Last updated: 18 September 2026
This Privacy Policy describes how Card Frontier Collectibles VOF processes personal data through card-frontier.com, our customer service and services connected to the webshop.
1. Data controller
Card Frontier Collectibles VOF
Tappersweg 59, 2031 ET Haarlem, Netherlands
Chamber of Commerce: 42135848
VAT ID: NL869881334B01
Email: info@card-frontier.com
2. What data do we process?
Depending on how you use our webshop, we may process, among other things: name, billing and shipping address, email address, phone number when provided, order and return details, payment status and transaction references, account details, customer-service communications, IP address, device and browser information, cookie or consent data and data necessary for security and fraud prevention.
We normally do not receive full payment-card details; these are processed by the relevant payment provider.
3. Purposes
We use personal data to process and deliver orders, payments and refunds, pre-orders, returns, customer service, statutory administration, fraud prevention and security, improvement of the webshop, analytics and – where permitted – marketing and personalization.
4. Legal bases
Depending on the purpose, processing is based on performance of a contract, a legal obligation, legitimate interests or consent. Where we rely on legitimate interests, we balance our interests against the privacy interests of the persons concerned. Consent may be withdrawn for the future.
5. Orders, payment and fraud prevention
To perform an order, we process the data necessary to enable payment, delivery, returns and customer service.
For security and fraud prevention, we may compare order, payment, address, device, communication and shipping data and, for unique collectibles, record product characteristics such as photos, card numbers, serial numbers or certificate numbers where this is necessary and proportionate. This helps prevent, among other things, product swaps, return fraud and chargeback abuse.
6. With whom do we share data?
We only share data where necessary or lawful. Recipients may include Shopify and webshop-related hosting and infrastructure services, payment providers, banks, carriers, fulfillment or shipping services, accounting and administrative services, email and customer-service providers, analytics and marketing services where the required consent has been obtained, security and fraud-prevention services, professional advisers and competent public authorities.
We do not sell personal data as a commercial product.
7. Shopify
Our webshop runs on Shopify. Shopify processes personal data for the technical operation of the store, checkout, security and other ecommerce functions. Depending on the Shopify services used, Shopify may act as a processor and/or independent controller. Shopify's current processing also depends on the Shopify configuration and enabled services.
8. Transfers outside the EEA
Some service providers may process data outside the European Economic Area. Where this occurs, and to the extent applicable to us, we ensure a valid transfer mechanism, for example an adequacy decision, applicable certification or approved standard contractual clauses and supplementary safeguards where required.
9. Retention periods
We do not retain data longer than necessary. Order, invoice and tax administration is generally retained for the statutory retention period, normally 7 years. Data subject to a longer OSS/IOSS retention obligation may be kept for that statutory period.
Customer-service communications are generally retained for no more than 2 years after the last substantive communication, unless longer retention is necessary for a complaint, warranty, dispute, fraud investigation or legal obligation. Account data is retained while the account remains active or until deletion is lawfully requested and possible. Marketing data is retained until you unsubscribe or withdraw consent, subject to minimal data needed to respect an opt-out.
10. Cookies and similar technologies
We use necessary technologies for the cart, checkout, security and preferences. Non-essential analytics, personalization and marketing technologies are only used where a valid legal basis exists and, where required, after consent has been given. More information is available in our Cookie Policy and cookie settings.
11. Marketing
If you subscribe to marketing, we may send messages about releases, pre-orders, products, promotions and CFC news. You can unsubscribe via the unsubscribe link or by contacting info@card-frontier.com.
12. Security
We take appropriate technical and organizational measures, such as secure connections, access restrictions and multi-factor authentication where available. No digital system can guarantee absolute security.
13. Your rights
Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Send a request to info@card-frontier.com.
We may request information reasonably necessary to verify your identity. We respond within the statutory period and may extend that period where permitted by the GDPR.
14. Automated signals
Payment, security and fraud-prevention services may use automated signals. We may manually review suspicious orders. To the extent we would make a decision based solely on automated processing that produces legal effects or similarly significant effects, we will respect the applicable legal safeguards.
15. Minors
Our webshop is not specifically directed at children under 16. Where consent for an online service cannot legally be given independently by a minor, we will seek consent from a parent or legal representative where required.
16. Complaints
If you have a privacy complaint, first contact us at info@card-frontier.com. You retain the right to lodge a complaint with the Dutch Data Protection Authority or another competent European supervisory authority.
17. Changes
We may amend this policy when our services, legislation, Shopify configuration or service providers change. The most current version is available on our website.