Who we are
Victory Road Collectables Ltd is the data controller for this website. We're registered in Scotland (company number SC856351), registered office 5 Letherby Drive, Glasgow G44 4TS. For anything privacy-related — questions, requests, complaints — email Scott@vrcollectables.co.uk.
What we collect, why, and our lawful basis
- Contact form: your name, email, phone (if you give it), subject and message. Used only to reply to you. Lawful basis: legitimate interests — answering the message you sent us. Kept only as long as the conversation needs, then deleted.
- Event registrations: your name, email and Player ID (if you give one). Used to send your confirmation email and run the door list on the night. No payment is taken online. Lawful basis: contract — reserving the place you asked for. Registrations are automatically deleted within a month of the event.
- Grading submissions: your name, contact details and the cards submitted. Lawful basis: contract. Kept for as long as needed to complete and warranty the submission, then deleted.
- Visiting the site: our host processes your IP address to deliver pages and block attacks. Lawful basis: legitimate interests — keeping the site up and secure.
Who handles your data for us
- Cloudflare hosts this site and its registration database, and processes visitor IP addresses to serve and secure it.
- Resend sends our confirmation and contact emails on our instructions. Resend is a US company — transfers are protected by the UK–US Data Bridge and standard contractual safeguards.
- Google receives usage data only if you accept analytics cookies (see below). If you decline — or are never asked — nothing goes to Google. All fonts and images on this site are served from our own domain, so simply browsing sends nothing to third parties.
We never sell your details, share them for marketing, or send you marketing emails you didn't ask for.
Cookies & local storage
- By default this site sets no cookies at all — no advertising, no tracking, no "we care about your privacy" pop-up theatre.
- Our host may set a strictly-necessary security cookie (e.g. Cloudflare's bot protection) to keep the site safe. These are exempt from consent under PECR.
- If we enable analytics (Google Analytics), you'll be asked first with a clear banner — analytics cookies are set only if you choose "Accept", and you can change your mind any time via the "Cookie choices" link in the footer. Your yes/no choice is remembered in your browser's local storage, which is the only storage we use ourselves.
How long we keep things
- Event registrations: deleted automatically within a month of the event.
- Contact messages: deleted once the conversation is finished with.
- Grading records: kept for the life of the submission and any warranty period, then deleted.
Your rights
Under UK GDPR you can ask us for a copy of what we hold about you, ask for it to be corrected or deleted, object to or restrict our use of it, and withdraw any consent you've given. Email the address above and we'll sort it — no forms, no fuss. You can also complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator, though we'd appreciate the chance to fix things first.
Changes
If this policy changes, the new version appears here with an updated date. We won't quietly weaken it.