Privacy Policy
Effective: 20 October 2026
Data controller for operation of the marketplace: POKEMARKET OÜ, registry code 17628205, Ridva tn 9, Saue, 76506, Estonia
Privacy contact: support@mypokecard.eu · Support ticket: Contact / Submit a ticket
1. Scope and controller roles
This Privacy Policy describes processing by POKEMARKET OÜ for PokeCard accounts, marketplace listings, offers, auctions, communications, orders, payments, shipping coordination, customer support and optional paid services via mypokecard.eu / pokecard.ee. Business and private sellers may independently determine how they process the information needed for their sale. Banks, Montonio, carriers and their financial/logistics partners may act as separate controllers for their own services; consult their policies as appropriate.
2. What data we collect
- Registration and identity: username, email address, encrypted/hashed authentication data, account settings, seller classification, business and verification information when applicable.
- Listings and profile: seller name or public username, listing photos and descriptions, prices, offers, ratings, reviews, collection visibility choices and messages or other information posted on the site.
- Transactions and payments: order references, items, amounts, fees, payment and refund status, limited processor identifiers, payout beneficiary name, bank identifier and IBAN if required. Payment details are entered in the payment provider’s checkout; PokeCard stores transaction references and statuses.
- Deliveries: sender and recipient names, addresses or parcel lockers, phone/email as required by the selected carrier, parcel identifiers, shipping labels, dispatch and tracking events.
- Support and safety: support tickets, dispute materials, photographs, allegations, moderation decisions, fraud-prevention signals and account security logs.
- Technical data: IP address, device/browser information, session identifiers, timestamps and essential cookies; optional analytics and marketing identifiers only when those tools are enabled and a lawful basis (including consent when required) applies.
Please do not submit unnecessary government ID, health or other sensitive information in public listings or messages. When identification is required, we will direct users to an appropriate secure workflow.
3. Purposes and legal bases
| Processing purpose | Typical GDPR legal basis |
|---|---|
| Account creation, authentication, orders, offers, delivery coordination and customer support necessary for the service | Contract — Art. 6(1)(b) |
| Accounting, statutory tax reporting, legal consumer duties and lawful regulatory requests | Legal obligation — Art. 6(1)(c) |
| Preventing abuse, counterfeit listings, fraud, account takeovers, handling disputes, enforcing platform rules and protecting the service | Legitimate interests — Art. 6(1)(f), after balancing interests and rights; other bases may apply in particular cases |
| Optional promotional emails and non-essential cookies or trackers | Consent — Art. 6(1)(a) when required; unsubscribe/withdrawal available at any time |
| Establishing, exercising or defending legal claims | Relevant lawful basis including legitimate interest or legal obligation, depending on the circumstances |
We do not condition essential marketplace use on optional marketing or analytics consent. Consent can be withdrawn without affecting lawfulness of earlier processing.
4. Who receives the information
We share only information reasonably needed with (i) the counterparty seller or buyer to complete a transaction, (ii) payment providers such as Montonio and relevant banks/payment institutions, (iii) delivery partners such as Omniva, DPD and SmartPosti where selected, (iv) authorised infrastructure, hosting, database, email, monitoring and customer-support service providers, and (v) advisers, insurers, courts or authorities where justified or legally required. Public profile fields and publicly visible listings are available to platform visitors in accordance with the site's actual access configuration. Private messages, verification documents and financial details are not intended to be public.
The current implementation uses ChatGPT Sites with Cloudflare Workers, D1 database and R2 storage, Supabase for authentication, Montonio sandbox payments and shipping, and Resend for configured transactional emails. Historical Stripe test-payment records and reconciliation code remain. Discord is an external community link. Provider functions and data shared depend on the feature used. For information about specific processing locations and contractual safeguards, contact support@mypokecard.eu.
5. International transfers
Service providers may process personal data outside the European Economic Area. Such transfers require an applicable GDPR transfer mechanism, for example an adequacy decision or appropriate contractual safeguards. Details of material transfers can be requested through support@mypokecard.eu. We do not represent the service as EU-only hosting.
6. How long we keep data
We retain data only for the relevant purposes and lawful periods. Typically: active account/profile data until account closure, followed by deletion or restricted archival where no longer needed; orders, invoices and accounting documents for statutory retention periods (generally seven years under applicable Estonian accounting obligations); dispute records for the time reasonably necessary for complaint handling and legal claims; technical/security logs for limited periods justified by the security purpose; optional consent records while necessary to demonstrate the consent choice. Login sessions expire after 30 days. Recent signed-in IP addresses are retained encrypted for up to 90 days, up to 20 per account; restriction records are handled separately. Contact us for the retention applicable to a specific record. Information may need to remain after account deletion where law requires it, or where necessary for an unresolved transaction or legal claim.
7. Your rights
Subject to legal conditions, individuals can request access to their data, rectification, erasure, restriction of processing, portability, and objection to processing based on legitimate interests. They may withdraw consent at any time and object to direct marketing. To exercise rights, contact support@mypokecard.eu or open a privacy support ticket; we may verify identity before disclosing personal data. We normally respond within one month, extendable in the cases permitted by GDPR. If dissatisfied, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at https://www.aki.ee or a competent supervisory authority in your country.
8. Cookies, communications and marketing
Essential login, security and checkout cookies may be required for the service. Optional analytics/advertising cookies must not be set until the user has given valid consent where required, and users must be able to reject or subsequently change their choices. Details belong in the separate Cookie Policy and cookie settings panel. Transactional emails (e.g., verification, shipping, receipt and dispute messages) are not marketing consent; newsletters and direct promotional email require an applicable legal basis and an easy unsubscribe mechanism.
9. Security and automated decisions
We use appropriate organisational and technical safeguards, such as role-based permissions, access controls, transport encryption, monitoring and secure payment integrations. No internet system can be guaranteed absolutely secure. We may use rules or automated indicators to detect suspicious activity, but meaningful access to challenge and a human review path will be provided where required by law. Contact support to challenge a restriction or request review of an automated flag.
10. Changes
We update this document when processing changes. Material changes will be communicated as appropriate, and the effective date will be updated. Contact support@mypokecard.eu for a previous version where relevant.