Legal
Privacy Policy
Last updated: July 2026
Who we are
NAKAMA TCG Ι.Κ.Ε. operates the website nakama.cards and sells sealed trading card game products (Pokémon, One Piece).
Registered address: Ethnikis Antistaseos 4, Alimos 17456, Greece. ΑΦΜ: 803261940, ΔΟΥ: ΚΕΦΟΔΕ, ΓΕΜΗ: 193305401000.
What we collect
- Account data: email address, name (when you sign up or check out).
- Shipping address: ACS home-delivery address, city, postal code, phone number.
- Payment data: processed by Stripe. We never see or store your full card number.
- Order data: what you bought, quantities, prices, order status.
- Technical data: IP address, browser type, pages visited (collected by our hosting provider Vercel).
- Analytics data: if you accept analytics cookies, Google Analytics may receive page views, interactions, approximate location, device information and pseudonymous identifiers. If you also accept advertising cookies, Google Signals may add aggregated insights from signed-in Google users who have enabled Ads Personalization.
- Marketing measurement data: if you accept advertising cookies, Google Ads may receive conversion signals, click identifiers, transaction metadata and a hashed version of your email. Raw email, delivery details and product details are excluded from the database measurement feed.
Why we collect it
- To process and ship your orders.
- To send transactional emails (order confirmation, shipping notifications).
- To send promotional emails only when you have explicitly opted in (you can unsubscribe at any time).
- To comply with Greek tax law and myDATA fiscal document requirements.
- To detect and prevent fraud.
- To understand anonymous site usage and improve store performance.
- To measure whether advertising leads to waitlist signups or purchases, where you have given cookie consent.
Legal bases
- Contract: checkout, payment, order support, delivery, returns, and refunds.
- Legal obligation: tax, accounting, myDATA, fraud-prevention, and consumer-law records.
- Legitimate interests: service security, abuse prevention, incident investigation, and basic operational measurement, balanced against your rights.
- Consent: marketing email and non-essential advertising or analytics cookies. You may withdraw consent at any time without affecting earlier lawful processing.
Who we share it with
- Stripe — payment processing.
- ACS Courier — parcel delivery (name, address, phone, email for shipping).
- Resend — transactional email delivery and unsubscribe handling.
- Supabase — authentication and database hosting (EU region, Frankfurt).
- Vercel — website hosting and analytics.
- Cloudflare Turnstile — waitlist abuse prevention using a short-lived challenge token and browser/network security signals.
- Google Analytics — consented site analytics and, when you also accept advertising cookies, aggregated Google Signals reporting.
- Google Ads — consented conversion measurement and enhanced conversions using a restricted purchase feed after you accept advertising cookies.
We do not sell your data to third parties.
How long we keep it
Order and invoicing data is retained for 5 years as required by Greek tax law. Account data is kept until you request deletion, except where a purchase or legal obligation requires us to retain related records. When you unsubscribe, waitlist profile, IP, user-agent, and confirmation data are removed immediately. We retain the email address, original consent and unsubscribe timestamps, minimal recordkeeping timestamps, and a suppression source marker so we can honour the opt-out and demonstrate compliance; launch-delivery state is erased. Provider delivery events are deleted after 90 days, and failed-send replay payloads are redacted after 90 days. A minimal failed-send record may retain the recipient, message type, diagnostic and retry/status timestamps, and related order or refund reference only as needed to operate, secure, troubleshoot, or establish legal claims for the service, subject to applicable law. Google Analytics event-level and user-level data is configured for a 14-month retention period. You can request deletion by emailing privacy@nakama.cards.
International transfers
Some service providers may process data outside the European Economic Area. Where this occurs, we rely on an applicable European Commission adequacy decision or approved safeguards such as Standard Contractual Clauses, together with additional measures where required. You may request information about the safeguards used by contacting privacy@nakama.cards.
Your rights (GDPR)
Under the General Data Protection Regulation you have the right to:
- Access your personal data.
- Correct inaccurate data.
- Request deletion (“right to be forgotten”).
- Restrict or object to processing.
- Data portability (receive your data in a machine-readable format).
- Withdraw consent for marketing at any time.
- Lodge a complaint with the Hellenic Data Protection Authority (HDPA).
To exercise any of these rights, email privacy@nakama.cards.
Cookies
We use strictly necessary cookies for authentication, waitlist state, and checkout. With your permission, we also use analytics and Google Ads conversion measurement. See our Cookie Policy for details.
Contact
NAKAMA TCG Ι.Κ.Ε.
Ethnikis Antistaseos 4, Alimos 17456, Greece
Email: privacy@nakama.cards