Privacy policy

Last updated: July 2026. ThreeKingdoms ("we") is the data controller for this website. We collect the minimum we need to run a card shop, and we don't sell or rent your data to anyone. Questions: hello@threekingdoms.pages.dev.

What we collect & why

• Orders: when you check out, Stripe collects your name, email, delivery address and payment details to process the payment (we never see your card number). We receive the order details and delivery address so we can ship your parcel, and we keep order records for 6 years for UK tax law.
• Contact & newsletter forms: we use the details you send to reply to you, or to send the newsletter you asked for. Unsubscribe any time via the link in any email.
• Basket & wishlist: stored in your own browser (local storage) — it never leaves your device unless you check out.

Legal bases

Contract (processing your order), legal obligation (tax records), consent (newsletter, and analytics if you opt in), and legitimate interest (answering your messages, preventing fraud).

Who we share data with

Only the services that make the shop work: Stripe (payments), Cloudflare (hosting and security), our email provider (transactional email), and Royal Mail / our courier (your address, to deliver). Each processes data under their own GDPR-compliant terms.

Your rights

Under UK GDPR you can request access, correction, deletion, restriction or portability of your data, and you can withdraw consent at any time. Email hello@threekingdoms.pages.dev and we'll act within one month. You can also complain to the ICO (ico.org.uk).