Privacy policy

The Guildmaster (theguildmaster.eu) is operated by The Guildmaster Trading, the sole proprietorship of Marc van Drunen, Koningsweg 99, 6655 AB Puiflijk, the Netherlands. Chamber of Commerce (KvK): 98583840. We are the controller for the personal data described on this page.

Questions, requests or complaints about your data: orders@theguildmaster.eu.

Your account. Email address, an optional name and a password. The password is stored only as a cryptographic hash — we cannot read it. We also briefly hold single-use tokens for email verification and password resets. Legal basis: performing our agreement with you.

Your orders. Your name, delivery address, email address, what you ordered, the order's payment and shipping status, and — if you filled it in — your answer to “how did you find us”. Legal basis: performing the agreement, and legal (tax) obligations for the resulting invoices.

Business details (optional). If you buy for a business, the company name, VAT number and Chamber of Commerce number you give us, and the date we last checked the VAT number. We check a VAT number by sending it to the European Commission's VIES service, which asks the tax authority of the country that issued it whether it is valid; only the number is sent. These details are printed on your invoices and pro formas, and each order keeps the VAT number it was placed under. Legal basis: performing the agreement, and legal (tax) obligations — an invoice to a business must carry its VAT number, and a 0% supply to a business in another EU country requires us to verify it.

Updates by email (optional). If you tick the box for news and updates, we record your email address and the moment you consented. Legal basis: your consent, which you can withdraw at any time via the unsubscribe link or by emailing us.

Correspondence. Emails you send us, so we can answer and keep track of the conversation. Legal basis: legitimate interest (customer service).

Security. Failed sign-in attempts are counted to temporarily lock an account against password guessing. Legal basis: legitimate interest (keeping accounts safe).

Visitor counts (Spectral Supplies only). On spectralsupplies.theguildmaster.eu we count how many visits our pages get, so the shopkeeper can see whether a shared link reached anyone. Each visit is turned into a one-way code made from your IP address, your browser description and the date — the IP address itself is never stored, and because the date is part of the code, the same visitor gets a different code tomorrow. We keep the code, the page, the country and the website you arrived from; nothing that identifies you, and nothing that lets us follow you from one day to the next. No cookie is involved and the counting is done by us, not by an outside service. Legal basis: legitimate interest (knowing whether the shop is being found).

We collect nothing else. We build no advertising profiles and run no analytics service; the one outside measurement is Google Ads, which counts which of our adverts bring visitors here — see section 7 for what it sends and when it may set cookies. We never sell or rent personal data.

Payments are processed by Rabo Smart Pay (Coöperatieve Rabobank U.A.) (Utrecht, the Netherlands). Your payment details — card numbers, bank account details — go directly to the payment processor and never reach our systems; we only receive confirmation that a payment succeeded or failed. Each processor is independently responsible for the payment data it processes; see Rabobank's privacy statement.

We use a small number of service providers to run the shop. They process data on our instructions and only what is needed:

• Vercel — hosts the website; our application and functions run in the European Union (Frankfurt).
• Neon — hosts our database, located in the European Union (Frankfurt).
• Google Workspace — our business email; order confirmations and account emails are sent through it.
• Google Ads — measures which of our adverts bring visitors here, with cookies only if you accept them (see section 7).
• European Commission (VIES) — receives a business customer's VAT number, and passes it to the issuing country's tax authority, to confirm it is valid.
• PostNL — receives your name and delivery address to deliver your parcel.
• Rabobank — payment processing, as described above.

One note on images: card artwork in the singles search is loaded by your browser directly from the image servers of Scryfall, a card database. Like any server that serves an image to you, Scryfall sees your IP address for that request — nothing more is shared with them.

Your data is stored in the European Union. Some of our providers (such as Vercel and Google) are part of US companies; where any data could be transferred outside the EU, this is covered by EU-approved safeguards (the EU–US Data Privacy Framework and/or standard contractual clauses).

• Orders and invoices: 7 years, as required by Dutch tax law.
• Your account: until you ask us to delete it. On deletion we remove the account; order records tied to past purchases remain for the tax retention period above.
• Business details: as long as your account, or until you remove them on your account page. A VAT number already printed on an invoice stays with that invoice for the tax retention period.
• Email updates list: until you unsubscribe.
• Verification and reset tokens: at most 24 hours, single use.
• Correspondence: as long as needed to handle and follow up on it.
• Visitor counts: 400 days, so a month can be compared with the same month a year earlier. Older records are deleted automatically.

We use one functional cookie of our own: a signed session cookie that keeps you logged in after you sign in to your account. It lives for 30 days, is not readable by scripts and is used for nothing except recognising your session. It needs no consent.

We also use Google Ads to measure which of our adverts bring visitors to the shop. Its cookies are set only if you click “Accept” in the cookie banner. Until then — and for good if you decline — the Google tag stores nothing on your device and sends Google only anonymous, cookieless signals that a page was viewed. Google may process this data outside the EU. You can change your answer at any time via “cookie settings” at the foot of every page.

Your shopping crate and your cookie choice are stored in your own browser (local storage); the crate only reaches us when you check out. The visitor counting described in section 2 uses no cookie either.

All traffic to the site is encrypted (HTTPS). Passwords are stored only as salted cryptographic hashes. Email verification and password-reset links are single-use and time-limited, and repeated failed sign-ins temporarily lock the account. Access to our systems is limited to the owner.

Under the GDPR (AVG) you can at any time ask us to:

• see the personal data we hold about you (access);
• correct it (rectification);
• delete it, where no legal duty requires us to keep it (erasure);
• hand it over in a portable format (data portability);
• restrict or object to how we use it;
• withdraw consent you gave earlier (for example for email updates).

Email orders@theguildmaster.eu and we will respond within one month. If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

The shop is not directed at children. If you are under 16, ask a parent or guardian to place the order or to consent to your account.

If how we handle data changes — a new tool, a new feature — we update this page and the date below. Significant changes that affect you will be pointed out on the site.