Privacy policy

Privacy Notice – Vaulten TCG
Updated: 20 October 2026.

This notice explains how we process the personal data of Vaulten TCG visitors, subscribers, enquirers and customers. The store is preparing to open and does not currently accept orders. Browsing, enquiries, customer accounts and subscriptions may involve processing during this period. Processing for orders, shipping and invoicing becomes applicable when actual sales begin.

1. Who controls the data?

Controller: EMARKO WOOD Kft.
Registered office: 1213 Budapest, Daru út 4., Hungary.
Company registration number: 01-09-979821.
Hungarian tax number: 23823716-2-43; EU VAT number: HU23823716.
Website: vaultentcg.com
Privacy and customer service: info@vaultentcg.com
Telephone: +36 30 480 0210
Postal address: 3060 Pásztó, Gépállomás lakótelep 1., Hungary.

We act in accordance with the GDPR, Regulation (EU) 2016/679, and applicable Hungarian legislation. Reading this notice or simply using the website does not constitute marketing consent.

2. Purposes, data and retention periods

Website operation and security

Serving the website, operating the basket and sign-in, retaining language and consent choices, and detecting misuse may generate IP addresses, device and browser information, access times, technical identifiers, session information and details of the requested page. Necessary technical processing is based on our legitimate interest in providing a secure, functioning website, Article 6(1)(f) GDPR. Article 6(1)(b) may also apply to specifically requested basket and account functions.

We retain session data for the relevant session and preferences for their period of validity. Retention of providers' technical logs and cookies depends on their purpose, lifespan and any need to investigate security incidents. The Shopify Cookie Policy explains the purposes and expiry of cookies Shopify may use; not every cookie listed there necessarily operates in this store.

Enquiries and customer service

We use your name, email address, telephone number, message and any information you attach to answer your enquiry. For questions preceding a contract or relating to a purchase, the legal basis is Article 6(1)(b) GDPR; for other enquiries it is our legitimate interest in providing a substantive response, Article 6(1)(f). We retain purely informational correspondence until the matter is closed and for up to six months afterwards, unless a legal claim or legislation justifies a different period.

Customer accounts and Google sign-in

We process your email address and contact details entered in the account to identify your Shopify customer account; subsequent orders may be linked to it. The legal basis is performance of the requested account service, Article 6(1)(b) GDPR. We process account data while the account exists; you may request closure by email. Closing an account does not automatically erase invoice or order data that must be retained on another legal basis.

If you choose Google sign-in, authentication takes place through Google and Shopify. Information shown by Google on the authorisation screen, particularly your email address and authentication identifier, may be shared to identify your account. We do not request or receive your Google password. Google's own processing is covered by its Privacy Policy.

Newsletter and opening notifications

If you subscribe voluntarily, we may send updates about the opening of Vaulten TCG, products and offers to the email address you provide. We process that address, consent status, the time and source needed to demonstrate consent, and the fact of unsubscribing. The legal basis is consent under Article 6(1)(a) GDPR, taking account of advertising legislation.

You may withdraw consent at any time, free of charge, using the unsubscribe link in the email or by writing to info@vaultentcg.com. Withdrawal does not affect the lawfulness of prior processing. We use data for marketing until consent is withdrawn or the purpose ceases. We may separately retain minimal evidence of consent and withdrawal for as long as necessary to deal with potential legal claims; we do not send advertising to unsubscribed addresses. Subscribing is not a condition of purchasing.

Orders and delivery – after sales open

The customer's name, email address, telephone number, billing and delivery addresses, selected collection point, products ordered, prices, order identifiers and status are needed to prepare and perform the contract. Legal basis: Article 6(1)(b) GDPR. Without the necessary data, the order or delivery cannot be completed.

We process fulfilment data until the order is settled. We then retain data needed to establish or defend contractual claims, generally until the end of the five-year general limitation period, on the basis of legitimate interests under Article 6(1)(f) GDPR. Pending disputes or suspension or interruption of limitation may justify a different period. Accounting documents are subject to the separate period below.

Payments and refunds

The payment provider processes the data needed for online card payments. The Seller receives the transaction identifier, amount, currency, status and limited payment-method information; it does not request a full card number or security code by email. For cash on delivery, the carrier receives the order and amount information needed for collection. If we agree on a bank-transfer refund, we may request the account holder's name and bank account number.

The legal bases are contractual performance and the obligation to refund, Article 6(1)(b) and, where applicable, (c) GDPR. Retention follows that of the related contract or accounting document.

Invoicing and accounting

We process the billing name and address, tax number where needed, purchase items, amount and accounting-document information to comply with a legal obligation under Article 6(1)(c) GDPR. Section 169 of Hungarian Act C of 2000 on Accounting requires accounting documents to be retained for at least eight years. The right to erasure does not override this obligation.

Complaints, withdrawal and conformity claims

We process the complainant's name and contact details, order information, the content of the claim and response, and necessary evidence to resolve the matter. Legal bases: Article 6(1)(b) GDPR and (c) for statutory obligations. Under Section 17/A of Hungarian Act CLV of 1997, we retain consumer complaints, records and a copy of the substantive response for three years. Other documents relating to withdrawal, conformity and legal claims are retained in accordance with specific obligations and the period necessary to pursue claims.

