Privacy Policy

As of November 2026. This is a translation for your convenience; only the German version is legally binding.

We process personal data only as far as the shop, your order and our legal obligations require. Here you can read which data that is, what we use it for and which rights you have.

1. Controller

Antalyse GmbH, Wienerstraße 1, 2440 Moosbrunn, Austria, e-mail: bestellung@pokemonkarten.at. We have not appointed a data protection officer because we are not required to; please send any questions to the e-mail address above.

2. Visiting the shop

• No access logs, no tracking. We do not store IP addresses when you visit the pages and we use no analytics, advertising or tracking tools.
• Everything from our server. Fonts and card pictures are delivered by our own server; your browser does not connect to third parties for them. We fetch the card pictures from TCGdex on the server side without passing on any data about you.
• Cookies. We use only technically necessary cookies: "pk_cart" remembers your cart (up to 30 days) and "pk_admin" keeps our staff signed in to the administration area. These cookies need no consent (§ 165 (3) TKG 2021).

The legal basis is our legitimate interest in a secure, working shop (Art. 6 (1) (f) GDPR).

3. Orders

For your order we process your name, delivery and, where given, billing address, e-mail address, your phone number if you choose to give it, the cards ordered, amounts and payment status. Without this data we cannot conclude and perform the contract.

The legal bases are performance of the contract (Art. 6 (1) (b) GDPR) and our statutory retention obligations (Art. 6 (1) (c) GDPR). We keep order and invoice data for seven years (§ 132 BAO) and delete it afterwards. Details entered and stored with the cart are deleted together with the cart after 30 days without activity.

4. Payment

Payments are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your card or account details directly with Stripe; we do not receive them, only the payment status, the payment method and a reference number. Stripe processes the data partly on our behalf and partly as a controller in its own right, for example for fraud prevention; in doing so Stripe checks payments automatically and may decline a payment. Stripe may also process data in the USA; Stripe is certified under the EU-US Data Privacy Framework and additionally uses standard contractual clauses. More at https://stripe.com/at/privacy.

If you choose PayPal, Stripe passes the necessary data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, which is itself responsible for it: https://www.paypal.com/at/legalhub/privacy-full.

The legal basis is performance of the contract (Art. 6 (1) (b) GDPR) and, for fraud prevention, our legitimate interest (Art. 6 (1) (f) GDPR).

5. Shipping

So that your parcel arrives, we pass your name and delivery address to Österreichische Post AG, Rochusplatz 1, 1030 Vienna, Austria; for international shipments the post hands the item over to the postal service of the destination country. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

6. E-mail

We send order confirmations, invoices and replies to your messages with Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as our processor. If you write to us, we use your details to answer your request (Art. 6 (1) (b) or (f) GDPR) and delete the message once it has been dealt with and no retention obligation applies.

7. Withdrawal through the online form

If you withdraw from the contract with "Withdraw from contract", we store your details and the time of receipt, send you an acknowledgement of receipt and process the withdrawal (Art. 6 (1) (c) GDPR in conjunction with § 13a FAGG). We keep this data as long as claims may arise from it, usually three years.

8. Hosting

The shop and the database run on servers of Exoscale (Akenes SA, Boulevard de Grancy 19A, 1006 Lausanne, Switzerland) in a data centre in Europe. Exoscale processes the data on our behalf. The European Commission has found that Switzerland ensures an adequate level of data protection.

9. Your rights

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on our legitimate interest (Art. 15 to 21 GDPR). To use them, write to us at bestellung@pokemonkarten.at.

If you believe that we do not process your data lawfully, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at. In Germany you can also contact the data protection authority of your federal state.