Customer Privacy Policy

What this policy covers

This policy explains how Geekiam Collectables Ltd uses personal information when you shop with us, use our website or customer account features, join our loyalty or cashback programme, buy or use an eGift card, trade in items, book an event, reserve or pre-order products, ask for a receipt or refund, or contact us. It also explains your rights and how to contact us.

Geekiam Collectables Ltd is the controller for the customer information described in this policy. This means we decide why and how that information is used. Some providers, including Square, process information for us to deliver payment, customer-management and related services. They may also use limited information for their own purposes where their own privacy notices apply.

Information we may collect

The information we collect depends on how you deal with us. It may include:

• identity and contact details, such as your name, email address, telephone number, postal or delivery address and, where appropriate, a parent or guardian contact;
• purchase, order and transaction details, including items, amounts, dates, payment method, refunds, receipts and limited card information made available by our payment processor, such as card brand and the last four digits;
• Square Customer Directory information, including your contact details, visit and transaction history, loyalty activity, preferences and relevant customer-service notes;
• loyalty or cashback information, such as your mobile number, points, rewards, redemptions, linked transactions and account status;
• eGift card and trade-in store-credit information, such as recipient or holder details, gift-card code or identifier, balance, issue, load, redemption, refund and transfer history;
• pre-order, reservation and event details, including the product or event, payment or deposit status, collection arrangements and messages needed to manage the booking;
• trade-in or buy-in details, including the Buy-In ID, your name and contact details, collection type, items, quantities and condition, market or selling values, cash and trade-credit offers, your choice and final agreed amount, payment or credit reference, declarations, signatures, and staff processing or storage notes;
• website information, including enquiries, device or browser data, security logs and cookie preferences and, where customer accounts are available, account credentials in protected form, order history and delivery details;
• player identifiers for organised play, where you choose to provide them, together with the event or game system to which they relate;
• communications with us about purchases, bookings, pre-orders, reservations, events, trade-ins, complaints or data requests; and
• CCTV images and related time and location information where CCTV is in operation at the store. Signs at the premises will identify its use.

Please do not give us payment-card numbers, passwords, health information or other sensitive personal information in free-text notes, emails or forms unless we specifically ask for information that is necessary and explain why. We do not need these details for ordinary customer records.

How we collect information

We collect information directly from you and through the services you choose to use. For example, you may provide it at the till, on a paper valuation or accepted-deal form, through an online form or website account, by email or telephone, or on a Square screen used for a receipt or loyalty enrolment. We also receive transaction and service information from Square and website or account information processed through Supabase.

Square may recognise contact details that a customer previously gave to Square for buyer features such as automatic receipts. Where Square masks those details, Geekiam cannot see the full address or number unless you give it directly to us.

Why we use information and our lawful bases

UK data protection law requires us to identify a lawful basis for each use. More than one basis may apply to the same record for different purposes.

Operational messages and marketing

We may contact you when needed to complete or manage a purchase, refund, booking, pre-order, reservation, event entry, trade-in, loyalty account or eGift card. These are service messages, not permission to send unrelated marketing.

We only use contact details for marketing where we have a valid route under UK data protection law and the Privacy and Electronic Communications Regulations. This will usually be your clear consent. In limited circumstances, we may use the existing-customer exception for our own similar products or services if the legal conditions are met and we offered an opt-out when collecting the details and in every message. We do not add operational contact details to unrelated marketing lists merely because you gave them for a receipt, booking or transaction.

You can change your choice at any time by using the unsubscribe or preference link in a message, changing available Square preferences, or contacting us. We keep enough information to respect an opt-out. Withdrawing consent does not affect earlier lawful use.

Online event bookings and organised play

When you book through our website, register for an online event or enter organised play, we may collect your name, contact and booking-account details, event and payment status, and any player ID, game account name or division needed for entry. We use these details to confirm bookings and payments, manage capacity, waiting lists and attendance, send essential updates, administer results or prizes where relevant, and answer questions. If a publisher, organiser or organised-play platform helps run the event, we share only the entry information reasonably needed and explain the sharing where appropriate. Event contact details are not automatically marketing consent. If you book for someone else, you should have permission to provide their details and make this policy available to them. Junior event bookings should be made by a parent or guardian, who provides their own contact details.

