🔥 NEW POKÉMON SET — Journey Together is here! Shop Pokémon →
🏴‍☠️ ONE PIECE CARD GAME — Pre-order the newest expansion now Pre-order OP →
✨ DISNEY LORCANA — Rise of the Floodborn restocked Shop Lorcana →
⚔️ MTG FINAL FANTASY — Secure your booster boxes early Secure MTG →
Navigation Menu

Privacy policy

Privacy Policy

Last updated: July 2026

This Privacy Policy describes how Universe TCG ("we," "us," or "our") collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from universetcg.com or otherwise communicate with us.

Universe TCG is based in Spain and operates in strict compliance with the GDPR (EU) 2016/679 and the Spanish LOPDGDD 3/2018.

1. Data Controller

  • Entity: Universe TCG
  • VAT/NIF: 77123245J
  • Address: Carrer de Gaietà Ventalló, 34, local 3, 08100 Mollet del Vallès, Barcelona, Spain
  • Email: [email protected]

2. Personal Data We Collect

Information You Provide Directly

  • Contact Details: Name, shipping address, billing address, email, phone number.
  • Order Information: Transaction details, purchased items, payment confirmations, delivery updates.
  • Account Details: Username, password (hashed), security logs, customer profile.
  • Customer Support Records: Communications sent to [email protected].
  • Preorder / Backorder Data: Product reservations, allocation history, cancellation requests.

Information Collected Automatically

  • Usage Data: IP address, device type, OS, browser, page views, clickstream, search queries, session duration.
  • Cookies and Tracking Pixels: See Section 4.

Information from Third Parties

  • Shopify Inc.: E-commerce platform and hosting.
  • Payment Processors: Stripe, PayPal, Shopify Payments — handle payment data directly. We never store full card numbers.
  • Logistics Partners: Correos, DHL, UPS, GLS — receive name, address, and phone for delivery.
  • XCover (Booking Protect): If you purchase Shipping Protection, XCover processes relevant order data under their own privacy policy.

3. Legal Basis and Purposes of Processing

  • Contract performance: Processing orders, managing accounts, fulfilling deliveries.
  • Legal obligation: Spanish tax compliance, invoice issuance, Agencia Tributaria reporting (data retained minimum 5 years).
  • Consent: Marketing emails and SMS. Withdraw at any time.
  • Legitimate interests: Fraud prevention, anti-scalping enforcement, website security, service improvement.

4. Cookies, Tracking Pixels, and Advertising

We use, or may use, the following technologies:

  • Shopify Analytics: Session and storefront performance data. Required for store operation.
  • Google Analytics 4 (GA4): Traffic analysis and conversion tracking. Processed on Google servers.
  • Google Ads / Remarketing: Conversion tracking and ad targeting.
  • Meta Pixel (Facebook / Instagram): Conversion tracking and custom audience targeting via Meta Platforms.
  • TikTok Pixel: Conversion tracking and audience targeting via TikTok.
  • Other technologies: We may add or remove tracking technologies. This list is updated when changes occur.

Manage cookie preferences via your browser settings or our cookie consent banner where applicable.

5. Data Security and Retention

  • Security: SSL/TLS encryption, Shopify secure hosting, access controls.
  • Retention: Order and transaction data: minimum 5 years (Spanish fiscal law). Marketing data: until consent withdrawn. Account data: until account deletion.
  • Breach notification: We will notify you and the AEPD within 72 hours of a breach likely to affect your rights.

6. Sharing of Personal Data

We do not sell personal data. We share data only with: Shopify (hosting); payment processors; logistics carriers; Spanish Agencia Tributaria (legal requirement); XCover (if Shipping Protection purchased); marketing platforms (Google, Meta, TikTok) where consented or legitimately required. All partners operate under GDPR-compliant data processing agreements.

7. Your GDPR Rights

  • Access: Request a copy of your data.
  • Rectification: Correct inaccurate data.
  • Erasure: Request deletion (subject to legal retention obligations).
  • Restriction: Limit processing under certain conditions.
  • Portability: Receive your data in machine-readable format.
  • Object: Object to direct marketing or legitimate-interest processing.
  • Withdraw consent: At any time, without affecting prior processing.

Exercise any right: [email protected] — subject "GDPR Request". Response within 30 days. Complaints: Agencia Española de Protección de Datos (AEPD).

8. International Data Transfers

Some providers (Shopify, Google, Meta, TikTok) process data outside the EEA. We rely on EU Commission adequacy decisions and Standard Contractual Clauses (SCCs) to ensure lawful transfer.

9. Changes to This Policy

We may update this policy at any time. The date at the top indicates the last revision. Continued use of our Services constitutes acceptance of the updated policy.

10. Contact

Privacy enquiries: [email protected] — subject "GDPR Request".

Frequently Asked Questions

Does Universe TCG sell my personal data?
No. Data is shared only with essential service providers under GDPR-compliant agreements.
What cookies does Universe TCG use?
Shopify Analytics, Google Analytics 4, Google Ads, Meta Pixel, and TikTok Pixel. Manage via browser settings.
How long is my data kept?
Order/transaction data: minimum 5 years (Spanish tax law). Marketing data: until you unsubscribe.
How do I delete my data?
Email [email protected] with subject "GDPR Request — Erasure". Response within 30 days.
How do I unsubscribe from emails?
Click "Unsubscribe" in any marketing email or email [email protected].
Who do I complain to?
The Spanish Data Protection Agency (AEPD) at www.aepd.es, or your local data protection authority.