Privacy Policy

The ClubShop is the data controller responsible for your personal information collected through the Service. If you have any questions about this Privacy Policy or how we handle your data, you can contact us using the details provided in Section 14.

We collect information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual or device ("Personal Information").

We process your personal information under the following lawful bases as permitted by UK GDPR:

• Contract (Article 6(1)(b)): Processing is necessary to perform a contract with you (e.g., processing orders, facilitating transactions, managing your account).
• Legal Obligation (Article 6(1)(c)): Processing is necessary to comply with a legal obligation (e.g., record-keeping for tax purposes, fraud prevention).
• Legitimate Interests (Article 6(1)(f)): Processing is necessary for our legitimate interests (e.g., platform security, preventing fraud, improving our services), provided those interests are not overridden by your rights and freedoms.
• Consent (Article 6(1)(a)): Where you have given consent (e.g., marketing communications, push notifications, non-essential cookies). You may withdraw consent at any time.

We use your personal information for the following purposes:

• Service Provision: To create and manage your account, facilitate listings, auctions, offers, purchases, and donations, and process payments through escrow.
• Club Verification: To verify the identity and authority of club representatives before allowing them to sell on the Platform.
• Transaction Processing: To process payments via Stripe, manage escrow, generate shipping labels, issue Certificates of Authenticity, and handle refunds.
• Communication: To send you order updates, auction notifications, bid alerts, outbid notices, dispute updates, support responses, and other transactional messages.
• Dispute Resolution: To investigate and resolve disputes between Buyers and Sellers, including reviewing evidence and communicating outcomes.
• Personalisation: To tailor your experience based on followed clubs, saved searches, saved items, and viewing history.
• Marketing (with consent): To send you information about new listings, promotions, ClubShop Gold membership, and platform updates. You can opt out at any time.
• Security and Fraud Prevention: To detect, prevent, and address fraud, unauthorised transactions, shill bidding, counterfeit listings, and other prohibited activity.
• Platform Improvement: To analyse usage patterns, improve features, fix bugs, and develop new functionality.
• Legal Compliance: To comply with applicable laws, regulations, and legal requests, and to enforce our Terms of Use.

We do not sell your personal information. We may share your information in the following circumstances:

• Between Users: When a transaction is completed, we share necessary information between Buyer and Seller, such as shipping address, order details, and contact information. Club Sellers can see buyer names for review purposes but not full shipping addresses in their sold-listing dashboard.
• Service Providers: We share information with third-party service providers who help us operate the Platform:
  • Base44 — hosting, database infrastructure, and platform services.
  • Stripe — payment processing, escrow management, and ClubShop Gold subscription billing.
  • ShipStation — shipping label generation and logistics management.
  • Google — authentication via Google OAuth.
  • Resend — transactional email delivery.
• Legal Requirements: We may disclose your information if required to do so by law, court order, or government regulation, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, reorganisation, or sale of all or part of our business, your personal information may be transferred as part of that transaction.
• Consent: We may share information with third parties when you give us consent to do so.

Your personal information may be transferred to and processed in countries outside the UK, including the United States (where some of our service providers are based). Where this occurs, we ensure that appropriate safeguards are in place to protect your information, such as Standard Contractual Clauses approved by the UK Government, or reliance on the UK International Data Transfer Agreement. By using our Service, you acknowledge that your information may be transferred and processed in such countries.

We retain your personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required by law. Specifically:

• Account Data: Retained for the duration of your account. You may request deletion of your account at any time through the Platform's account deletion feature.
• Transaction and Order Data: Retained for up to 7 years for tax, accounting, and legal compliance purposes.
• Dispute and Communication Data: Retained for the duration of the dispute resolution process and for a reasonable period thereafter for record-keeping.
• Listing Data: Retained while the listing is active and for a reasonable period after sale or removal for audit and dispute purposes.
• Marketing Data: Retained until you opt out or request deletion.

We implement commercially reasonable technical, organisational, and physical security measures designed to protect your personal information from unauthorised access, use, alteration, or disclosure. These measures include encryption in transit, secure data storage, access controls, and regular security reviews. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. Financial data (including card details) is handled entirely by Stripe, which is PCI-DSS compliant. Shipping data may be shared with ShipStation to support logistics.

You have the following rights regarding your personal information:

• Right of Access: You can request a copy of the personal information we hold about you.
• Right to Rectification: You can request that we correct inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal information in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.
• Right to Restriction of Processing: You can request that we restrict the processing of your personal information in certain circumstances.
• Right to Data Portability: You can request a copy of your personal information in a structured, commonly used, and machine-readable format, and you have the right to transmit that data to another controller.
• Right to Object: You can object to our processing of your personal information based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where we rely on consent as the lawful basis for processing, you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data appropriately. You can contact the ICO at ico.org.uk.

To exercise any of these rights, please contact us using the details in Section 14. We will respond to your request within one month of receipt.

We use cookies and similar tracking technologies to operate and improve our Service. Cookies are small data files stored on your device. We use the following categories:

• Essential Cookies: Required for the Service to function (e.g., maintaining your login session). These cannot be disabled.
• Preference Cookies: Remember your settings and preferences (e.g., dark mode, marketplace selection).
• Analytics Cookies: Help us understand how visitors use our Service so we can improve it.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us and we will take steps to delete that information.

We do not use automated decision-making that produces legal or similarly significant effects on you. Certain platform features (such as auction proxy bidding, listing promotion scoring, and saved search alerts) operate automatically based on pre-defined rules, but these do not produce legal effects and you can contact us if you have concerns.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on this page and updating the "Effective Date" at the top. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at:

The ClubShop — Legal Department
Email: support@wyvern-studio.com

If you wish to make a complaint about how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.