Privacy Policy
I do not sell your personal data. I collect what I need to take payment, make and post your order, and answer your emails — nothing more.
Yiverse Limited, CR No. [XXXXXXX], [Address], Hong Kong SAR, is the data controller. To exercise any privacy right, email privacy@baldursgate3-merch.com.
What I collect
- Name, email, shipping and billing address, and phone number where a courier needs one
- Your order history and any messages you send me
- Account details, if you create an account (passwords are stored hashed)
- IP address, browser and device type, and pages viewed
Card details are collected and processed directly by the payment provider. I never receive or store your full card number — only a confirmation of payment and the last four digits.
Why I use it
- To take payment, make your order and get it delivered — this is how I perform our contract
- To make customs declarations and pay duty on your behalf — a legal obligation
- To answer your emails
- To prevent fraud and keep the site secure
- To keep tax and accounting records
- Analytics and marketing emails — only with your consent, which you can withdraw at any time
Who sees it
Very few people, because there is no team and no factory in the middle:
- Me — I read your emails and write your address on the parcel myself
- My store platform and payment providers
- My shipping partner and the couriers who carry your parcel, including customs declarations
- My email and analytics providers
I may also disclose data if the law requires it. I never sell it.
Sending data outside the EU and UK
I am based in Hong Kong and post from China, so if you are in the EU or UK, your name and address travel with your parcel.
Neither Hong Kong nor mainland China has an EU or UK adequacy decision. To make these transfers lawfully I rely on the Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum, alongside encryption and strict access controls. Couriers receive only what they need to deliver your parcel — never your payment details or order history.
How long I keep it
- Order records: [7] years, for tax and accounting
- Account data: until you delete your account
- Marketing contacts: until you unsubscribe
- Analytics: [14] months
Cookies
Essential cookies run the cart and checkout and cannot be switched off. Analytics and marketing cookies are set only if you consent, and you can change your mind at any time through the cookie banner. You can also block cookies in your browser, though parts of the site may stop working.
Your rights
If you are in the EU or UK you can ask me to give you a copy of your data, correct it, delete it, restrict how it is used, or send it to another provider. You can withdraw consent or unsubscribe from marketing at any time.
Email privacy@baldursgate3-merch.com and I will respond within one month. If you are unhappy with how I handle it, you can complain to your data protection authority — the ICO in the UK, or your national authority in the EU.
California residents
You have the right to know what I collect, to have it deleted or corrected, and to opt out of the sale or sharing of personal information. I do not sell or share your personal information, and I will never treat you differently for exercising a privacy right.
Security
The site runs on HTTPS and the payment processors are PCI-DSS compliant, so card numbers never touch my systems. No system is perfectly secure, but if a breach affects you I will tell you and the regulator as the law requires.
Children
This shop is not intended for children under 16, and I do not knowingly collect their data.
Changes
I may update this policy. The date at the top of the page always shows the current version.