Privacy policy

PRIVACY POLICY

Last updated: 25 September 2026

Collection Protection is a trading name of PokéProtection Ltd (“we”, “us”, “our”).

This Privacy Policy explains how we collect, use, store and share personal data when you visit our website, place an order, contact us, make a return, interact with our marketing, or otherwise use our services.

PokéProtection Ltd is the data controller for the personal data described in this policy.

We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (“EU GDPR”).

1. WHO WE ARE

PokéProtection Ltd trading as Collection Protection
44 Harpur Street
Bedford
MK40 2QT
United Kingdom

Email: luke@pokeprotection.co.uk

2. PERSONAL DATA WE COLLECT

The personal data we collect depends on how you interact with us.

2.1 INFORMATION YOU PROVIDE

When you place an order, contact us, submit a return or otherwise provide information to us, we may collect:

your full name
billing address
delivery address
email address
telephone number
order details
products purchased
order number
delivery information
returns and refund information
correspondence with us
information you submit through forms or customer-support enquiries
marketing preferences

Payment information is processed through our payment and ecommerce providers. We do not ordinarily receive or store your full payment-card details.

2.2 INFORMATION COLLECTED AUTOMATICALLY

When you visit or use our website, we and our service providers may collect information such as:

IP address
browser type and version
device type
operating system
pages viewed
products viewed
searches performed
items added to your basket
interactions with our website
date and time of visits
referring website or source
cookie and advertising identifiers
approximate location derived from technical information
information relating to website security, fraud prevention and errors

Some of this information is collected using cookies and similar technologies.

2.3 MARKETING AND ADVERTISING DATA

If you subscribe to marketing or interact with our advertising, we may process information including:

your email address
marketing preferences
whether you opened or interacted with marketing communications
website and shopping activity
advertising identifiers
interactions with advertisements
information used to measure advertising performance or create advertising audiences

Where required, advertising and analytics technologies are only activated after you have provided the necessary consent.

3. HOW WE COLLECT PERSONAL DATA

We may obtain personal data:

directly from you
automatically when you use our website
through Shopify and services connected to our Shopify store
from payment providers
from returns-management providers
from delivery and logistics providers
from analytics and advertising platforms
from customer-service and communications providers
from publicly available or legally permitted sources where appropriate

4. HOW AND WHY WE USE PERSONAL DATA

We use personal data only where we have a lawful basis for doing so.

PROCESSING AND FULFILLING ORDERS

We use your personal data to:

process purchases
take and confirm payment
prepare and fulfil orders
arrange delivery
communicate about your order

Lawful basis: performance of a contract.

RETURNS, REFUNDS AND CUSTOMER SERVICE

We use personal data to:

manage returns
process refunds
investigate delivery or product issues
respond to questions
provide customer support

Lawful basis: performance of a contract and our legitimate interests in providing effective customer service and administering our business.

LEGAL, TAX AND ACCOUNTING OBLIGATIONS

We may process and retain information to:

maintain accounting records
comply with VAT and tax requirements
comply with import/export requirements, including EU arrangements where applicable
respond to legal or regulatory requests

Lawful basis: legal obligation.

FRAUD PREVENTION, SECURITY AND BUSINESS PROTECTION

We may process information to:

prevent and detect fraud
protect customers and our business
maintain website and payment security
investigate suspected misuse
establish, exercise or defend legal claims

Lawful basis: legitimate interests and, where applicable, legal obligation.

Our legitimate interests include protecting our business, customers, systems and legal rights.

WEBSITE OPERATION AND IMPROVEMENT

We may use information to:

operate and maintain our website
understand how customers use it
diagnose technical problems
improve navigation, products and services
measure website performance

For strictly necessary processing, our lawful basis may be performance of a contract or legitimate interests.

For non-essential analytics technologies, we rely on consent where required.

MARKETING

We may send you marketing communications where:

you have given consent; or
applicable electronic-marketing law permits us to contact existing customers about similar products and services.

UK rules provide a limited existing-customer “soft opt-in” in defined circumstances; it is not a blanket permission to market to anyone.

You can unsubscribe from marketing at any time.

5. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies for purposes including:

keeping the website functioning
remembering basket and session information
security and fraud prevention
remembering preferences
measuring website use
analytics
measuring advertising
personalised advertising where permitted

Some cookies are necessary for the website to operate and do not require consent where the applicable exemption applies.

We will not place or use non-essential analytics or advertising cookies before obtaining consent where consent is legally required.

The ICO states that users must be told what cookies do and, for non-exempt cookies, provide consent through a clear positive action rather than merely continuing to browse.

You can manage your choices through the cookie/privacy controls provided on our website. You can also withdraw or change previously given consent.

6. WHO WE SHARE PERSONAL DATA WITH

We only share personal data where reasonably necessary for the purposes described in this policy.

SHOPIFY

Our store is hosted on Shopify.

For core services where Shopify processes customer personal data on our behalf, we generally act as controller and Shopify acts as processor. Certain Shopify consumer services may involve Shopify processing information under its own privacy terms.

PAYMENT PROVIDERS

Payment providers process information required to authorise and administer payments, refunds and fraud-prevention checks.

