GDPR
Privacy policy
Last updated: September 24, 2026
La Maison du TCG is committed to protecting your privacy. This policy describes what data we collect, why, and your rights over that data.
1. Data controller
La Maison du TCG, whose details appear in the Legal notice, is the controller of data collected via lamaisondutcg.com.
2. Data collected
Identification data (email, name, shipping address), order data (purchase history, cart), gamification data (XP, ranks, badges, activity), browsing data (cookies, anonymised IP), and, if you consent to marketing (newsletter or the marketing checkbox at signup), proof of that consent: date, IP address at opt-in time and collection point. Payment is processed directly by Shopify and our providers, we store no card number.
3. Purposes
Order processing, account management, loyalty programme, newsletter (opt-in only), measuring how our ads perform (with your consent), fraud prevention, legal and accounting obligations, service improvement.
4. Legal basis
Contract performance (orders), consent (newsletter, non-essential cookies, ad measurement), legitimate interest (security, fraud prevention), legal obligation (invoicing, 10-year accounting retention).
5. Retention
Active account: until you request deletion. Invoices: 10 years (accounting obligation). Analytics cookies: 13 months max. Technical logs: 12 months. Proof of marketing consent is kept for 3 years after the last contact, then deleted.
6. Your rights
You may exercise your rights of access, rectification, erasure, portability, objection and restriction at any time. Send a request to privacy@lamaisondutcg.com with proof of identity. We reply within 30 days. In case of dispute: French CNIL (www.cnil.fr).
7. Cookies
We use functional cookies (always on: cart, session, language), analytics (anonymised audience measurement, opt-in) and marketing (personalisation and ad measurement, opt-in, see section 8). You can change your preferences anytime via the consent banner.
8. Measuring our ads
Only if you accepted marketing cookies: when you place an order, we send Google (Google Ads), Meta (Facebook, Instagram) and TikTok the information needed to measure how well our ads perform. This is your email address in hashed form (irreversibly transformed, never sent in plain text), the identifier of the ad click that brought you to the site if there is one, your order's identifier, amount and currency, and, for Meta and TikTok, your IP address and browser. For Google, this processing is governed by the Google Ads Data Processing Terms, which make Google our processor. These partners may process this data outside the European Union, with the safeguards provided by the GDPR (adequacy decision or standard contractual clauses). Without marketing consent, nothing is sent. You can withdraw this consent at any time via the consent banner.