Privacy policy

Last updated: 20 August 2026

Card Avenue Ltd operates this store and website, including the information, content, features, tools, products and services made available through it (collectively, the "Services").

Card Avenue Ltd is powered by Shopify, which provides the ecommerce platform that enables us to offer the Services to you.

This Privacy Policy explains how Card Avenue Ltd collects, uses, stores and shares your personal information when you visit or use our website, make a purchase, create an account, contact us, sign up for marketing, or otherwise interact with the Services.

For the purposes of applicable UK data protection law, Card Avenue Ltd is the data controller of the personal information described in this Privacy Policy, except where another organisation, such as Shopify or a payment provider, acts as an independent controller for particular processing activities.

Please read this Privacy Policy carefully so that you understand how we use your personal information.

Personal Information We Collect

"Personal information" means information that identifies you or can reasonably be linked to you. It does not include information that has been anonymised so that you can no longer be identified.

Depending on how you interact with the Services, we may collect or process the following categories of personal information:

• Contact information, including your name, email address, telephone number, billing address and delivery address.

• Account information, including account login details, preferences and settings if you create an account with us.

• Order and transaction information, including products you view, add to your basket or purchase, order history, returns, refunds, cancellations and other transaction details.

• Payment information, including your chosen payment method, billing information, payment confirmation and transaction information. Payment card information may be processed directly by Shopify, payment providers or other payment processors.

• Communications, including information you provide when contacting us by email, through our website, through customer support or by other means.

• Device and technical information, including your IP address, browser type, device type, operating system, network information and other technical identifiers.

• Usage information, including information about how you use and navigate our website, pages you visit, products you view, links you select and how you interact with the Services.

• Marketing preferences, including whether you have chosen to receive marketing communications from us and your preferences relating to those communications.

• Cookie and similar technology information, where cookies, pixels or similar technologies are used as described below.

How We Collect Personal Information

We may collect personal information:

• Directly from you, including when you place an order, create an account, contact us, subscribe to marketing or otherwise provide information to us.

• Automatically when you use the Services, including through cookies, pixels and similar technologies.

• From Shopify and our service providers, where they process information in connection with providing our store, payments, fraud prevention, analytics, delivery or other services.

• From business partners and other third parties, where permitted by applicable law.

How We Use Your Personal Information

We may use your personal information for the following purposes.

Providing and Fulfilling Orders

We use personal information to:

• process and accept orders;

• process payments;

• arrange delivery;

• provide order confirmations and updates;

• manage returns, refunds and cancellations;

• maintain customer accounts;

• respond to questions about purchases;

• provide customer support; and

• otherwise perform our obligations in connection with purchases made through our store.

Operating and Improving Our Store

We may use personal information to:

• operate and maintain our website;

• remember customer preferences;

• understand how customers interact with our store;

• improve our products, website and customer experience;

• diagnose technical problems;

• measure the performance of our Services; and

• develop and improve our business.

Security and Fraud Prevention

We may use personal information to:

• verify transactions;

• protect customer accounts;

• detect and prevent fraud;

• investigate suspicious or potentially unlawful activity;

• protect the security of our website, systems, customers and business; and

• enforce our terms and policies.

Shopify, payment providers and other service providers may also use automated systems to assist with fraud detection and transaction security in accordance with their own privacy practices.

Communicating With You

We may use your contact information to communicate with you regarding:

• orders;

• deliveries;

• returns or refunds;

• your account;

• customer service enquiries;

• changes to our Services or policies; and

• other administrative or transactional matters.

Marketing and Advertising

Where permitted by applicable law, we may use your personal information to send you information about Card Avenue Ltd products, offers, promotions or other news that may be of interest to you.

We will send electronic direct marketing where we have the appropriate permission or another lawful basis to do so, including where the applicable existing-customer or "soft opt-in" rules allow it.

You can unsubscribe from marketing emails at any time by selecting the unsubscribe link contained in the email or by contacting us at sales@cardavenue.co.uk.

Unsubscribing from marketing will not prevent us from sending necessary non-marketing communications relating to orders, payments, deliveries, customer service or your account.

We may also use information about your interactions with our store for advertising, measurement and personalisation where permitted by law and, where required, after obtaining your consent.

Legal and Regulatory Purposes

We may use personal information where necessary to:

• comply with our legal, tax and accounting obligations;

• maintain appropriate business records;

• respond to lawful requests from courts, law enforcement agencies, regulators or other authorities;

• establish, exercise or defend legal claims; and

• protect our legal rights and those of our customers or others.

Lawful Bases for Processing

Where the UK GDPR applies, we process personal information only where we have an appropriate lawful basis.

Depending on the circumstances, we may rely on the following lawful bases.

