Privacy policy

Who is responsible

TCG Bank, Sweden, is the data controller for the personal data processed on this site. Contact: jenspeter@gmail.com. We process data under the EU General Data Protection Regulation (GDPR) and Swedish law.

What we collect and why

• Browsing the card explorer. No account, no tracking cookies, no analytics. Our web server keeps standard access logs (IP address, time, page, browser string) for security and troubleshooting; they are rotated after a short period. Legal basis: legitimate interest in running a secure site (art. 6(1)(f)).
• Shopping. A strictly necessary cookie (cm_cart) holds a random id for your cart for 30 days; it identifies nothing about you. When you pay, Stripe collects your name, email, phone, shipping address and card details on its own pages; we receive everything except the card details, and we use them to deliver and support your order. Legal basis: performance of a contract (art. 6(1)(b)). Order records are kept for 7 years because Swedish accounting law requires it; name, phone and address are removed from shipped orders after 2 years. Abandoned carts are deleted after 30 days.
• Registering interest in the fund. Name, email, phone and the message you write, so we can reply. Your IP address and browser string are stored for 30 days to stop spam, then deleted. Legal basis: steps at your request before a contract (art. 6(1)(b)). If you become an investor, your details and your unit holdings are kept for the life of the investment and the retention periods that follow from accounting and anti-money-laundering rules.
• Investor pages. Your personal fund page is reached through a secret link we send you. It shows your own holdings only. Legal basis: contract.
• Owner login. A session cookie (cm_session) for the site owner only.

Who else sees your data

• Stripe Payments Europe Ltd (Ireland) processes payments and holds your payment details; it is an independent controller for the card data and our processor for the checkout details. See Stripe's privacy policy.
• Postal carriers receive your name and address to deliver a parcel.
• Hosting in the EU (Hetzner, Finland). Backups are stored on the same server.
• Cards we source for you from marketplace sellers are shipped to us first; sellers never receive your details. We do not sell or share personal data for marketing, and we do not transfer it outside the EU/EEA except where Stripe does so under its own safeguards.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to processing, and receive it in a portable format. Write to jenspeter@gmail.com; we answer within 30 days and may ask you to confirm your identity. Deletion may be refused where the law requires us to keep records (for example invoices). You can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or your local supervisory authority.

Cookies

Only strictly necessary cookies are used (cart id, owner session). No consent banner is shown because no optional cookies, trackers or third-party analytics exist on this site. Stripe sets its own cookies on its checkout pages.

Security

All traffic is encrypted (HTTPS). Secrets and payment keys are never stored in the browser. Access to the owner area is password protected and rate limited. We keep this policy current; material changes are noted here with a new date.