Privacy Policy

1. Controller and contact

Lady Luck TCG is a trading name of ATNAR COMPANY LTD, company number 16669659, registered office 124 City Road, London, EC1V 2NX, United Kingdom. For privacy enquiries email support@ladylucktcg.co.uk. This notice explains how we process personal information when you use our online store, create an account, place an order, contact us or subscribe to updates.

2. Information we collect

Depending on how you use our website, we process names, email addresses, phone numbers, billing and delivery addresses, account details, order items, payment status and transaction references, messages you send us, consent records and newsletter preferences. We also process limited information about your connection and activity where needed to protect the website and prevent abuse. We do not intentionally collect or store full payment-card numbers or security codes as part of your account or order records; payment information is handled by the relevant payment provider. We do not intentionally collect children’s information for the community-card initiative.

3. Why we use information and lawful bases

We process order, payment, delivery, account and customer-support information where necessary to perform a contract or take requested pre-contract steps. We process records where necessary to meet accounting, tax, consumer-law or other legal obligations. We use proportionate fraud prevention, site security and purchase-limit controls on legitimate-interest grounds, balanced against individual rights. Where marketing relies on consent, we use and retain evidence of that consent and honour withdrawal. We do not use consent as a blanket basis for processing needed to fulfil an order.

4. Orders, stock and delivery

We use order information to manage your purchase, take payment, arrange delivery, provide customer support, handle returns and refunds, and maintain accounting records. Where necessary to deliver your order, we share the relevant delivery details with the carrier or fulfilment provider actually used, including Royal Mail where applicable.

5. Payments

Where Stripe is offered at checkout, it processes payment information under its own applicable terms and privacy notices. We receive payment status, transaction references and related information needed to reconcile orders, handle refunds and investigate payment issues. We do not store full card details in your account or order records.

6. Fair-purchase and security controls

Selected products have household purchase limits. We may compare account details, billing email and billing or delivery addresses with relevant previous orders to apply those limits fairly. We also use proportionate checks on unusually frequent or repeated activity, together with security records, to prevent automated abuse and protect customers. An IP address is not the sole way we identify a household, and we do not claim that these checks are infallible. Access to the related information is restricted.

7. Newsletter and marketing

If you request newsletters, we keep a record of your email address, how and when you signed up, what you agreed to, whether you confirmed your subscription, and any later withdrawal. You must actively request updates and confirm your email address before you can receive marketing. You may unsubscribe at any time. Order emails are separate and do not depend on newsletter consent. Newsletter emails are not currently being sent, and subscriber information is not currently shared with an external marketing platform.

8. Hosting and providers

Our website is hosted by Hostinger. The current hosting location is the United Kingdom, and website backups are stored in Germany. Hostinger also helps deliver pages through a network of servers, so UK hosting does not mean that all processing takes place in the UK. Stripe is our chosen payment provider and Royal Mail our chosen carrier, but live payments and delivery services have not yet been enabled. Those providers receive information when their services are actually used. We keep newsletter consent records through our own website and do not currently share subscriber information with Hostinger Reach or another external marketing platform. We share only the information reasonably needed for each service. If we introduce another provider that handles your information, we will update this notice before the relevant service is used. For questions about our providers, contact support@ladylucktcg.co.uk.

9. Cookies and similar technologies

Our Cookie Policy explains how cookies support your basket, account and checkout, and how to manage them. Optional advertising and marketing tracking are not currently used on the public website. If we introduce optional technologies that require consent, we will provide the required choices before enabling them.

10. Retention

We keep personal information only as long as necessary for its purpose, our legal obligations, genuine legal claims, fraud prevention or appropriate security. We review information for deletion or anonymisation when it is no longer needed, taking account of outstanding orders, disputes and legal requirements.

Accounting and financial transaction records: generally six years from the end of the relevant financial year or accounting period, or longer where required by law.
Order records: as needed to fulfil orders, handle refunds, meet legal obligations and deal with potential claims. We review these records against the accounting framework, keeping the personal information needed for those purposes.
Customer accounts: while active, then reviewed for deletion or anonymisation when no longer necessary, subject to outstanding orders and legal obligations.
Newsletter consent: while you are subscribed and as necessary afterwards to show what you agreed to or when you withdrew consent. Personal details in unconfirmed subscription requests are removed after 30 days.
Unsubscribe preferences: the minimum information necessary to honour your withdrawal and prevent accidental resubscription.
Security and anti-abuse records: only as long as necessary for the security purpose for which they are kept. Evidence of a particular incident may need to be retained longer where justified.
Backups: Hostinger provides daily automated backups and retains older recovery points under its backup rotation. Backups are held for recovery and security, with retention governed by that rotation and any continuing legal or recovery need. Separate recovery copies are retained only while necessary for those purposes; we do not apply one fixed deletion period to every copy.

Records may be retained longer where reasonably necessary for legal claims, fraud prevention or statutory obligations. This does not mean that every detail about your account or website use is required to be kept for the accounting period.

11. Who can access information

Authorised staff and service providers may access information as needed for their work and subject to appropriate safeguards. We do not sell personal information, make customer information public or pass subscriber lists to a marketing provider without an appropriate basis.

12. International transfers

Your personal information may be processed in the United Kingdom or other countries where our service providers operate. Where personal information is transferred internationally, we take steps to ensure that appropriate safeguards are in place as required by UK data protection law. These may include adequacy regulations, approved contractual safeguards or other legally permitted mechanisms, depending on the transfer. Hostinger’s published data-processing terms provide for Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable. Stripe explains its international processing and transfer safeguards in its own published terms. The safeguards that apply depend on the provider, service and transfer involved. You can ask about the safeguards relevant to your information, or how to obtain a copy, by emailing support@ladylucktcg.co.uk.

13. Your rights

Subject to applicable conditions and exceptions, you may request access, correction, erasure, restriction, portability, or object to certain processing. You may withdraw marketing consent at any time without affecting earlier lawful processing. Contact support@ladylucktcg.co.uk. We may verify identity before disclosing information.

14. Complaints

If you have concerns, please contact us first so we can investigate. You may also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

15. Children

The shop is not intended to collect children’s personal information through the optional community initiative. We do not publish recipient details or collect children’s addresses through that feature. Parents or guardians should supervise children’s online purchases where appropriate.

16. Changes and contact

We may update this notice when our services, legal obligations or privacy practices change. The effective date identifies the current version. Where a change affects how we use your information, we will provide any additional information or choices required by law. For privacy questions, contact support@ladylucktcg.co.uk. The controller is ATNAR COMPANY LTD, 124 City Road, London, EC1V 2NX, United Kingdom.

Provider information

Version and effective date: 31 October 2026.