Privacy policy
Your data belongs to you. Here is, in plain words, what FoxTCG collects, why, for how long, and how to exercise your rights (GDPR).
Who is the data controller?
FoxTCG, whose publisher is identified in section 1 of the Terms. For any question about your data: contact@foxtcg.com.
What data is collected, and why?
Customer account (optional): email, name, password (stored hashed, never in clear text), consent date — to manage your account and order history. Legal basis: contract performance and consent.
Orders: name, email, delivery address, order details — to prepare, ship and invoice your order. Legal basis: contract performance. Card payments are processed by Stripe: no banking data ever reaches or is stored by FoxTCG.
Contact form: name, email, message — to reply to you. Legal basis: legitimate interest.
Newsletter: email, with double opt-in — to send you new arrivals (1 email per week maximum). Legal basis: consent, withdrawable at any time via the unsubscribe link.
Audience measurement and security: IP address, browser and visited pages — for visit statistics and bot/fraud detection. Legal basis: legitimate interest. The visit identifier is anonymised and rotates daily: it cannot track you across days.
How long is it kept?
Customer account: until you delete it (possible at any time from your account page).
Invoices and order data: 10 years (legal accounting obligation).
IP address and browser (statistics): automatically erased after 13 months.
Newsletter: until you unsubscribe.
Contact messages: as long as needed to handle your request.
Who can access your data?
No one but FoxTCG, except strictly necessary providers: Stripe (secure payment), OVH (hosting and email, servers in France), La Poste (delivery — name and address only). No data is ever sold, rented or shared for advertising. No transfer outside the European Union.
Cookies
FoxTCG only uses cookies strictly necessary for the site to work: session and cart. No advertising cookies, no third-party trackers. Audience measurement works without cookies. That is why no cookie consent banner is legally required — the information banner on your first visit is there for transparency.
Your rights
Under the GDPR you have the right to access, rectify, erase, port and object to the processing of your data.
From your account page: download a full copy of your data (JSON format) or delete your account in one click. Upon deletion, your account data is erased; only invoices are kept (legal obligation), detached from any account.
For any other request: contact@foxtcg.com — answered within 30 days. You may also lodge a complaint with the CNIL (cnil.fr).
Security
Hashed passwords (never readable), encrypted connection (HTTPS), login attempt throttling, two-factor authentication (TOTP) available on your account, database isolated from the internet and backed up nightly.