do not show a cookie banner.
| Name | Purpose | Lifetime |
|---|---|---|
anistore_cart | Remembers your cart (local browser storage) | Until you empty the cart |
lang | Remembers your language choice | 12 months |
anistore_admin | Login for shop staff (admin only) | Until the browser is closed |
We use no analytics or marketing cookies. Fonts and images are served from our own servers and storage, so your visit is not shared with Google or social networks.
🌐 Data processors
We only share your data with the processors needed to run the shop:
- Stripe Payments Europe Ltd. (Ireland): payment. You enter card details directly with Stripe, which is PCI-DSS certified.
- PostNord: delivery. Name, address and phone number are sent to PostNord so they can deliver the parcel.
- Supabase: database for orders, newsletter and products, hosted in the EU.
- Google Workspace (Google Ireland Ltd.): e-mail, e.g. order confirmations and replies to enquiries.
- Simply.com A/S (Denmark): web hosting and technical logs.
All processors are covered by data processing agreements under GDPR Art. 28. Any transfer outside the EU/EEA follows the European Commission's Standard Contractual Clauses.
✋ Your rights
Under the GDPR you have the right to:
- Access the data we process about you.
- Rectification of incorrect data.
- Erasure — although we must keep order data under the Bookkeeping Act.
- Restriction of processing in certain cases.
- Object to processing based on legitimate interest.
- Data portability — receiving your data in a machine-readable format.
- Withdraw your consent — e.g. unsubscribe from the newsletter via the link in every e-mail.
You can complain to the Danish Data Protection Agency at datatilsynet.dk.
📧 Contact about personal data
Write to tw@anistoretcg.dk. We reply within 30 days at the latest, as the GDPR requires.