Privacy Policy, Mad Comps

Mad Comps UK ("we", "us", "our") is the data controller for personal data collected through this website.

Contact: info@madcomps.com or contactus@madcomps.com (phone available on request). Office: Mad&Dad Solutions Ltd, Mad Comps UK, 14 Museum Place, Cardiff CF10 3BH. Company number: (not registered). ICO registration: (ICO registration pending).

• Identifying data: name, email, phone, address.
• Transactional data: orders, enquiries, bookings.
• Technical data: browser storage, IP address, device, browser.
• Your interests: the games, card types and play times you choose to save.
• Competition data: entry records, your answer to the skill question, prize delivery address (winners only).
• Guest checkout: if you buy tickets without an account, your name, email address, that you confirmed you are 18 or over and agreed to our terms (with the time), your tickets and payment, a scrambled form of your private ticket link, and, if you pay with PayPal, a scrambled form of your PayPal payer number. We never keep the link or the payer number itself. If we limit wrong answers to a competition's question, we keep a scrambled form of your email with the count, until the competition is drawn. To stop one person holding many tickets without paying, we also keep, for each try at buying as a guest, a scrambled form of your email address and of your internet connection (worked out from your IP address, which itself is not kept), and the scrambled connection with an unpaid reservation.
• PayPal payments: when you pay with PayPal, PayPal sends our booking system a payment notice. We keep the PayPal transaction number, the amount, the currency, the payment status and our reference with your tickets or membership payment. We do not keep your PayPal name, email address, postal address or PayPal payer number from it (only a scrambled form of the payer number).
• Ticket and payment emails: we email your ticket numbers (or confirm your trading access) to your email address once your payment is confirmed. The email is sent from our web host's mail server, and we keep a record that it was sent (the time and whether our mail server accepted it), not the email itself.
• Grading data: if you ask for a card to be graded, your request reference, the card and the listing it belongs to, a copy of what your listing showed when the card arrived, the terms you agreed to (and that you confirmed you are 18 or over when you asked), whether the card is in a grading company's case, with the company, the grade on the label and the certificate number you or we gave, the result of any case and label check, whether the card arrived without the case you described, with our note of what arrived and your confirmation that it was not in a case, any written request you type to have the card taken out of its case with the time you made it, the day we took it out and what your listing said before, the grade and subgrades we give, our notes, the guide price with its source, date and the price reference we used, any offer we make and your answer (including that you confirmed you are 18 or over and free to sell the card), and, if we buy the card, the amount, the payment reference and the date. We also keep a record of each step and who took it. While we hold your card or owe you a payment, we keep a copy of your name, delivery address, phone number and account email with the request, so we can finish even if your account details change.
• Facebook sign in: if you are a member and choose to connect Facebook, Facebook sends us your name, your email address and a Facebook account identifier so we can find your account. Facebook sign in is for members and never makes an account; every member account confirms it is 18 or over and agrees to our terms when it signs up, and we keep the time of that answer with your account. We do not receive your password, your friends list or your posts, and we never post to Facebook for you. Facebook's own privacy policy covers what Facebook records about your sign in.

We rely on one of the following lawful bases under UK GDPR Art. 6:

• Contract: to provide the services or goods you have ordered.
• Legitimate interest: to operate, secure and improve the website.
• Consent: for anything optional you choose to save, such as your interests.
• Legal obligation: to comply with HMRC, Companies House and other statutory requirements.

• Fulfilling your order or service.
• Replying to enquiries.
• Fraud prevention and security monitoring.
• Statutory record-keeping (HMRC requires invoice records for 6 years).
• Guest checkout: to reserve and issue your tickets, apply the 5 ticket limit, match your payment, refund you if needed, and contact you if you win. We rely on contract, legal obligation (payment records) and our legitimate interest in keeping the 5 ticket limit fair and stopping misuse.
• Winners: if you win as a guest, we publish your initials and home town or city on the winners page only with your consent, as for every winner, and we will ask you for your town by email.
• Service improvement (we do not use analytics).
• Grading and early offers: to check and grade the card you send us, to make and honour our offer, to arrange payment or the return of your card with you by email, and to show the grade on your open listing. If we buy your card, the bank details you send us by email are used only to pay you; we never keep bank details on this website, but they are kept in our email and payment records. Emails about a grading payment come only from the payment contact address shown with the grading terms. We rely on contract (you asked us to grade your card and may sell it to us), legal obligation (payment records) and our legitimate interest in keeping a record of what we checked and of your card while it is in our care.

We collect what you give us when you create an account, enter a competition, pay, list or sell cards, save shipping details, save your interests, add friends or socials, or email us.

We share personal data with the following only where necessary:

• Mad&Dad Solutions Ltd, which builds and maintains the website for us and receives bank transfers on our behalf.
• Fasthosts, which hosts the website and email.
• Supabase, which stores accounts and site data in Ireland.
• PayPal, which processes PayPal payments as its own data controller.
• Meta Platforms Ireland Limited (Facebook), only if you choose to sign in with Facebook, as its own data controller.
• Our accountant.
• Authorities responding to a lawful request.

We do not sell personal data. We have written processor agreements with each of our processors.

Grading: the grade we give (for example "Mad Comps UK grade 9"), the day we graded it and the day we returned the card are shown publicly on your listing while it is open. For a card checked in its case, only that its case and label were checked by Mad Comps UK, the day and the day we returned it are shown, never a grade. For a card taken out of its case at your written request, the day it was taken out and that its old grade is void are shown. Everything else about your grading request is seen only by you and by Mad Comps UK, and held for us by the service providers listed in this policy.

PayPal processes PayPal payments as its own data controller. Bank transfers are paid into the account of Mad&Dad Solutions Ltd, which receives them on our behalf. Supabase stores accounts and site data in Ireland. Fasthosts hosts the website and email.

Third-party lookups: when you search cards, the site asks public card indexes (TCGdex, the Pokemon TCG API at pokemontcg.io, Scryfall, YGOPRODeck, Digimon Card, Lorcast, Lorcana API, Grand Archive) and Frankfurter for currency rates, and your browser loads most card pictures from those services. Card lists for the other card games, built each night from TCGCSV’s copy of TCGplayer’s catalogue, and the pictures for Yu-Gi-Oh!, Digimon and those games come from our own Supabase store. When you search for venues, it asks Nominatim, Photon, postcodes.io and Overpass map servers in France and Germany. These services see your IP address and what you searched for. When a card picture is not stored on our Supabase picture store yet, our picture service there keeps a coded form of your IP address for a short time to stop overuse; the code cannot be turned back into your address.

Listing photos: when you list a baseball card, a Hot Wheels card or another collectible, the photo you add is resized in your browser, which removes the location data a phone camera adds, and stored in our Supabase photo store. Everyone can see it on your listing. When you remove the listing, the photo is removed with it. Photos of listings that were sold, closed or removed, photos never put on a listing, and your photos when your account is deleted are cleared from the store within two days.

We keep your account details while your account is open, and delete or anonymise them when you ask us to erase your account. Payment and ticket records are kept for 6 years, as HMRC requires. PayPal payment notices are kept with your payment record for 6 years.

If you buy tickets from us with cash, we record your name and your email or phone number with the sale, to apply the 5 ticket limit and to contact you if you win. We remove them when you ask us to delete your data, and in any case 6 years after the sale.

If you buy tickets as a guest, we keep your name and email address with your tickets so we can match your payment and contact you if you win. If the reservation ends without payment, we delete them 30 days after you reserved (longer only while a refund to you is still open). If you paid, we keep them for 6 years after the payment, as for other payment records, then delete them. We delete them sooner if you ask, but we then cannot contact you if you win. If you create an account with the same email address, paid guest tickets move to your account and are kept as account records. The scrambled forms kept for each try go after 2 hours, and the scrambled connection kept with a reservation goes within an hour of it being paid or ending.

Messages sent through the contact and data deletion forms, with a scrambled form of the sender's network address (used to stop repeated sending), are kept on our web server for up to 12 months to show we answered them, then deleted. A copy also arrives in our email inbox.

Grading records are deleted automatically: if we bought your card, 7 years after we paid you (6 years from the end of our financial year, as HMRC requires for payment records); if we held your card and then returned it, or it was lost or damaged in our care, 6 years after that (the time limit for most claims about it); if you cancelled before the card reached us, 12 months after you cancelled. The copy of your contact details is deleted as soon as we have paid you or returned your card. If you delete your account, the record stays for that time without the link to your account, and your account id is removed from our step-by-step record within a day. If you ask us to delete your data while we still hold your card or owe you a payment, we finish that first, then delete your data. If a buyer starts a card payment for a listing on Card Trading, we keep a note of the listing and the payment session for 30 days (2 years if the payment arrived but the sale could not be recorded), so a card a buyer has paid for is never also sold to us.

See the Data Deletion Policy for how to request earlier removal.

You have the right to:

• Access: a copy of the data we hold about you.
• Rectification: to correct inaccurate data.
• Erasure: to have your data deleted (subject to statutory exceptions).
• Restriction: to pause our processing while a dispute is resolved.
• Data portability: to receive your data in a machine-readable format.
• Objection: to object to processing on legitimate-interest grounds.
• Withdrawal of consent: at any time, without affecting prior processing.
• Automated decision-making: we do not currently make decisions about you using automated profiling.

Email info@madcomps.com with the subject "Privacy request, [type]". We respond within 30 days. There is no fee unless the request is manifestly unfounded or excessive.

We may need to verify your identity before we release data.

You have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or to:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113.

We host within the UK / EEA. Where a processor is based outside (e.g. a payment partner in the US), data is transferred under UK-approved Standard Contractual Clauses or an adequacy decision under UK GDPR Chapter V.

See our Cookie Policy for the full list of cookies we use.

We may update this policy. Material changes are notified by a banner on the homepage.

Data controller: Mad Comps UK. Email info@madcomps.com. Phone (phone available on request).

Last updated 11 October 2026.