Privacy Policy

Bandar TCG ("we", "us") is operated by Bandartcg.com Limited, a private limited company registered in England and Wales (Company No. 17468113), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We run a B2B wholesale storefront for Japanese TCG product, serving international resellers.

Bandartcg.com Limited is the controller of your personal data for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact: trade@bandartcg.com.

When you use this site we collect:

• Contact and order details — name, shop or company name, email address, WhatsApp/phone number and delivery address, when you place an order or send a request.
• Order notes — anything you write in the note field.
• Payment confirmation — the amount and sender name shown on the Wise or bank transfer you make to us, or, if you pay by card, the payment status, amount, card brand and last four digits that Stripe reports to us. Card payments are entered on Stripe's page — we never see or store full card details.
• Account data — only if you sign in (optional): your email address, your name and Google account ID if you use "Continue with Google", and a shipping address if you ask us to save one. Your orders are private to the email you ordered with; signing in is how you see them.
• Technical and usage data — IP address, browser, device and pages visited, via our hosting logs and the analytics and advertising tools in section 9.
• ChatGPT plugin searches — if you use the Bandar TCG plugin in ChatGPT, we receive only what ChatGPT sends to look up a price: the card details it read (card name, number, set, rarity, printing, language and grade), the game and the number of results. We do not receive your ChatGPT account details, your conversation, or any photo you upload; ChatGPT reads a photo itself and sends us only these card details. These requests are not linked to you and are kept only in short-lived hosting logs. When a search finds no matching card or nothing in stock, we keep a count of the card details searched (not linked to you) so we can add the cards people ask for. OpenAI's handling of your ChatGPT data is covered by OpenAI's own privacy policy.

We do not collect identity documents or any special-category data.

• To take, fulfil and support your order (stock checks, payment matching, shipping, customer service) — performance of a contract with you.
• To keep accounting and tax records and meet customs and export requirements — legal obligation.
• To prevent fraud, secure the site and improve our service — our legitimate interests in running a safe, working business.
• To measure our ads and site traffic using the tools in section 9 — your consent where the law requires it (visitors in the UK, EEA and Switzerland), otherwise our legitimate interests in measuring our advertising.

We do not sell your data and do not send you marketing emails unless you ask us to.

• Cloudflare — website hosting and data storage.
• Wise (or your bank) — the payment you send us.
• Stripe (Stripe Payments Europe / Stripe Payments UK) — if you pay by card, Apple Pay or Google Pay: your payment details, email, order reference and delivery address, to process the payment and prevent fraud.
• FedEx / DHL, via our shipping agent eLogi — your name, address and phone for the shipping label and customs declaration.
• Google, Meta and TikTok — usage data from the tools in section 9, and your order details (with email and phone hashed) so we can measure our ads. In the UK, EEA and Switzerland, only if you accept cookies.
• WhatsApp (Meta) — if you contact us on WhatsApp.
• Google sign-in — only if you choose "Continue with Google": Google confirms your email address to us. We receive your name, email and Google account ID, never your password.
• Our suppliers in Japan receive only the products ordered, never your personal details.

We may also disclose data where required by law, e.g. to HMRC or customs authorities.

Our team and suppliers work from Japan and Indonesia, and our service providers operate worldwide, so your data is processed outside the UK. Where a country is not covered by UK adequacy regulations, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Ask us for a copy.

Order and payment records: 6 years from the end of the financial year of the order, to meet UK tax and accounting rules. Enquiries that don't lead to an order: deleted after 12 months without contact.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have it corrected, or erased (except records we must keep by law);
• restrict or object to our use of it, including for direct marketing;
• receive it in a portable format;
• withdraw consent at any time, where we rely on consent.

If you have an account you can delete it yourself at any time from your account page — your sign-in and saved address are erased; order records we must keep for tax purposes are retained. For anything else, email trade@bandartcg.com. We reply within one month.

Data is stored on Cloudflare infrastructure, encrypted in transit and at rest. Access is limited to the people who run Bandar TCG.

We use:

• Strictly necessary — Cloudflare security cookies (e.g. cf_clearance) and your cart, delivery country and currency choice, stored in your browser.
• Analytics — Google Analytics 4, to understand how the site is used.
• Advertising — the Meta Pixel and TikTok Pixel, to measure our ads and show them to relevant audiences.

If you visit from the UK, the EEA or Switzerland (or we can't tell where you are), analytics and advertising cookies load only if you click Accept on our cookie banner, and the same choice decides whether we send your order to Meta or TikTok to measure our ads. You can change your mind at any time with the Cookies link in the footer. Elsewhere these tools are on by default; you can block them in your browser settings, or opt out of personalised ads in your Google, Meta or TikTok settings, and you can object to this use of your data as described in section 7. Strictly necessary storage is always on.

The current version is always on this page, with the date it was last updated. We will email active buyers about material changes.

Contact us first at trade@bandartcg.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) — ico.org.uk.