SHIPPING AND LOGISTICS PROVIDERS

We share information such as your name, delivery address, contact details and relevant order information with the shipping, postal, courier and logistics providers required to deliver your order.

We may use different delivery providers depending on the destination, service selected and operational requirements.

RETURNS MANAGEMENT

We use AtLast to support our returns process.

Information required to identify your order, administer a return, arrange return delivery and process the return may be shared with the returns platform and relevant delivery providers.

EMAIL, COMMUNICATIONS AND IT PROVIDERS

We may use providers that support:

transactional emails
marketing communications
customer service
website functionality
hosting
data storage
technical support

They may process personal data where necessary to provide those services.

ANALYTICS AND ADVERTISING PARTNERS

We use services provided by companies including:

Google, including Google Analytics and Google Ads
Meta, including Facebook and Instagram advertising services
TikTok

These services may receive information through cookies, pixels, APIs and similar technologies where permitted by your privacy choices.

Depending on the particular service and processing activity, these organisations may act as processors, joint controllers or independent controllers for certain processing.

Where a third party determines its own purposes for processing personal data, its own privacy notice will also apply.

PROFESSIONAL AND REGULATORY RECIPIENTS

We may disclose information where reasonably necessary to:

accountants
legal advisers
tax advisers
insurers
regulators
courts
law-enforcement authorities
government or tax authorities

We may also disclose information where required by law or where necessary to establish, exercise or defend legal rights.

7. INTERNATIONAL DATA TRANSFERS

Some of the organisations that process personal data for us operate outside the United Kingdom or European Economic Area, including in the United States.

Where personal data is transferred internationally, we take steps to ensure that an appropriate legal transfer mechanism applies.

Depending on the circumstances, these safeguards may include:

UK adequacy regulations
EU adequacy decisions
the UK International Data Transfer Agreement
the UK Addendum to the EU Standard Contractual Clauses
EU Standard Contractual Clauses
another legally permitted safeguard

The ICO confirms that the UK IDTA and UK Addendum are recognised safeguards for restricted transfers where adequacy does not apply.

You can contact us if you would like further information about the safeguards used for a particular international transfer.

8. HOW LONG WE KEEP PERSONAL DATA

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, tax and regulatory requirements.

Our usual retention approach includes:

Order, transaction and financial records: typically retained for up to 6 years where required or appropriate for accounting, tax, contractual or legal purposes.

Returns and customer-service records: generally retained for up to 24 months after the matter has been resolved, unless the information needs to be retained for longer because it forms part of an order record, dispute or legal obligation.

Marketing information: retained while you remain subscribed or while it remains necessary for the relevant marketing purpose. We may retain limited suppression information after you unsubscribe so that we can honour your opt-out.

Analytics, advertising and cookie information: retained according to our configured retention periods, the relevant provider's systems, your privacy choices and applicable law.

We may retain information for longer where necessary to investigate a dispute, prevent fraud, establish legal rights or comply with a legal obligation.

Where information is no longer required, it is deleted or anonymised where appropriate.

The UK GDPR requires organisations to tell people their retention periods or, where a fixed period is not possible, the criteria used to determine them.

9. YOUR DATA-PROTECTION RIGHTS

Depending on your location and the circumstances of the processing, you may have rights including:

the right to access personal data we hold about you
the right to correct inaccurate or incomplete information
the right to request deletion of personal data
the right to restrict certain processing
the right to object to certain processing
the right to data portability
the right to withdraw consent where processing relies on consent

Some rights only apply in particular circumstances and may be subject to legal exemptions.

YOUR RIGHT TO OBJECT TO DIRECT MARKETING

You have the right to object to the use of your personal data for direct marketing at any time.

You can unsubscribe using the link provided in our marketing communications or contact us directly.

Where processing is based on consent, withdrawing consent does not affect the lawfulness of processing that occurred before it was withdrawn.

10. COMPLAINTS

If you have concerns about how we use your personal data, please contact us first so that we can investigate.

You also have the right to complain to a data-protection supervisory authority.

For customers in the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO).

EU residents may also have the right to complain to the data-protection authority in the EU Member State where they live, work or believe an infringement occurred. The ICO confirms that privacy notices should tell individuals about their right to complain to the relevant supervisory authority.

11. DATA SECURITY

We use appropriate technical and organisational measures designed to protect personal data against:

unauthorised access
accidental loss
destruction
alteration
disclosure
misuse

Measures may include:

encrypted website connections
secure payment processing
access controls
authentication controls
appropriate contractual arrangements with service providers
limiting access to information to those who require it

However, no internet transmission or storage system can be guaranteed to be completely secure.

12. THIRD-PARTY WEBSITES AND SERVICES

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices of websites or services that we do not control.

We recommend reviewing the relevant privacy information when leaving our website or using a third-party service.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

changes to our services
changes to the organisations we work with
changes to our use of personal data
legal or regulatory developments

The latest version will be published on this page with an updated revision date.

14. CONTACT US

For questions about this Privacy Policy, to exercise a data-protection right or to raise a privacy concern, contact: