Privacy Policy - Ares TCG

ARES TCG — last updated 1 November 2026

1. Who is responsible for your data?

ARES TCG is responsible for the personal data processed through arestcg.eu and its customer service.
Address: Wielrenner 30, 5146 EN Waalwijk, The Netherlands
Chamber of Commerce (KvK): 98241117
VAT identification number: NL005319579B55
Email: info@arestcg.eu

2. Data we process and why

Orders and delivery: your name, billing and delivery addresses, email address, telephone number if provided, purchased products, order details and delivery information. We need these to conclude and perform our contract, arrange delivery and provide customer service. If required order information is missing, we may be unable to fulfil the order.
Payments and accounts: payment method, transaction references, payment status and refund details; account login and profile details if you create an account. These support payments, access to your orders and account management. Our legal basis is performance of the contract, with legal obligations applying to financial records. Payment credentials are handled by the payment provider; you should not send us card details by email.
Availability requests and correspondence: the contact information, products, quantities and messages you submit through our request-for-quote function or email. We use these to respond and take steps at your request before a possible contract, or to handle existing orders.
Returns, withdrawal and complaints: your contact details, order reference, returned items, declaration, correspondence and submission date and time. We use these to comply with consumer-law obligations, perform the contract and retain proportionate evidence needed to resolve disputes.
Website operation and security: technical information such as IP addresses, browser/device information, access times, session identifiers and security logs. We process this where necessary for our legitimate interests in keeping the shop operational, preventing fraud and investigating misuse. We balance these interests against your rights.
Order attribution: referral or campaign information and browsing-session information may be associated with an order by WooCommerce to help us understand how customers reach the shop. Any non-essential tracking requiring consent must remain subject to your prior consent.

We do not need sensitive personal information to sell trading cards. Please do not include unnecessary sensitive information in messages or uploads. We do not use these shop processes to make decisions based solely on automated processing that have legal or similarly significant effects on you. A selected payment provider may perform its own fraud or credit checks under its own privacy notice.

3. Service providers and other recipients

Our shop runs on WordPress and WooCommerce. YITH Request a Quote supports product requests within the shop. STRATO supplies hosting and email services. Relevant technical service providers may process data on our behalf to operate, maintain and secure these services.

We share information needed to process your payment with Mollie and the payment method you choose, such as a bank, card provider or pay-later provider. This may include contact and billing details, order information, amount, transaction identifiers and technical information. Read Mollie’s Privacy Statement and the notice of your chosen payment provider for their own processing, legal obligations and retention periods.

Delivery carriers receive the contact and delivery information needed to transport your order. Accounting or professional advisers may receive information needed for administration or advice. We may disclose relevant data to public authorities where legally required, or where necessary and lawful to establish, exercise or defend legal claims. Access is limited to what is needed for the relevant purpose.

4. International processing

Some service providers or their subcontractors may process information outside the European Economic Area, depending on the service and payment method used. Where GDPR transfer restrictions apply, transfers require an appropriate safeguard, such as an adequacy decision or standard contractual clauses with any necessary additional measures. Contact us for information about the safeguards relevant to your data.

5. How long we keep data

We retain data for the purpose for which it was collected and for applicable legal obligations, not simply because storage is available. Financial and basic tax-administration records are generally retained for seven years. Certain cross-border VAT records may require ten years where the relevant tax scheme applies.

Account data is needed while your account is in use. Enquiries and quote requests are kept for handling the request and any reasonable follow-up; when no longer needed, they should be deleted or anonymised. Order, complaint and withdrawal records may be needed after fulfilment for statutory guarantees, legal obligations or a specific dispute. Security logs and backups are retained according to their operational purpose and recovery cycle, with longer retention only where needed to investigate an incident or meet a legal obligation.

WooCommerce currently has no automatic deletion schedule configured for these records. Retention therefore requires review and manual deletion or anonymisation where appropriate. You may contact us to ask about the retention period or necessity of particular data, or request deletion where the law permits it.

6. Cookies and similar technologies

The shop uses cookies or similar storage for functions such as the shopping basket, checkout, login and security. These allow the shop to recognise a session and maintain your selections. WooCommerce may also use session-based referral or campaign storage for order attribution.

Non-essential tracking or advertising cookies that require consent must only be used after consent. Consent can be withdrawn at any time without affecting earlier lawful processing. You can manage or remove cookies through your browser settings; blocking essential cookies may prevent login, basket or checkout functions from working correctly. This privacy notice itself does not constitute consent to tracking.

If you follow a link to an external website or social-media service, that service applies its own privacy and cookie rules.

7. Your rights

Depending on the circumstances, you can request access to your data, correction, deletion, restriction of processing or a portable copy. You can object to processing based on legitimate interests and always object to direct marketing. Where processing relies on consent, you may withdraw it at any time. These rights do not require us to delete records we must retain by law.

Send your request to info@arestcg.eu. We may ask for proportionate information to confirm your identity; please do not send an unsolicited copy of your identity document. We normally respond within one month. For a complex request, the law allows an extension of up to two further months; we will explain this within the first month.

You may complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or another competent supervisory authority, including in the country where you live or work.

8. Security and changes

We use organisational and technical measures appropriate to the risks, including encrypted website connections and access controls. No internet service can guarantee absolute security. Contact us if you suspect misuse of your account or personal data.

We update this policy when our processing changes. The date above identifies this version. Material changes will be communicated where appropriate; changing this policy does not itself provide a new legal basis to use your data.