Privacy Policy

Who we are

R&K Collectibles Ltd, trading as VintageCardBuyer, is the data controller for the personal data described on this page. If you have any question about your data, contact us at help@vintagecardbuyer.co.uk.

R&K Collectibles Ltd trading as VintageCardBuyer. Registered in England and Wales, company number 17488107.

What we collect, and why

Contact and collection details

Your name, email address, phone number (if you give us one) and postcode or collection address, so we can send you a quote, arrange collection and get in touch if something needs checking. We use this on the basis that it's necessary to provide the service you've asked for — quoting for and buying your collection.

Your agreement to the Terms. When you submit a collection and when you accept an offer, we record which version of the Terms you agreed to and when. This is kept with your submission and deleted with it.

Photos and video of your collection — and your home

We ask for photos or a short video of the cards you're submitting, so we can price them and, once we receive the parcel, check it against what we were shown before we pay. Because this media is captured inside your home, it may incidentally show parts of your home and its contents beyond the cards themselves — we only use it to price and verify your collection, we don't look at or use anything else it happens to show. These files are stored in a private cloud storage bucket that is never publicly accessible; every time you or a staff member views one, it's through a time-limited link generated at the moment of viewing, not a permanent public address.

If a collection you send doesn't match what you showed us, or we send you a revised offer, we may add photos or video of what we found when we opened and checked it to your submission as evidence, for the same reason — so we can show you exactly what we found rather than just tell you. We also keep the written explanation we gave you; for a revised offer, it is kept with the offer. These files are handled the same way: private storage, time-limited links, shown to you on your tracking page rather than emailed as a raw link.

Payment information

We don't keep your bank account or card details. What we see depends on how you choose to be paid:

• Bank transfer through Stripe. Stripe, our payment provider, collects what it needs to pay you directly on its own secure pages — typically your name, date of birth, address, sort code and account number, and photo ID if it asks for it. We never see these, and Stripe holds them under its own terms and privacy policy. To set the account up we send Stripe your email address and our reference for your submission, and we keep only the account reference Stripe gives us, whether Stripe says the account can receive payments, and a record of the payment.
• PayPal. We keep the PayPal email address you give us, which is a payment handle, not a bank credential.
• A bank transfer arranged by phone or message. You give a member of our team your bank details, so we do see them. We use them once to send the payment and don't copy them into our records — we keep only a note that a payment was sent, not where it went. If you send them in a written message, that message stays in our email or messaging account until it is deleted.

If you need to pay for return postage (see section 5 of our Terms of Service), the card details for that are typed directly into Stripe's own hosted checkout page and never reach us.

Requests to cancel or change your collection

If you ask us, on your tracking page, to cancel or to change the collection address or parcel size, we keep a record of the request (including the address or measurements you typed), of what we decided and when, of the reason we gave you if we said no, and of which member of our staff decided. We use this to carry out your request and to keep an accurate record of what was agreed. It is kept with your submission and deleted with it (see “How long we keep it”), and it is included if you ask for a copy of your data.

Reminder emails if you decline an offer

When you decline an offer on your tracking page, you will see an optional tick box asking whether you would like us to email you a reminder about that offer. It is never ticked for you, and declining works in exactly the same way whether or not you tick it. If you tick it, we send you one email about that offer, about 7 days after you declined, and only if the offer is still open. It tells you the offer still stands, in case you've changed your mind, and contains nothing else. If you do not tick the box, we send you no reminders.

We send these reminders on the basis of your consent. You can withdraw it at any time, using the unsubscribe link in any reminder (one click, nothing to sign in to) or by emailing help@vintagecardbuyer.co.uk. Withdrawing it stops further reminders; it does not stop messages about a submission you are actively going ahead with, such as your offer, label or payment.

We keep a record of whether you ticked the box, when you did, and which version of the wording you were shown, with your submission, and we note the date if you later withdraw consent. We also keep a record of each reminder we send. All of this is deleted with the submission (see “How long we keep it”).

The unsubscribe record. To make the unsubscribe link work, when we send you a reminder we also add you to a small list of people who can ask us to stop. Your entry on that list holds only: your email address (in lower case), a random code that your unsubscribe link uses (it is not your email address or your reference number), the date the entry was made, and, if you unsubscribe, the date you did. It is not used for anything else.

Why we keep it, and for how long. This entry is not deleted automatically: there is no timed deletion for it. We keep it because it is the least we need in order to honour your opt-out. If we deleted it, we would no longer know that you had asked us to stop. You can ask us to erase it at any time by emailing help@vintagecardbuyer.co.uk. Our staff can erase it, but the tool we use does so as part of erasing everything we hold about you (apart from a receipt we must keep), not on its own. If your entry has been erased and you later decline another offer, we would only send you reminders if you ticked the box again.

Help requests

If you send us a message through our contact form, we keep your email address, your name if you give it, your message and any collection reference you include, so we can reply and keep track of the conversation. Our staff may add their own notes to it.

Your IP address, for security

To stop people guessing reference numbers, flooding our forms or misusing our uploads, we count how often each internet (IP) address and email address uses our forms and tracking page in a short window. We don't store the address itself — only a scrambled code (a keyed hash) that can't be turned back into it — and we delete these records after 48 hours. We do this on the basis of our legitimate interest in keeping the service and your data secure.

