Privacy policy

Last updated: 5 September 2026

This policy explains what personal information PokePortal Ltd, trading as Portal TCG, collects when you use portaltcg.co.uk, buy from us, join our live streams, sign up to our emails or contact us, why we collect it, who we share it with and what rights you have. We are the data controller for that information. We follow the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Who we are and how to contact us

PokePortal Ltd, company number 15910981, The Apex, Derriford Business Park, Brest Road, Plymouth, PL6 5FL. For anything about your data, email support@portaltcg.co.uk with "Privacy" in the subject line, or write to the address above.

2. What we collect

  • Contact and identity details: your name, email address, postal address and phone number.
  • Order and payment details: what you bought, when, how much you paid and which payment method you used. Card numbers are entered directly with our payment providers (Shopify Payments, PayPal) and never reach or are stored by us.
  • Account details if you create an account: login details, saved addresses and order history.
  • Marketing preferences: whether you have asked for our emails, and how you interact with them.
  • Messages: emails, contact form entries, social media messages and reviews you send us.
  • Live stream and marketplace details: your TikTok or eBay username and the details those platforms pass to us to fulfil an order or a live purchase.
  • Device and usage information: IP address, browser and device type, the pages you visit and how you got to them, collected by cookies and similar technologies (see section 8).
  • Custom order details: artwork, names, photographs or text you send us to print on a custom item.
  • Wholesale enquiries: your business name, role and contact details.

We do not deliberately collect special category data (such as health or religious information) and we ask you not to send it to us.

3. Where it comes from

Mostly from you, when you order, sign up, message us or take part in a stream. Some comes automatically from your device through cookies. Some comes from the platforms you buy through (TikTok Shop, eBay), from our payment providers (for example fraud checks) and from our delivery partners (tracking events).

4. Why we use it and our lawful basis

  • To fulfil your order and our contract with you: taking payment, printing and packing, delivery, tracking, returns, refunds and customer service. Lawful basis: performance of a contract.
  • To keep records we are required to keep: invoices, VAT and accounting records, and responding to lawful requests from authorities. Lawful basis: legal obligation.
  • To run and improve the business: fraud prevention, understanding which products and pages people use, fixing problems, protecting the site, handling complaints and defending legal claims. Lawful basis: our legitimate interests, balanced against your rights.
  • To send you marketing emails about new sets, binders, restocks and offers, only if you have asked for them, and you can unsubscribe at any time from the link in every email. Lawful basis: consent, or the soft opt-in for existing customers who have not objected.
  • To show you advertising on other platforms based on your visit, only where you accept the relevant cookies. Lawful basis: consent.
  • To print custom items with the artwork or text you send us. Lawful basis: performance of a contract.

5. Who we share it with

We share personal information only with companies that help us run Portal TCG, and only what they need. They act on our instructions under contracts that require them to protect it. They include:

  • Shopify, which hosts our store, processes orders, sends order emails and provides our checkout, analytics and email marketing tools, and Shopify Payments and PayPal, which process payments and run fraud checks.
  • Delivery partners: Royal Mail and any courier we use for a particular parcel, who receive your name, address and phone number for delivery.
  • Printful, which prints and posts our merchandise (T-shirts, hoodies, hats) and receives the delivery details for those orders.
  • Marketplace platforms: TikTok Shop and eBay, for orders placed there, and LitCommerce, which keeps our stock and orders in sync between those platforms and the website.
  • Store apps that provide product reviews (Judge.me), back in stock alerts, affiliate tracking (UpPromote) and post purchase offers, each of which processes the details needed for its feature.
  • Business tools: our accounting software (Xero) and accountants, and automation tools (Zapier) that move order and enquiry information between the systems above.
  • Advertising and analytics platforms such as Google, Meta and TikTok, only where you have accepted advertising cookies.
  • Professional advisers, insurers and authorities where the law requires it or to protect our rights, and any buyer of the business if it is ever sold.

We never sell your personal information.

6. International transfers

Some of the companies above store data outside the UK, mainly in the United States, Canada and the European Economic Area. Where that happens we rely on the UK's adequacy decisions or on the UK International Data Transfer Agreement and the Addendum to the EU Standard Contractual Clauses, so your information stays protected to UK standards.

7. How long we keep it

  • Order, invoice and payment records: 6 years after the end of the financial year of the order, as HMRC requires.
  • Account details: for as long as you keep the account, then deleted on request or after a long period of inactivity.
  • Marketing details: until you unsubscribe, then a record that you opted out so we do not email you again.
  • Messages and customer service history: up to 3 years, so we can deal with follow-up questions and disputes.
  • Custom artwork and print files: until the order is complete and any return period has passed, unless you ask us to keep a design for reorders.
  • Live stream recordings: kept by the platform under its own rules; clips we publish stay online unless you ask us to remove one and we agree.

8. Cookies

Cookies are small files placed on your device. We use essential cookies that make the site and checkout work, analytics cookies that tell us how the site is used, and, only with your consent, advertising cookies that let us show you relevant adverts elsewhere. You choose which non-essential cookies to allow in the banner when you first visit and can change your mind at any time through the cookie settings link in the footer or your browser settings. Blocking essential cookies will stop the checkout working.

9. Your rights

Under UK data protection law you can ask us to:

  • tell you what personal information we hold about you and give you a copy (access);
  • correct anything that is wrong (rectification);
  • delete your information where we no longer need it (erasure);
  • stop or limit what we do with it (restriction and objection), including stopping marketing at any time;
  • give you your information in a portable format (portability);
  • withdraw consent where we rely on it, without affecting anything done before.

Email support@portaltcg.co.uk to use any of these rights. We may need to check your identity first. We respond within one month, free of charge in almost all cases. If you are unhappy with how we handle your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we would like the chance to sort it out first.

10. Children

Our website is not aimed at children under 16 and we do not knowingly collect their personal information; accounts and marketing sign-ups are for people aged 16 and over. Live openings, rip and ships and mystery products are for adults aged 18 and over. If you think a child has given us personal information, email us and we will delete it.

11. Security

Our store runs on Shopify's secure platform with encrypted connections, payments are handled by PCI compliant providers, and access to customer information inside the business is limited to the people who need it to do their job. No system is perfectly secure, so please keep your account password private and tell us straight away if you think it has been compromised.

12. Changes to this policy

We update this policy when our practices or the law change. The date at the top tells you when it was last revised, and significant changes will be flagged on the site or by email.