Privacy Policy

1. Who We Are

Leylines (“we”, “us”, “our”) is a trading card game retailer operating in the United Kingdom. We are the data controller for the personal information we collect through this website and our services.

For any privacy-related queries, please contact us at: privacy@leylines.uk

2. What Information We Collect

When you create an account or place an order with us, we collect and store the following personal information:

• Account information — your name and login credentials (password stored as a cryptographic hash; we never store your plain-text password)
• Delivery addresses — name, address lines, city, postcode, country, and optionally a phone number that you save to your account for use at checkout. Your phone number is collected when you place a delivery order if one is not already saved to the address you select.
• Order history — the items you purchased, quantities, prices, the delivery address snapshot at the time of order, and order status
• Store credit balance — accrued credit associated with your account
• Session data — a short-lived authentication token stored in your browser to keep you logged in

We do not collect or store payment card numbers or full payment details. All payment processing is handled directly by our third-party payment providers (see Section 5).

3. How We Use Your Information

We use your personal information for the following purposes:

• To fulfil your orders — processing purchases, preparing shipments, and communicating order status
• To manage your account — maintaining your saved delivery addresses and store credit balance
• To process payments — passing the minimum necessary information to our payment providers to complete a transaction
• To comply with legal obligations — retaining transaction records as required by UK tax and financial regulations
• To prevent fraud — detecting and preventing unauthorised account access or fraudulent transactions

4. Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases to process your personal data:

• Contract performance — processing is necessary to fulfil orders you have placed with us and to manage your account
• Legal obligation — retaining transaction records to comply with UK tax law and financial reporting requirements
• Legitimate interests — fraud prevention, account security, and ensuring the integrity of our platform
• Consent — for any optional cookies set beyond those strictly necessary for the website to function (you may withdraw consent via our cookie preferences at any time)

5. Third Parties We Share Data With

We share the minimum necessary personal data with the following categories of third-party service providers:

• PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing. When you choose to pay via PayPal, you are redirected to PayPal’s platform, which is subject to PayPal’s Privacy Policy.
• Wonderful Payments Ltd — Pay by Bank payment processing. Subject to Wonderful’s Privacy Policy.
• Cloudflare, Inc. — we use Cloudflare Turnstile on our account registration form to distinguish human users from automated bots and protect against spam. Turnstile may collect your IP address, browser characteristics, and interaction signals for this purpose. No data is shared with Cloudflare during ordinary browsing — only when you submit the registration form. Subject to Cloudflare’s Privacy Policy.
• Royal Mail / InPost — your name, delivery address, and phone number are shared with the carrier used to dispatch your order. InPost parcel lockers require a phone number to send your collection code and delivery notifications; this is the sole reason we collect it.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

6. Cookies

We use a small number of cookies strictly necessary for the website to function, including an authentication token to keep you logged in during your session. We do not use third-party tracking or advertising cookies. You can manage your cookie preferences using the banner displayed on your first visit.

7. How Long We Keep Your Data

• Order records — retained for a minimum of 6 years from the date of the transaction, as required by HMRC record-keeping rules
• Account and address data — retained for as long as your account remains active. Saved addresses you delete are removed from your profile view immediately; residual data may be retained in order records for legal compliance
• Session tokens — expire automatically and are not stored beyond your logged-in session

8. Your Rights

Under UK GDPR you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data where we no longer have a lawful basis to retain it
• Right to restriction — ask us to restrict processing of your data in certain circumstances
• Right to data portability — receive your data in a structured, commonly used format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, please contact us at privacy@leylines.uk. We will respond within 30 days. We may need to verify your identity before processing your request.

9. How We Protect Your Data

We implement appropriate technical and organisational security measures to protect your personal data, including encrypted storage of passwords (bcrypt hashing with a server-side pepper), HTTPS for all data in transit, and restricted access to personal data on a need-to-know basis.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

11. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK’s supervisory authority:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
ico.org.uk/make-a-complaint

We would appreciate the opportunity to address your concerns directly before you contact the ICO, so please reach out to us first at privacy@leylines.uk.