How we use Square

We use Square for services that may include point-of-sale payment processing, receipts, transaction history, refunds, reporting, Customer Directory, Loyalty, eGift cards and related customer-service functions. Square receives and processes the information needed to provide those services. Payment-card details are entered into Square systems and hardware; Geekiam staff must not write down or manually store full card details.

For much of this activity, Square describes itself as obtaining customer information on a seller's behalf as a service provider or payment processor. For some Square buyer features, such as a Square profile, Square Pay or a personalised customer account, Square may act separately under its own buyer privacy notice. Square may also use seller or business and transaction information to provide seller services, make eligibility assessments or offer financial products under Square's own terms and privacy notice.

Square's privacy information is available at squareup.com/gb/en/legal/general/privacy and its buyer-features privacy notice.

Who we may share information with

We share only what is reasonably needed with:

• Square and other payment, eGift-card, loyalty, website, account, hosting, database, communications or IT providers that support the services you use;
• Supabase, where used to provide database and account functions for the Geekiam website;
• Vercel, which hosts our website and provides anonymous visitor statistics;
• Resend, which sends booking confirmations and event updates and delivers messages sent through our contact form;
• our website developer, who maintains the website and its database on our behalf;
• delivery or collection providers where needed to fulfil an order;
• accountants, insurers, banks and professional advisers where necessary for business, accounting, insurance or legal purposes;
• event organisers, publishers or organised-play platforms where you ask us to submit an entry or player identifier and we explain the sharing;
• law-enforcement bodies, regulators, courts, tax authorities or other public bodies where disclosure is required or lawfully necessary; and
• a purchaser, investor or adviser if our business or assets are reorganised or sold, subject to appropriate confidentiality and legal safeguards.

We do not sell customer personal information.

International transfers

Some service providers or their group companies may process information outside the UK. Where UK data protection law requires a transfer safeguard, we expect the relevant provider to use an approved mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful safeguard. You may contact us for more information about the safeguards relevant to your information.

Data minimisation and security

We aim to collect only the information needed for the stated purpose. Access is limited according to staff roles and business need. We use account permissions, passwords and other appropriate technical, organisational and physical controls; keep paper forms away from public view; and review access when roles change. Square states that customer information submitted to its servers is encrypted and that its payment services follow applicable PCI standards. No system is completely secure, but we take proportionate steps to reduce risk.

How long we keep information

We keep personal information only for as long as necessary for the purpose it was collected, including legal, accounting, fraud-prevention and dispute-handling requirements. The period depends on the record and what happened. We consider whether an order, booking, loyalty account, eGift card or store-credit balance remains active; whether a refund, chargeback, warranty, complaint or legal claim could arise; and whether tax, company or other law requires a record.

We review information and delete, securely destroy or anonymise it when it is no longer needed. We may retain a minimal suppression record so that we do not contact someone who has opted out of marketing. Square and other providers may retain information under their own legal and operational obligations.

Your data protection rights

Depending on the circumstances, you may have the right to:

• be informed about how we use your information and obtain access to it;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information or restrict how we use it in certain circumstances;
• receive certain information in a portable format where the right applies;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time where we rely on consent; and
• challenge a qualifying decision made solely by automated means. Geekiam does not currently make decisions about customers solely by automated means that produce legal or similarly significant effects.

These rights are not absolute and may depend on our lawful basis and legal duties. We may ask for enough information to confirm your identity and understand the request. We normally respond without undue delay and within the period required by law. We do not usually charge a fee.

Contact us or make a complaint

Contact Geekiam first if you have a question, wish to exercise a right or believe we have handled your information incorrectly:

• Email: contactus@geekiamcollectables.co.uk
• Post: Geekiam Collectables Ltd, 28 Harraton Terrace, Birtley, Gateshead, DH3 2QG
• Telephone: 0191 925 0436

If you remain dissatisfied, you may complain to the Information Commissioner's Office, the UK data protection regulator. The ICO recommends giving the organisation an opportunity to resolve the matter first.

ICO: ico.org.uk/make-a-complaint | 0303 123 1113 | Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Cookies

Our website uses cookies and similar technologies. Our Cookie Policy explains what we use, why, and how you can manage your choices.

Changes to this policy

We may update this policy when our services, suppliers or legal obligations change. The current version will be available on our website and will show its effective date. If a change materially affects how we use information already collected, we will take appropriate steps to tell affected customers.