Privacy policy

The Guildmaster (theguildmaster.eu) is operated by The Guildmaster Trading, the sole proprietorship of Marc van Drunen, Koningsweg 99, 6655 AB Puiflijk, the Netherlands. Chamber of Commerce (KvK): 98583840. We are the controller for the personal data described on this page.

Questions, requests or complaints about your data: orders@theguildmaster.eu.

Your account. Email address, an optional name and a password. The password is stored only as a cryptographic hash — we cannot read it. We also briefly hold single-use tokens for email verification and password resets. Legal basis: performing our agreement with you.

Your orders. Your name, delivery address, email address, what you ordered, the order's payment and shipping status, and — if you filled it in — your answer to “how did you find us”. Legal basis: performing the agreement, and legal (tax) obligations for the resulting invoices.

Updates by email (optional). If you tick the box for news and updates, we record your email address and the moment you consented. Legal basis: your consent, which you can withdraw at any time via the unsubscribe link or by emailing us.

Correspondence. Emails you send us, so we can answer and keep track of the conversation. Legal basis: legitimate interest (customer service).

Security. Failed sign-in attempts are counted to temporarily lock an account against password guessing. Legal basis: legitimate interest (keeping accounts safe).

We collect nothing else. No advertising profiles, no analytics trackers, and we never sell or rent personal data.

Payments are processed by Mollie B.V. (Amsterdam, the Netherlands). Your payment details — card numbers, bank account details — go directly to Mollie and never reach our systems; we only receive confirmation that a payment succeeded or failed. Mollie is independently responsible for the payment data it processes; see Mollie's privacy statement.

We use a small number of service providers to run the shop. They process data on our instructions and only what is needed:

• Vercel — hosts the website; our application and functions run in the European Union (Frankfurt).
• Neon — hosts our database, located in the European Union (Frankfurt).
• Google Workspace — our business email; order confirmations and account emails are sent through it.
• PostNL — receives your name and delivery address to deliver your parcel.
• Mollie — payment processing, as described above.

One note on images: card artwork in the singles search is loaded by your browser directly from the image servers of Scryfall, a card database. Like any server that serves an image to you, Scryfall sees your IP address for that request — nothing more is shared with them.

Your data is stored in the European Union. Some of our providers (such as Vercel and Google) are part of US companies; where any data could be transferred outside the EU, this is covered by EU-approved safeguards (the EU–US Data Privacy Framework and/or standard contractual clauses).

• Orders and invoices: 7 years, as required by Dutch tax law.
• Your account: until you ask us to delete it. On deletion we remove the account; order records tied to past purchases remain for the tax retention period above.
• Email updates list: until you unsubscribe.
• Verification and reset tokens: at most 24 hours, single use.
• Correspondence: as long as needed to handle and follow up on it.

We use one functional cookie: a signed session cookie that keeps you logged in after you sign in to your account. It lives for 30 days, is not readable by scripts and is used for nothing except recognising your session. Functional cookies like this do not require a consent banner — which is why you have not seen one.

Your shopping crate is stored in your own browser (local storage) and only reaches us when you check out. We use no analytics cookies, no advertising cookies and no third-party tracking of any kind.

All traffic to the site is encrypted (HTTPS). Passwords are stored only as salted cryptographic hashes. Email verification and password-reset links are single-use and time-limited, and repeated failed sign-ins temporarily lock the account. Access to our systems is limited to the owner.

Under the GDPR (AVG) you can at any time ask us to:

• see the personal data we hold about you (access);
• correct it (rectification);
• delete it, where no legal duty requires us to keep it (erasure);
• hand it over in a portable format (data portability);
• restrict or object to how we use it;
• withdraw consent you gave earlier (for example for email updates).

Email orders@theguildmaster.eu and we will respond within one month. If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

The shop is not directed at children. If you are under 16, ask a parent or guardian to place the order or to consent to your account.

If how we handle data changes — a new tool, a new feature — we update this page and the date below. Significant changes that affect you will be pointed out on the site.