Privacy

Who we are

Dead Good Cards is the data controller for everything described here.

• Legal entity: Dead Good Cards
• Data enquiries: admin@deadgoodcards.com
• Everything else: the contact page

We are not big enough to have a Data Protection Officer, and we are not required to have one.

The short version

• We only ask for what we need to do the thing you asked for.
• We never sell your details, and we don't run a mailing list.
• We do not use tracking cookies, so there is no cookie banner.
• You can ask us what we hold, and ask us to delete it. We answer within one month.

At a glance

What you did	What we collect	Why we may (lawful basis)	How long
Sent an enquiry	Name, email, message, route	Legitimate interests — Art. 6(1)(f)	12 months after it closes
Offered us a collection	Name, email, outward postcode, what you have, photos	Pre-contract steps — Art. 6(1)(b)	30 days if we don't buy
We bought your cards	The above, plus address and payment reference	Legal obligation — Art. 6(1)(c)	6 years (tax), photos 365 days
Just visited	Nothing that identifies you	—	—

Enquiries

When you use the contact form we collect your name, your email address, your message, which of the five routes you picked, and any optional extras that route asks for.

We use it to answer you, and to send you one automatic acknowledgement so you know it arrived. That is the entire purpose. This form does no marketing and adds you to no list. If you want the newsletter, there is a separate tickbox on a separate page, which is how it should be.

Our lawful basis is legitimate interests (Art. 6(1)(f)): you volunteered your details so that we would reply, replying is the obvious expected use, it is the minimum needed, and it carries no real risk to you. We deliberately do not rely on consent here — if you withdrew it we would be obliged to stop replying, which serves nobody.

Name, email and message are all necessary. Without them we cannot reply.

Who else sees it: Cloudflare (hosting, the spam check, and inbound mail routing), Resend (sends the two emails), and Google (the inbox we read it in). All three are processors acting on our instructions.

How long: we delete the thread 12 months after the enquiry closes. If it became a purchase or a sale, normal business records apply instead and we keep those for six years, because HMRC expects us to.

Selling us your cards

When you use the sell form we collect your name, email, the outward half of your postcode only (so "L1", not the whole thing), roughly what you have, what era, what you hope to get, whether you'd prefer bank transfer or store credit, and a declaration that you're over 18 and the cards are yours to sell. We also record your IP address and browser with the submission, for security.

We ask for the outward postcode alone because at that stage all we need to know is whether you're near enough to collect from. We ask for your full address only after we've agreed a deal, by reply, when we need it to pay you and to keep the purchase record.

Our lawful basis is taking steps prior to entering into a contract at your request (Art. 6(1)(b)). We also rely on legitimate interests (Art. 6(1)(f)) for fraud and stolen-goods checks, for keeping a record of offers we declined, and for security logging. If we buy from you, the purchase record is kept under legal obligation (Art. 6(1)(c)) because tax law requires it.

We do not do any automated decision-making. A submission gets a rough score to decide what order we open things in. A human decides everything that matters.

Who else sees it: Cloudflare (hosting and the spam check), Resend (sends the email your photos are attached to), Google (the mailbox those photos then sit in), our accountant, our bank, and a courier if you post the cards. And the police, if we have genuine reason to believe the items are stolen. We'd rather say that plainly than bury it.

How long: if we don't buy, or you don't reply, everything goes 30 days after we close the enquiry. A live enquiry is held up to 90 days. If we do buy, the purchase record — name, address, item, price, payment reference — is kept for six years in our ledger, which is a different place from the photographs.

You do not have to give us any of this. If you'd rather not use a form, email admin@deadgoodcards.com and we'll do it by email instead.

Photographs you send us

Photographs of your cards are not stored on our website or our servers at all. They are attached to one email that comes to us, and that email is the only copy. There is no photo library, no admin gallery, and no link that could be guessed or shared. They are never published, never posted, and never used in content without asking you first and separately.

Your phone writes GPS coordinates into photos by default. We strip all of that in your browser, before anything is uploaded — the file that leaves your device has no location, no device identifier and no timestamp metadata. That is a deliberate safety control, not a file-size optimisation: a photo of the inside of your house, next to your name and postcode, is exactly the combination nobody should be holding.

How long: 30 days if we don't buy. 365 days if we do, as proof of what we bought. Because that email is the only copy, deleting it is how the photos get deleted — we do that by hand on this schedule, not by an automatic timer. Longer only for higher-value lots where provenance genuinely matters, and if that applies to you we'll say so at the time.

Partner links

The PulseTCG card is a partner link and carries our promo code. It's labelled Ad before you click it, because finding out afterwards isn't disclosure.

The price you pay is exactly the same either way. We don't collect anything when you click it; PulseTCG sets its own cookies on its own site once you get there, under its privacy policy, not ours. We count clicks as a plain number with nothing attached — no IP address, no identifier, no way back to you.

Cookies, and why there's no banner

We set no tracking cookies and run no third-party analytics that identifies you. That is why you haven't been asked to accept anything.

Two things do store data in your browser, and neither is a cookie in the sense the law cares about — both are strictly necessary or entirely local:

• dgc-pack-opened, dgc-best, dgc-match-best, dgc-sell-draft — kept on your device so the booster pack doesn't replay, the game remembers your score, and a half-finished sell form isn't lost. Never sent to us. Clear your browser data and they're gone.
• Cloudflare Turnstile, the spam check on our forms, sets what it needs to tell a human from a bot. It replaces a CAPTCHA and does not track you across sites.

Sending data outside the UK

Two of our processors involve a transfer out of the UK, and we'd rather name them than gesture at "international partners":

• Resend (the service that sends our emails) sends from Ireland, but its account data, metadata and message logs sit in the United States. Message logs are kept for 30 days.

Google holds our mailbox, which is where your photographs live once they reach us, on servers that may sit outside the UK. That transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We're aware that's a sentence nobody enjoys; the alternative was not naming it.

Your rights

You can ask us to: tell you what we hold, correct it, delete it, give you a copy in a portable format, restrict what we do with it, or stop entirely.

You have the right to object. We're flagging that separately because we're supposed to, and because it's the one people don't know about: where we rely on legitimate interests — enquiries, fraud checks, security logging — you can tell us to stop and we have to justify carrying on or stop.

Email admin@deadgoodcards.com. We reply within one month. It's free, and we won't ask you why.

Complaining

Tell us first — admin@deadgoodcards.com — because we can usually just fix it.

If we don't sort it out, you have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113. Complaining to them does not cost you anything and does not affect anything else.

Changes to this notice

If we change something that matters, we bump the date below.

Last updated 26 August 2026