Privacy Policy

Last updated: 29 May 2026

Template notice: This is a placeholder Privacy Policy provided as a starting template. It is not legal advice. Replace the bracketed placeholders below and have a qualified professional review it before relying on it for your business.

1. Who we are

ShinyGrails.com ("we", "us", "our") operates the website at atlasgrails.com (the "Site"), an independent Pokémon TCG collection and marketplace. For any privacy-related questions, contact us at marcusmimms@me.com.

Data controller: [Your registered name / business name], [Address], United Kingdom.

2. What information we collect

Contact information — such as your name and email address, if you contact us directly.
Technical data — such as IP address, browser type, device information, and pages viewed.
Usage data — how you interact with the Site, collected via cookies and similar technologies.
Preferences — such as your light/dark theme choice, stored locally in your browser.

3. How we use your information

To operate, maintain, and improve the Site.
To respond to your enquiries and provide customer support.
To understand how visitors use the Site (analytics).
To comply with legal obligations.

4. Legal bases for processing (UK GDPR)

We process personal data under one or more of the following legal bases:

Consent — where you have given clear consent (e.g. non-essential cookies).
Legitimate interests — to run and improve our Site, provided your rights do not override these.
Legal obligation — where we must process data to comply with the law.

5. Cookies

We use cookies and similar technologies. For full details, please see our Cookie Policy & GDPR page.

6. Sharing your information

We do not sell your personal data. We may share it with service providers who help us operate the Site (e.g. hosting and analytics providers), or where required by law. [List your processors here.]

7. Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy, or as required by law. [State your retention periods here.]

8. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request erasure of your data ("right to be forgotten").
Restrict or object to processing.
Data portability.
Withdraw consent at any time.
Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email marcusmimms@me.com.

9. Data security

We take reasonable technical and organisational measures to protect your personal data. However, no method of transmission over the internet is fully secure.

10. Children's privacy

The Site is not directed at children under 13, and we do not knowingly collect their personal data.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the latest revision.

12. Contact

Questions about this policy? Email marcusmimms@me.com.