Performance of a Contract

We process personal information where necessary to enter into or perform a contract with you.

This includes processing necessary to:

• accept and fulfil your order;

• process your payment;

• arrange delivery;

• process returns and refunds;

• manage your customer account; and

• provide customer service relating to your purchase.

Legitimate Interests

We may process personal information where necessary for our legitimate interests or those of another organisation, provided that those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and improving Card Avenue Ltd;

• understanding how customers use our Services;

• providing effective customer service;

• maintaining the security and reliability of our Services;

• preventing fraud and misuse;

• protecting our business and customers;

• keeping appropriate business records; and

• measuring and improving the effectiveness of our Services.

Where required, we balance these interests against the potential effect of the processing on your privacy rights.

Legal Obligations

We may process personal information where necessary to comply with a legal obligation, including obligations relating to:

• taxation;

• accounting;

• consumer protection;

• fraud prevention;

• regulatory requirements; and

• lawful requests from public authorities.

Consent

Where required by law, we rely on your consent for particular processing activities.

This may include:

• certain marketing communications;

• non-essential cookies;

• analytics technologies;

• advertising technologies; and

• other processing for which consent is legally required.

Where we rely on consent, you may withdraw your consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

Information Required to Provide the Services

Certain information is necessary for us to enter into and perform a contract with you.

For example, if you place an order, we generally require information such as your name, delivery address, contact information and appropriate payment information.

If you do not provide information that is necessary to process or fulfil an order, we may be unable to provide the relevant products or Services to you.

Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Cookies are small files or pieces of information stored on or accessed from your device when you visit a website.

Some cookies are strictly necessary for our website to operate. These may be used for purposes such as:

• maintaining your shopping basket;

• providing checkout functionality;

• keeping the website secure;

• remembering essential settings; and

• providing functionality that you request.

Other cookies or similar technologies may be used for:

• analytics;

• measuring website performance;

• understanding how visitors use our store;

• advertising;

• measuring advertising effectiveness; and

• personalising content or advertising.

Where consent is required by law, non-essential cookies and similar technologies will not be used until you have been given an appropriate opportunity to make your choice.

You can manage your cookie preferences through the cookie controls made available on our website.

Changing or withdrawing consent does not affect the lawfulness of processing that occurred before your preferences were changed.

Third-party applications or services used by our store may also use cookies or similar technologies in accordance with their own privacy policies.

How We Share Personal Information

We may share personal information with third parties where necessary for legitimate business purposes and in accordance with applicable law.

These may include:

• Shopify, which hosts and provides the ecommerce platform used to operate our store.

• Payment providers and payment processors, which process payments and assist with payment security and fraud prevention.

• Delivery and fulfilment providers, which require relevant information to deliver orders to customers.

• Technology and hosting providers, which support the operation and security of our business.

• Analytics providers, where used to help us understand and improve our Services.

• Marketing and advertising providers, where permitted by law and subject to applicable consent requirements.

• Customer service providers, where used to assist us in responding to customers.

• Professional advisers, including accountants, legal advisers, insurers and other professional service providers where necessary.

• Government bodies, regulators, law enforcement agencies or courts, where disclosure is required or permitted by law.

We may also disclose personal information in connection with a sale, restructuring, merger, acquisition or transfer of all or part of our business, subject to appropriate legal protections.

We do not disclose personal information to third parties simply because they request it. Disclosure must have an appropriate legal or business purpose.

Relationship With Shopify

Our store is hosted by Shopify.

Shopify collects and processes personal information relating to your access to and use of our store in order to provide its ecommerce services to us and to you.

Information submitted through our store may therefore be transmitted to and processed by Shopify and its service providers.

Shopify may process information in countries other than the country in which you live.

In some circumstances, Shopify may process personal information as our service provider or processor. In other circumstances, Shopify may act as an independent data controller for its own purposes.

Certain Shopify services and enhanced features may use information obtained from your interactions with our store and other Shopify merchants to provide functionality, security, analytics, personalisation or advertising features.

You can find more information about Shopify's privacy practices in the Shopify Consumer Privacy Policy and can manage certain Shopify privacy choices through the Shopify Privacy Portal.

Third-Party Websites and Services

Our Services may contain links to websites or services operated by third parties.

If you follow a link to a third-party website, that organisation's own privacy policy and terms will apply to your use of its services.

We are not responsible for the privacy, security or content of third-party websites that we do not control.

The inclusion of a link does not necessarily mean that Card Avenue Ltd endorses that third party or its services.

Children's Privacy

Our products may be of interest to people of different ages, including younger Pokémon fans.

However, we do not knowingly seek to collect children's personal information for purposes that are not permitted by applicable law.

Where an individual is not legally able to provide information, create an account, enter into a transaction or provide a required consent themselves, a parent or guardian should be involved as required by applicable law.

