Privacy policy

PokePlugTCG Privacy Policy

Last updated: 8 October 2026

PokePlugTCG handles personal data carefully. This privacy policy explains which data we process, why we do so and what rights you have.

1. Who is responsible?

LekCar, trading as PokePlugTCG, is responsible for the processing of personal data described in this policy.

Address: Nering Bögelweg 99
Postcode and city: 7418 HJ Deventer, Netherlands
Chamber of Commerce number: 42049840
Email address: pokeplugtcgnl@gmail.com

For privacy questions or to exercise your rights, you can contact us at the email address above.

2. Which data do we process?

Depending on how you use our webshop, we process:

• Name, billing address and delivery address.
• Email address and telephone number, if you provide them.
• Order details, purchased products, amounts and payment status.
• Information about shipping, returns and refunds.
• Messages and other information you provide to our customer service.
• Account details, if you create a customer account.
• Technical data, such as IP address, browser, device and information about use of the webshop.
• Cookie preferences and, where applicable, consent to newsletters or marketing.

Payment details are processed by the payment provider you use at checkout. The payment details we receive depend on your chosen payment method.

We receive data directly from you and, where necessary, from our webshop, payment and delivery service providers.

3. What do we use your data for?

Orders and customer service
We use data to process orders, handle payments, deliver products and deal with questions, returns and complaints. The legal basis is performance of the contract or taking steps at your request before a purchase.

Statutory record-keeping
We retain necessary order, invoice and payment details to meet tax and other statutory obligations. The legal basis is a legal obligation.

Security and fraud prevention
We may use technical, order and payment data to investigate misuse, secure our webshop and defend our rights. The legal basis is our legitimate interest in safe business operations and fraud prevention. We take your privacy interests into account.

Newsletters
If we offer a newsletter and you consent to it, we use your data to send it. You can unsubscribe at any time using the unsubscribe option in the newsletter or by emailing us. Unsubscribing does not affect necessary messages about your order.

Analytics and marketing
To the extent that we use analytics or marketing technology requiring consent, we process the associated data only after you have consented. You can later withdraw this consent through the available privacy or cookie settings.

4. With whom do we share data?

We share personal data only when necessary for the purposes described. Depending on the services used, this concerns:

• Shopify, for providing and managing our webshop.
• Payment providers, for payments, refunds and relevant payment checks.
• Delivery services, for delivering orders.
• Service providers for email, customer service and technical support.
• Accounting or legal service providers, for administration and advice.
• Analytics or marketing service providers, to the extent they are used and there is a valid legal basis.
• Public authorities, when we are legally required to provide data.

Service providers receive only the data necessary for their work. When they act as processors on our behalf, we make the required arrangements for processing and security.

Some service providers, such as certain payment providers, also process data under their own responsibility. Their privacy policies are then also relevant.

5. Shopify and processing outside the EEA

Our webshop uses Shopify. Shopify and other service providers may process personal data outside the European Economic Area.

When data is transferred outside the EEA, valid safeguards must exist, for example an adequacy decision of the European Commission or approved standard contractual clauses, with additional measures where necessary.

You can ask us for more information about the safeguards applicable to a specific transfer.

More information about Shopify is available at:
https://www.shopify.com/legal/privacy

6. Cookies and similar technology

Our webshop uses functional cookies and similar technology needed for purposes such as the shopping cart, checkout and remembering privacy choices.

For analytics and marketing cookies requiring consent, we ask for consent in advance. You can refuse these cookies or later change your consent without affecting your statutory rights when making a purchase.

Information about the cookies used, providers and retention periods is made available through our cookie information or privacy settings.

You can also delete or block cookies through your browser. This may cause certain webshop functions to work less well.

7. How long do we retain data?

We do not retain personal data longer than necessary for the purpose for which it was collected.

• Data subject to statutory tax retention requirements is generally retained for seven years. If a longer statutory period applies, we follow that period.
• Other order, return and complaint data is retained for as long as necessary for handling, warranty and any legal claims.
• Individual customer service messages are retained for as long as necessary to handle your question and relevant follow-up questions.
• Account data is retained for as long as the account is used. Upon deletion, data needed for statutory obligations or ongoing orders may be retained.
• Newsletter data is retained until you unsubscribe. A limited record of your unsubscribe request or previous consent may be retained to respect your choice and demonstrate compliance.
• Technical data is retained for as long as necessary for security and the functioning of the webshop.
• Cookie retention periods are stated in the corresponding cookie information.

If data is needed for an ongoing dispute or a legal obligation, we may retain the relevant data for longer.

8. How do we secure data?

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

Access to personal data is limited to people and service providers who need it for their work. No digital environment can guarantee absolute security; this does not affect our statutory security obligations.

9. Your privacy rights

Subject to the conditions of the GDPR, you may:

• Request access to your personal data.
• Have inaccurate or incomplete data corrected.
• Request deletion of data.
• Request restriction of processing.
• Object to processing based on a legitimate interest.
• Object to the use of your data for direct marketing.
• Request data portability where this right applies.
• Withdraw previously given consent.

Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Send your request to pokeplugtcgnl@gmail.com. We may request additional information to verify your identity appropriately. Do not send a full copy of your identity document without being asked.

We generally respond within one month. Where the law permits an extension, we inform you within that month of the extension and its reason.

Some data cannot be deleted immediately due to statutory retention requirements or other valid legal reasons. We will explain this.

10. Automated decisions

If a service used makes a solely automated decision with legal or similarly significant effects on you, the relevant GDPR safeguards apply. Where applicable, you may request human review, explain your position and contest the decision.

11. Privacy complaints

Do you have a question or complaint about our use of personal data? Contact pokeplugtcgnl@gmail.com.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
https://www.autoriteitpersoonsgegevens.nl

12. Changes

We may amend this privacy policy when our services or data processing change. The current version appears on this page with the date of the last update.

If a change requires new consent, we ask for it before starting the relevant processing.