Privacy Policy
This policy sets out exactly which personal data Misstep Lda collects through this store, why, on what legal basis, who we share it with and how long we keep it. It is written from how the store actually works, not from a generic template.
Last updated: 20 August 2026.
1. Controller
Misstep Lda, NIPC 519506383, registered office Rua 25 de Abril 15 2 Dto, 2510-705 Gaeiras, Portugal. For any data-protection question: support@misstepgames.com
Given the size and nature of our activity we are not required to appoint a Data Protection Officer. Questions are handled directly by management at the address above.
2. What we collect, and on what basis
Orders
To sell and deliver a product to you we collect: your email address, name and delivery address, billing address (if different) and, optionally, your VAT number. We also store the items, amounts and the VAT applied.
- Purpose: performing the sales contract, delivering your order and issuing an invoice.
- Basis: performance of a contract — article 6(1)(b) GDPR. For the invoice itself, compliance with a legal obligation — article 6(1)(c).
This data starts being stored before you complete the order: when you fill in your details at checkout we save them against your cart so you do not lose them moving between steps.
Newsletter
If you subscribe we store your email address, language, the date you subscribed, the date you confirmed, and the exact consent wording you were shown.
- Purpose: sending you release news and restock alerts.
- Basis: consent — article 6(1)(a). We use double opt-in (you receive an email to confirm), and you can withdraw consent at any time via the unsubscribe link in any email or by writing to support@misstepgames.com.
Stock alerts
On a product that is not available you can ask to be told when it is. We store your email address, the product, your language, the dates of the request, confirmation and notification, and the exact consent wording you were shown.
- Purpose: sending you one email when that product becomes available. Nothing else.
- Basis: consent — article 6(1)(a), with double opt-in. If your address is already confirmed for a stock alert, later alerts skip the confirmation email.
- Removal: every alert email carries a removal link that deletes the record, and you can always write to support@misstepgames.com.
- Retention: the record is deleted 12 months after the alert is sent — or after 12 months if you never confirmed it.
Buylist
Searching for cards and building a sell list are anonymous. We collect no personal data at this stage — the list is tied only to a random identifier in your browser. When list submission launches, this policy will be updated before we begin collecting the data needed to pay you.
Collection purchases
To sell a whole collection, you talk to us on WhatsApp or by email. If you use WhatsApp, that conversation passes through the infrastructure of Meta Platforms Ireland Limited, which acts as a processor and is not part of our systems — if you would rather avoid it, write to support@misstepgames.com.
From the conversation we keep only what performing the purchase requires: your identification, the agreement on the amount, and payment details. See the Card Purchase Terms.
Cookies
We use only two strictly necessary cookies. See the Cookie Policy.
3. What we do NOT do
- No advertising, no analytics, and no third-party script that tracks you.
- We do not sell, rent or pass your data to third parties for marketing.
- We make no automated decisions and carry out no profiling with legal effects.
4. Who we share it with
We share only what is strictly necessary, with processors acting on our behalf under contract:
| Who | For what | Where |
|---|---|---|
| Vercel | Website hosting | EU / US |
| Neon | Database | EU |
| Stripe | Payment processing | EU / US |
| Moloni | Issuing the certified invoice | Portugal |
| Resend | Sending transactional email | EU / US |
| Postal operator (CTT) | Delivering your order | Portugal |
| Meta (WhatsApp) | Conversations about selling cards | EU / US |
Payments are processed by Stripe: your card details never pass through our servers and are never stored by us.
Where a processor handles data outside the European Economic Area, that transfer relies on the Standard Contractual Clauses approved by the European Commission.
5. How long we keep it
| Data | Period |
|---|---|
| Invoices and sale tax records | 10 years — legal obligation (article 52 of the Portuguese VAT Code) |
| Order contact details | For the duration of the relationship, then in the tax archive |
| Newsletter subscription | Until you unsubscribe |
| Abandoned carts | 30 days from your last activity, then deleted |
| Stock alerts | 12 months after the alert is sent, or 12 months if never confirmed |
| Purchases from individuals | Statutory archive period; your IBAN is deleted 90 days after payment |
6. Your rights
You have the right to access your data, and to request its rectification, erasure, restriction of processing, portability, and to object to processing. Where processing rests on consent you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
These rights have limits where they meet a legal obligation: we cannot delete an invoice already issued before its statutory retention period has run.
To exercise any of these rights, write to support@misstepgames.com. We respond within one month.
If you believe we have not handled your request properly, you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.
7. Security
The site is served exclusively over an encrypted connection (HTTPS). Session cookies are
httpOnly, meaning they cannot be read by scripts in the browser. Access to the administration
area is restricted.
8. Changes
If we change this policy, the "last updated" date at the top changes with it. If a change is substantial — for example if we start using analytics cookies — we will ask for your consent before applying it.