Privacy Policy

1.In short

We collect very little. If you join our mailing list we keep your email address, proof that you agreed to receive marketing, and any promotional code linked to your record. If you browse the Site, analytics and advertising tools record how the Site was used. We do not sell your personal information. You can unsubscribe or ask us to delete your data at any time.

2.Who is responsible for your data

Sevag Pashayan, carrying on business as HokiePokie TCG, is the person responsible for the personal information described here (the "controller" under European law, and the person responsible for the protection of personal information under Quebec's Law 25).

Privacy contact: tcghokiepokie@gmail.com. Postal address: PO Box 52087, RPO Fabreville, Laval, Quebec, H7P 5S1, Canada. This address also serves as our privacy officer contact for the purposes of Quebec's Law 25.

3.What we collect

Information you give us directly:

• Your email address, and the language you signed up in, when you join the mailing list or a waitlist.
• A record of your consent: the exact wording you agreed to, the date and time, and the IP address used. We keep this because Canadian anti-spam law requires us to be able to prove consent.
• Whatever you choose to include when you contact us or reserve an item by email or Instagram message. This is typically your name, your message and which card you are interested in.
• If we launch online ordering: your delivery address, order history and contact details. Payment would be processed by a third-party payment provider; we would receive confirmation of payment but not your full card number.

4.What is collected automatically

Like most websites, we and our analytics and advertising providers automatically receive technical information when you visit: your IP address, browser and device type, operating system, the pages you view and how long you spend on them, the site or ad that referred you, and general location inferred from your IP address (typically city-level). This is collected through cookies and similar technologies.

5.Analytics and advertising tools we use

We currently use the following third-party tools on the Site. Each one may set cookies and receive information about your visit directly from your browser, and may combine it with data it already holds about you:

• Google Analytics 4: measures traffic and how the Site is used.
• Google Tag Manager: loads and manages the tags listed here.
• Google Search Console: reports how the Site performs in Google Search. It uses aggregated search data rather than cookies on your browser.
• Meta (Facebook) Pixel: measures the performance of our Instagram and Facebook advertising and lets us show ads to people who have visited the Site.
• Vercel Analytics: privacy-focused traffic measurement used by our hosting provider.

We expect to add further measurement and advertising tools as the business grows. TikTok Pixel is the most likely next one, and others may follow. When we add a tool that collects personal information, we will update this policy and, where consent is required, ask for it through our cookie banner before the tool loads.

These providers act as independent businesses in their own right for advertising purposes. Their handling of your data is governed by their own privacy policies, which we encourage you to read: Google (policies.google.com/privacy), Meta (facebook.com/privacy/policy) and TikTok (tiktok.com/legal/privacy-policy).

6.Cookies and how to control them

Cookies are small files stored by your browser. We use a small number that are strictly necessary to make the Site work and to remember choices such as your language and whether you have dismissed the newsletter popup. The analytics and advertising cookies above are not strictly necessary.

Our cookie banner lets you accept or decline non-essential cookies, and you can change your mind at any time through the Cookie Settings link in the footer. You can also block or delete cookies in your browser settings, though parts of the Site may then behave unexpectedly. To opt out of Google Analytics across all sites, Google offers a browser add-on at tools.google.com/dlpage/gaoptout.

7.Why we use your information

We use personal information to:

• send you the marketing emails you signed up for: new inventory, discounts and price drops, giveaways, Pokémon news, and the card shows we will be attending as a vendor or a buyer;
• issue and administer any promotional code linked to your record, including checking that it has not already been used;
• answer your questions and arrange a reservation, sale or trade;
• send order and delivery updates, if and when we offer online ordering;
• understand how the Site is used so we can improve it;
• measure and target our advertising;
• keep records we are legally required to keep, prevent fraud and abuse of promotions, and establish or defend legal claims.

8.Our legal bases (EU / UK visitors)

Where the GDPR or UK GDPR applies to you, we rely on: your consent for marketing emails and for non-essential cookies and advertising tools, which you may withdraw at any time; the performance of a contract, or steps taken at your request before entering one, when we handle a reservation or an order; our legitimate interests in running, securing and improving the Site and preventing abuse of our promotions; and compliance with a legal obligation for record keeping.

9.Marketing emails and your control over them

We only add you to the mailing list if you ask us to and then confirm your address by clicking a link we email you. Every marketing email identifies us, gives our postal address and carries an unsubscribe link that works for at least 60 days, as Canada's Anti-Spam Legislation requires. Unsubscribing takes effect immediately.

When you unsubscribe we keep a minimal record of your address and your original consent, so that we can honour your opt-out and demonstrate that consent existed. We do not use that record to send you anything further.

10.Who we share information with

We do not sell your personal information, and we do not share it with anyone who wants to market their own products to you.

We do share it with service providers who process it on our behalf, under contract and only for the purposes we set: our website host and database provider (Vercel and Neon), our email provider (Resend), and the analytics and advertising providers listed above. We may also disclose information where the law requires it, to enforce our terms, or to a buyer if the business is ever sold, in which case we would tell you first.

11.Where your information is processed

We are based in Quebec, Canada. Our providers may store or process data in Canada, the United States and the European Union, meaning your information may be transferred outside your country and be accessible to authorities there under local law.

Before entrusting personal information to a provider outside Quebec we assess whether it will receive adequate protection, as Law 25 requires. For transfers from the EU or the UK, we rely on Standard Contractual Clauses or an equivalent safeguard offered by the provider.

12.How long we keep it

Mailing list records are kept while you are subscribed and, after you unsubscribe, for as long as we need to prove that consent existed and to honour your opt-out. Promotional code records are kept while the code is live and for a reasonable period after redemption so we can resolve disputes. Enquiry emails and Instagram messages are kept as long as needed to serve you and for our ordinary business records. Analytics data is retained according to each provider's settings, typically between two and fourteen months. Where we would have transaction records, tax law requires us to keep them for six years.

13.Your rights

Wherever you live, you can ask us to: confirm what we hold about you and give you a copy; correct anything inaccurate; delete your information; stop sending you marketing; or stop relying on your consent.

If you are in Quebec, Law 25 also gives you the right to receive the information you provided us in a structured, commonly used technological format, the right to ask that a search-engine link to your information be de-indexed in certain circumstances, and the right to be informed of and to object to the use of technology that profiles, identifies or locates you, which is what our advertising and analytics tools do. You can exercise that last right by declining non-essential cookies in our banner.

If you are in the EU or the UK, you additionally have the right to object to or restrict certain processing, and the right to data portability.

To exercise any of these, email tcghokiepokie@gmail.com. We will respond within 30 days. If we ever refuse a request we will explain why and tell you how to challenge it. We do not use your data for automated decision-making that produces legal effects.

14.Complaints

If you are not satisfied with how we have handled your information, please tell us first and we will try to put it right. You can also complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, if you are in the EU or the UK, to your local data protection authority.

15.Security and breaches

The Site is served over HTTPS, subscriber data is held in an access-controlled hosted database, and verification and unsubscribe links use long random tokens rather than anything guessable. No system is perfectly secure, and we cannot guarantee absolute security.

If a confidentiality incident occurs that presents a risk of serious injury, we will notify the Commission d'accès à l'information and affected individuals promptly, and keep a register of incidents, as Law 25 requires.

16.Children

The Site is intended for collectors old enough to transact, and is not directed at young children. We do not knowingly collect personal information from a child under 14 without parental consent. If you believe a child has given us their information, contact us and we will delete it.

17.Changes to this policy

We will update this policy when our practices change, for example when we add a new advertising tool or launch online ordering. The date at the top shows when it last changed. If a change materially affects how we use information you have already given us, we will tell you and, where the law requires, ask for your consent again.

18.Contact

Privacy questions and requests: tcghokiepokie@gmail.com, or by mail to Sevag Pashayan, carrying on business as HokiePokie TCG, PO Box 52087, RPO Fabreville, Laval, Quebec, H7P 5S1, Canada.