Privacy Policy

01Controller

Misstep Lda, NIPC 519506383, registered office Rua 25 de Abril 15 2 Dto, 2510-705 Gaeiras, Portugal. For any data-protection question: support@misstepgames.com

Given the size and nature of our activity we are not required to appoint a Data Protection Officer. Questions are handled directly by management at the address above.

02What we collect, and on what basis

Orders

To sell and deliver a product to you we collect: your email address, name and delivery address, billing address (if different) and, optionally, your VAT number. We also store the items, amounts and the VAT applied.

• Purpose: performing the sales contract, delivering your order and issuing an invoice.
• Basis: performance of a contract — article 6(1)(b) GDPR. For the invoice itself, compliance with a legal obligation — article 6(1)(c).

This data starts being stored before you complete the order: when you fill in your details at checkout we save them against your cart so you do not lose them moving between steps.

Providing these details is necessary to conclude the contract: without an email address and a delivery address we cannot accept an order, deliver it or issue the invoice. The VAT number is optional and only relevant to a business buyer.

If you give an EU VAT number from another Member State, we check it in the European Commission's VIES register at the details step, and we keep the result with the order — whether the number was valid, when we checked, and the registered name VIES returned — because it is the evidence that supports invoicing without VAT.

Newsletter

If you subscribe we store your email address, language, the date you subscribed, the date you confirmed, and the exact consent wording you were shown.

• Purpose: sending you release news and restock alerts.
• Basis: consent — article 6(1)(a). We use double opt-in (you receive an email to confirm), and you can withdraw consent at any time via the unsubscribe link in any email or by writing to support@misstepgames.com.

Stock alerts

On a product that is not available you can ask to be told when it is. We store your email address, the product, your language, the dates of the request, confirmation and notification, and the exact consent wording you were shown.

• Purpose: sending you one email when that product becomes available. Nothing else.
• Basis: consent — article 6(1)(a), with double opt-in. If your address is already confirmed for a stock alert, later alerts skip the confirmation email.
• Removal: every alert email carries a removal link that deletes the record, and you can always write to support@misstepgames.com.
• Retention: the record is deleted 12 months after the alert is sent — or after 12 months if you never confirmed it.

Buylist

Searching for cards and building a sell list are anonymous. We collect no personal data at this stage — the list is tied only to a random identifier in your browser. When list submission launches, this policy will be updated before we begin collecting the data needed to pay you.

Collection purchases

To sell a whole collection, you talk to us on WhatsApp or by email. If you use WhatsApp, the conversation runs on WhatsApp's service, which is not part of our systems: for the content of the messages, WhatsApp Ireland Limited (a Meta company) acts as our processor under WhatsApp's business terms; for its own account and usage data it is a separate controller under its own privacy policy. If you would rather avoid it, write to support@misstepgames.com.

From the conversation we keep only what performing the purchase requires: your identification, the agreement on the amount, and payment details. See the Card Purchase Terms.

Cookies

We use three strictly necessary cookies, and none of them is set until you add something to your cart, add a card to your buylist, or choose a language. Reading the site leaves nothing on your device. See the Cookie Policy.

03What we do NOT do

• No advertising, and no third-party script that tracks you. We do count visits, with software we run ourselves that stores nothing on your device, uses no identifier that follows you between sites or from one month to the next, honours your browser's Do Not Track setting, and produces only statistics that do not identify you — described in full under Audience measurement.
• We do not sell, rent or pass your data to third parties for marketing.
• We make no automated decisions and carry out no profiling with legal effects.
• We do not knowingly collect data from anyone under 13. The store is for adults, or minors with the consent of whoever holds parental responsibility, as the Terms say.

04Who we share it with

We share only what is strictly necessary, with processors acting on our behalf under contract:

Payments are processed by Stripe: your card details never pass through our servers and are never stored by us. Stripe also uses payment data for its own fraud prevention and legal compliance, for which it is a controller under its own privacy policy.

The carrier that delivers your order is the one named in your dispatch email; the country of the delivery decides which one.

Where a recipient handles data outside the European Economic Area, the transfer rests on a European Commission adequacy decision — the EU-US Data Privacy Framework, for recipients certified under it — or otherwise on the Standard Contractual Clauses approved by the Commission.

05How long we keep it

06Your rights

You have the right to access your data, and to request its rectification, erasure, restriction of processing, portability, and to object to processing. Where processing rests on consent you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

These rights have limits where they meet a legal obligation: we cannot delete an invoice already issued before its statutory retention period has run.

To exercise any of these rights, write to support@misstepgames.com. We respond within one month.

If you believe we have not handled your request properly, you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.

07Security

The site is served exclusively over an encrypted connection (HTTPS), and every cookie we set is marked so that it travels only over that connection. The cart, buylist and staff-session cookies are httpOnly, meaning they cannot be read by scripts in the browser; the language cookie is not, because the page itself has to read it. Access to the administration area is restricted to named staff signing in with their own account.

08Changes

If we change this policy, the "last updated" date at the top changes with it. If a change is substantial — for example if we start using analytics cookies — we will ask for your consent before applying it.