PokeMarket
PokeMarket is responsible for personal information submitted through this website, such as contact form enquiries and admin login records. For privacy questions, use the contact page and select Website issue or Other.
Contact PokeMarket
Privacy policy
Your data should be handled as carefully as your collection.
This policy explains what personal information PokeMarket may collect, why it is used, how long it is kept and the rights available to users under UK data protection law.
UK GDPR and DPA 2018
This policy is written for UK users and follows the transparency principles in the UK General Data Protection Regulation and Data Protection Act 2018. The ICO explains that people have the right to be informed about how their personal data is collected and used.
ICO right to be informedNo public accounts yet
PokeMarket may collect guest checkout details for store orders, but public customer accounts are not active yet. Private inventory, suppliers, grading and stream tools are restricted to admin users.
Personal data, purpose and lawful basis
Contact form messagesName, email, message, category and optional card/set/product details. Used to respond to your enquiry. Lawful basis: legitimate interests, or consent where you choose to send optional information.
Store checkout detailsName, email, shipping address, basket items and order records. Used to process orders, handle support and keep business records. Lawful basis: contract and legitimate interests.
Stripe payment processingCard payment details are handled by Stripe Checkout. PokeMarket receives payment status, checkout session identifiers and payment intent references, not raw card numbers.
First-party site analyticsAnonymous page, search, product, set, card and checkout-start events may be recorded to understand what visitors use and what stock people are interested in. PokeMarket stores hashed technical identifiers rather than plain IP addresses for these analytics. Lawful basis: legitimate interests.
Technical server logsIP address, browser details, requested page, time and basic security events. Used for security, troubleshooting and service reliability. Lawful basis: legitimate interests.
Admin login/session dataAdmin email, password hash, role and session information. Used to protect private owner tools. Lawful basis: contract/legitimate interests depending on the admin relationship.
Browser local storageSome watchlist or stream-prep convenience data may be stored in the admin user browser. This remains on that device unless exported or cleared by the user.
Retention
Data is kept only for as long as needed.
Contact messages should be retained only while needed to respond, investigate a report or maintain a reasonable business record. Technical logs are normally short-term operational records unless needed for security investigation. Admin records remain while the admin account or owner tools are active.
Contact messages: kept only as needed for support.
Security logs: used for troubleshooting and protection.
Admin records: private and not shown to public users.
Limited service providers
PokeMarket may use hosting, email and infrastructure providers to run the site. Card and set API providers receive server-side API requests for card data, not public contact-form messages.
Essential and first-party analytics
Admin login uses a session cookie to keep private tools secure. Public analytics may use a first-party visitor cookie to count anonymous visits and improve stock/search decisions. PokeMarket does not currently run public advertising cookies.
Protected admin tools
Private tools are behind admin login, sensitive actions use CSRF protection, and API keys are read server-side rather than exposed to browser JavaScript.
UK data protection rights
Depending on the situation, you may have rights to access, correct, erase, restrict, object to or receive a copy of your personal information. You can also complain to the Information Commissioner's Office if you are unhappy with how your data is handled.
Policy updates
This policy should be reviewed when PokeMarket adds public accounts, newsletters or any other feature that changes how personal information is used. Last updated: July 2026.