Privacy policy

Privacy Policy

Last Updated: January 28, 2026

At Untapped Potential TCG (untappedpotentialtcg.co.za), we value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, share, and protect your information when you visit our website, purchase trading card game products (e.g., Magic: The Gathering, Pokémon), or use our services. By using our website, you agree to this Privacy Policy.

1. Information We Collect

We may collect the following types of information:

Personal Information (when you place an order, create an account, or contact us):

  • Name

  • Email address

  • Shipping address

  • Billing address

  • Phone number

  • Payment details (processed securely via Shopify and third-party payment providers such as Stitch Express for card payments, and EFT where selected)

  • Courier preference (e.g., PostNet branch or door-to-door delivery)

Important note about payment data: We do not store your full card details on our systems. Card payments are processed securely by Stitch Express (and/or Shopify’s integrated payment flow), and we may only receive limited transaction information such as payment confirmation, last four digits, authorization references, and payment status.

Non-Personal Information (to improve site performance):

  • IP address

  • Browser type and device information

  • Pages visited, items added to cart, and time spent on our site

Cookies & Tracking: We use cookies to enhance your shopping experience, track usage, and show relevant products. You can manage or disable cookies in your browser settings.

2. How We Use Your Information

We use your information to:

  • Process and fulfill your orders (e.g., shipping TCG products via PostNet).

  • Communicate with you about orders, returns, payment confirmations, or inquiries (via untappedpotentialtcg@gmail.com).

  • Improve our website and services (e.g., analyzing popular TCG products).

  • Send promotional emails about new releases or events (only if you opt in).

  • Comply with legal requirements under South African law, including the Protection of Personal Information Act (POPIA).

3. How We Share Your Information

We only share your information when necessary:

Service Providers: With trusted third parties such as:

  • Shopify Inc. (our e-commerce platform)

  • Payment processors (including Stitch Express for card payments and EFT processing where selected)

  • Couriers (PostNet) to deliver your orders

Legal Compliance: If required by South African law or to protect our rights (e.g., in cases of fraud, chargebacks, or disputes).

Business Transfers: If Untapped Potential is sold or merged, your information may be transferred to the new owner, but you will be notified.

We do not sell or rent your personal information to third parties for marketing purposes.

4. Your Rights Under POPIA

You have the right to:

  • Access the personal information we hold about you.

  • Correct inaccurate or outdated information.

  • Request deletion of your personal information (unless required for legal/tax purposes).

  • Limit or object to how we process your information.

  • Opt out of marketing emails at any time (via the “unsubscribe” link or by contacting us).

To exercise these rights, email us at untappedpotentialtcg@gmail.com.

5. Data Security

We take reasonable steps to protect your information, including:

  • Encrypting payment details during checkout.

  • Using Shopify’s secure platform for storage and processing.

  • Using trusted payment gateways such as Stitch Express for secure card payment processing.

  • Limiting staff access to personal data.

No online system is 100% secure. By using our services, you share information at your own risk.

6. Data Retention

We retain your information only as long as necessary to:

  • Fulfill your orders (until PostNet delivery is completed).

  • Comply with legal or tax requirements (e.g., 5 years for financial records).

  • Support customer service and returns (e.g., 7-day return window).

After this, data is securely deleted or anonymized where possible.

7. Third-Party Links and Tools

Our website may contain links to third-party sites (e.g., Wizards of the Coast, The Pokémon Company) or use integrations (e.g., courier tools and payment gateways). These third parties have their own privacy policies, and we are not responsible for their practices. Please review their policies before sharing information.

8. Cookies and Tracking

We use cookies to:

  • Remember cart items and preferences.

  • Analyze traffic and improve site performance.

  • Provide relevant promotions (if you opt in).

You may disable cookies in your browser, but this could affect website functionality.

9. International Data Transfers

As our store is hosted on Shopify’s global servers, your data may be transferred outside South Africa. Shopify complies with international data protection standards.

10. Changes to This Privacy Policy

We may update this Privacy Policy by posting changes here. Continued use of our website after changes means you accept the updated terms.

11. Contact Us

For questions about this Privacy Policy, your personal information, or to exercise your POPIA rights, contact us at:

📧 untappedpotentialtcg@gmail.com