3. Who can access the data?

The Seller's authorised staff and service providers involved in delivering the service may access data to the extent required for their tasks. Data may be disclosed to authorities, courts or Hungary's National Tax and Customs Administration where required by law. A provider's role as processor or independent controller depends on the activity.

• Shopify International Limited – The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland. Online store, hosting, customer accounts, ordering and message/subscription management through Shopify Messaging. It generally acts as a processor for store operation and may act as an independent controller for its own consumer and network services. Consumer Privacy Policy; Data Processing Addendum.
• Shopify Payments and associated payment partners – card payments, transaction checks and refunds. Checkout and provider notices identify the actual payment solution used. Providers may be independent controllers for their own legal and fraud-prevention obligations. Shopify privacy information.
• PickupBird by Digiloop – webwise Hungary Kft. – 4032 Debrecen, Füredi út 98., Hungary. The installed app may process customer contact, address, selected collection-point and order data within its permissions for collection-point selection and shipping integration. Carrier label creation is still being prepared. Provider's notice.
• Billingo Technologies Zrt. – 1133 Budapest, Árbóc utca 6., 1st floor, Hungary. The installed invoicing app and planned integration use billing and order data. Automatic invoicing is still being configured; installation does not mean invoices are already being issued. Billingo privacy notice.
• Google services – emails sent to our Gmail address and Google authentication selected by you also involve Google's infrastructure. The EEA consumer-service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Privacy Policy.
• Carriers – after shipping begins: the selected carrier or collection-point provider receives the name, address or collection point, telephone number, email address, parcel identifier and any cash-on-delivery amount needed for delivery. Specific carrier arrangements are still being finalised; before launch, we will add the actual providers' details to this notice.

We provide links to our Facebook, Instagram and TikTok pages. When you open an external page, that platform processes data under its own rules. If you message us there, the chosen platform also processes the communication. Before introducing social advertising tracking or a new data connection, we will update the information and, where necessary, consent management.

4. Shopify Network Intelligence and international transfers

Shopify Network Intelligence is enabled for this store. Shopify may use data from interactions with the store, other merchants and its own services for security, development, personalisation and, with appropriate consent, advertising. Shopify is responsible for processing for its own purposes. We request consent for non-essential tracking for these purposes; you may subsequently withdraw it.

Shopify and other international providers may transfer data outside the European Economic Area, for example to Canada or the United States. Appropriate safeguards must be in place, such as an adequacy decision, binding corporate rules or standard contractual clauses. Shopify describes its current mechanisms in its Data Processing Addendum; you may also ask us for information about safeguards.

You may also exercise consent-withdrawal, objection and other rights concerning Shopify's own processing through the Shopify Privacy Portal.

5. Cookies and consent

Strictly necessary cookies support the website, basket, security and functions you request. Non-essential analytics, personalisation and marketing cookies require prior consent under Article 6(1)(a) GDPR. Rejecting optional tracking does not remove your ability to purchase.

You can set your choices in the cookie banner and later change them using the privacy/cookie-settings link in the footer. You may also delete or block cookies in your browser, although blocking necessary cookies can prevent certain functions from working. Withdrawing consent does not affect the lawfulness of earlier processing.

6. Your rights

Subject to statutory conditions, you may request information, access, a copy, rectification, erasure and restriction of processing. For automated processing based on consent or contract, you may also request data portability. You may object to processing based on legitimate interests on grounds relating to your situation and to direct marketing at any time. Consent may be withdrawn at any time.

Send requests to info@vaultentcg.com. We may verify your identity to the extent necessary; please do not send a complete identity document without prior agreement. We generally respond within one month. For complex or numerous requests, this may be extended by two further months; we will explain the reason within the first month. We explain any refusal and available remedies.

The right to erasure is not absolute: necessary data may be retained for statutory retention obligations or establishing, exercising or defending legal claims. Erasing marketing data and closing an account may be handled separately.

7. Security, children and automation

We protect data using appropriate access permissions and providers' security functions. Please do not send passwords, card security codes or unnecessarily sensitive data in customer-service messages. Providers may use automated security and fraud-prevention checks. If an automated flag adversely affects your order, you may request human review and an explanation from us.

Persons under 16 may subscribe to the newsletter only with appropriate consent from their legal representative. Purchases by minors are subject to the rules on legal capacity. Please tell us if you become aware of children's data provided without authorisation.

8. Complaints and remedies

You may contact us directly about processing, but this is not a prerequisite for seeking administrative or judicial remedies.

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary.
Postal address: 1363 Budapest, Pf. 9., Hungary.
Telephone: +36 1 391 1400.
Customer-service email: ugyfelszolgalat@naih.hu.
Contact and administrative information · Online proceedings

To initiate proceedings, use the official channel specified by NAIH; the customer-service email alone is not suitable for initiating every type of procedure. You may also seek judicial remedies, including before the regional court for your place of residence or habitual stay where provided by law.

9. Updates to this notice

We update this page when operations, providers or legislation change. Simply amending the notice is not sufficient for processing for a new purpose: we provide prior information and an appropriate legal basis, and obtain new consent where necessary. The version date appears at the beginning.