Marketing source data

If you arrive at our site from an advert or a QR code on a leaflet, we record which campaign brought you here (standard tracking parameters in the web address, plus a code printed on some physical materials) so we can tell which of our advertising is actually working. This is a short label like “google” or a campaign name — it does not contain your name, email or any other personal detail, and it's only ever looked at in aggregate, grouped by channel, never by individual visitor.

Cookies and analytics

We use a small number of strictly necessary cookies/local storage to run the site (for example, remembering that you've already answered our cookie banner). Anything beyond that — such as Google Analytics or a Meta advertising pixel, if and when we turn either on — only loads after you actively accept the optional cookies banner shown on your first visit; if you reject it, or never answer, nothing beyond the essentials loads. You can change your mind at any time by clearing your browser's site data for this domain, which will show the banner again.

If you reach us through a QR code we gave you in person, the site keeps a short-lived note (24 hours) of which code it was, so we know how your submission reached us. It holds one word, such as the name of the code, and nothing about you.

Who we share it with

We use a small number of service providers to run this business, each of whom only processes your data to provide their service to us: our database and file storage provider, our transactional email provider (to send you confirmations, offers and your tracking link), our payment provider, Stripe (to pay you, or to take a return-postage payment if your collection is sent back to you — and PayPal, if you choose to be paid that way), Royal Mail (to arrange collection using the address you give us), and a parcel-tracking service, Ship24, which is given only the Royal Mail tracking number of the label we buy for you so that it can tell us where your parcel is — never your name, address or contact details. Some of these providers may process data outside the UK; where that happens, we rely on their standard contractual safeguards. We do not sell your personal data to anyone, ever.

How long we keep it

We delete your data automatically on this schedule. While your collection is still in progress — you've accepted an offer, it's in the post, or we're checking it or paying you — nothing is deleted.

• Photos, videos and postage labels: 90 days after your submission finishes without a sale (you decline, we don't make an offer, it's cancelled, or there's no reply for 90 days), or 90 days after we pay you.
• If we send your collection back because it didn't match what you showed us, or because you declined a revised offer: the photos, videos, our unboxing footage and anything we attached to a revised offer are kept for 6 months after it goes back, in case of any dispute. A collection we have disposed of under our Terms counts the same as one that went back, with the 6 months starting on the day it was disposed of.
• Your submission (your name, contact details, address, notes, our offers, including any revised offer and the explanation we gave, and how you were paid): 12 months after the last activity on it, or 12 months after we pay you. This includes any requests you made to cancel or change your collection, our decisions on them, your choice about reminder emails (and when you made it), and the record of any reminder emails we sent you.
• Receipts: if we buy your collection, UK law requires us to keep the record of the purchase for six years after the end of our financial year, so we keep your receipt — your name, contact details and address as printed on it, what we bought, the price and how we paid you — for 7 years from the purchase, then delete it. This applies even if you ask us to delete everything else.
• Help requests: 12 months after the conversation is closed.
• Reminder unsubscribe entry: not deleted automatically (see “Reminder emails if you decline an offer” above); we erase it if you ask.
• Security records (the scrambled IP and email codes above): 48 hours.
• Uploads you never sent (photos added to the form but never submitted): 48 hours.
• Parcel tracking: the tracking-service record of your Royal Mail tracking number goes with your submission, and our own log of tracking numbers after 13 months.

Our unboxing footage. We film every collection as it is opened. Footage of a collection that matched, and so was bought or cancelled, is kept by us on our own equipment, not on this website, for 6 months after the sale is completed or cancelled, and then deleted. Footage used as evidence on a rejection or revised offer follows the 6 months that apply when a collection goes back. If you ask us to delete your data we delete the footage too, unless a dispute about your collection is already open.

Our service providers keep short-lived copies of their own: our database provider's daily backups are kept for 8 days, and email delivery and server logs for a short period set by each provider. Stripe keeps its own records of any Stripe account or payment, under its own legal obligations. You can ask us to delete your data sooner at any time — we'll delete everything except a receipt we're required to keep.

Your rights

Under UK GDPR, you have the right to:

• ask us what personal data we hold about you, and get a copy of it;
• ask us to correct anything that's inaccurate or incomplete;
• ask us to delete your data (see “How long we keep it” above for the one thing we must keep);
• ask us to restrict or object to how we use your data;
• ask for your data in a portable format; and
• withdraw consent at any time, for anything we rely on consent for (like analytics cookies and reminder emails).

To exercise any of these, email help@vintagecardbuyer.co.uk. If you're not happy with how we've handled your data, you can also complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

Children

This service involves a cash payment and, for some payment methods, identity verification through our payment provider, so it isn't intended for anyone under 18. We don't knowingly collect data from children.

Changes to this policy

If we make a material change to how we handle your data, we'll update this page and change the “last updated” date at the top.

Contact us

Questions about this policy, or a request about your data — email help@vintagecardbuyer.co.uk. See also our Contact page and Terms of Service.