We do not knowingly use children's personal information for marketing or targeted advertising in circumstances where doing so would be prohibited by law.

If you are a parent or guardian and believe that a child has provided personal information to us inappropriately, please contact us at sales@cardavenue.co.uk.

We will review the request and take appropriate action where required by law.

Security

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no internet transmission, website, database or information system can be guaranteed to be completely secure.

You should therefore take appropriate care when providing information online and should not send highly sensitive or confidential information to us through insecure communication methods.

You are responsible for keeping any customer account credentials confidential.

How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for any additional period required or permitted by law.

The length of time we retain information depends on factors including:

• whether it is needed to provide our Services;

• whether you maintain an account with us;

• the nature of our relationship with you;

• legal, tax and accounting requirements;

• fraud prevention and security requirements;

• whether information is required to resolve a dispute;

• whether information may be required to establish, exercise or defend legal claims; and

• other legitimate business or regulatory requirements.

When personal information is no longer required, we will delete, anonymise or otherwise securely dispose of it where appropriate.

International Transfers

Shopify and some of the service providers that support our business may process or store personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we take appropriate steps where required by law to ensure that the information receives an adequate level of protection.

Depending on the destination and circumstances, these measures may include:

• transferring information to a country recognised by the UK as providing an adequate level of data protection;

• using the UK International Data Transfer Agreement;

• using the UK Addendum to approved Standard Contractual Clauses;

• relying on another legally recognised transfer mechanism; or

• relying on an applicable exception permitted by data protection law.

You can contact us at sales@cardavenue.co.uk if you would like further information about the safeguards relevant to international transfers of your personal information.

Your Data Protection Rights

Depending on the circumstances and applicable law, you may have the following rights regarding your personal information.

Right of Access

You may have the right to ask us whether we process personal information about you and to request a copy of that information.

Right to Rectification

You may have the right to ask us to correct personal information that is inaccurate or complete information that is incomplete.

Right to Erasure

In certain circumstances, you may have the right to ask us to delete personal information we hold about you.

This right is subject to exceptions, including where we are legally required to retain information.

Right to Restriction

In certain circumstances, you may have the right to ask us to restrict how we process your personal information.

Right to Data Portability

In certain circumstances, you may have the right to receive personal information you provided to us in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation.

Right to Object

You may have the right to object to our processing of your personal information where we rely on legitimate interests.

You also have the right to object at any time to the use of your personal information for direct marketing purposes.

If you object to direct marketing, we will stop using your personal information for that purpose.

Right to Withdraw Consent

Where we process personal information on the basis of your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Automated Decision-Making Rights

Where applicable law gives you rights relating to decisions made solely through automated processing that produce legal or similarly significant effects, you may exercise those rights by contacting us.

Exercising Your Rights

You can exercise applicable privacy rights by contacting:

sales@cardavenue.co.uk

We may need to request information reasonably necessary to confirm your identity before responding to certain requests.

We will respond within the period required by applicable law.

You will not be discriminated against for exercising your data protection rights.

In some circumstances, you may authorise another person to make a request on your behalf. We may require appropriate evidence that the person has authority to act for you.

Some rights are subject to legal limitations and exceptions, and we may be permitted or required to refuse certain requests. If this happens, we will explain our decision where required by law.

Marketing Preferences

You can stop receiving marketing emails from us at any time by using the unsubscribe link included in the relevant email.

You can also contact us at sales@cardavenue.co.uk to update your marketing preferences.

Even if you unsubscribe from marketing, we may continue to send communications necessary to administer your account or fulfil transactions with you, including order and delivery information.

Complaints

If you have a concern about how Card Avenue Ltd collects or uses your personal information, please contact us first at:

sales@cardavenue.co.uk

We will aim to investigate and respond appropriately.

If you are in the United Kingdom and are dissatisfied with our response, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

You can find information about making a complaint on the ICO's official website.

If you live outside the United Kingdom, you may also have the right to complain to the relevant data protection or supervisory authority in the country where you live or work.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be made to reflect:

• changes to our business or Services;

• changes to the technologies or service providers we use;

• changes to our privacy practices; or

• changes to applicable laws and regulatory requirements.

When we update this Privacy Policy, we will update the "Last updated" date at the top of this page and provide any additional notice required by law.

We encourage you to review this Privacy Policy periodically.

Contact Us

If you have any questions about this Privacy Policy, our privacy practices or your personal information, or if you would like to exercise any of your data protection rights, please contact:

Card Avenue Ltd
Email: sales@cardavenue.co.uk

For the purposes of applicable data protection law, Card Avenue Ltd is the data controller responsible for the personal information described in this Privacy Policy, except where another organisation acts as an independent controller for its own processing activities.