Privacy & cookies notice

Who we are

EdinCard Ltd (trading as EdinCard Vending) operates Pokémon TCG vending machines in venues across Edinburgh and publishes this website at edincardvending.com. For the purposes of UK data protection law, EdinCard Ltd is the data controller for the personal data described in this notice.

Registered in Scotland, company number [company number to be inserted]. Registered office: [registered office address to be inserted].

You can reach us about anything in this notice at info@edincardvending.com.

What we collect, and why

Email alert sign-ups

If you give us your email address to be told when a machine goes live near you, we store that address and the date you gave it. We use it only to send you those notifications. Our lawful basis is your consent, which you can withdraw at any time by using the unsubscribe link in any email or emailing us.

Enquiries through our forms or by email

When you contact us through the contact form, the venue-hosting form or by email, we receive whatever you send: typically your name, email address, and — for venue enquiries — your venue's name, address, phone number and details about the site. We use this to answer you and, where relevant, to progress a hosting arrangement. Our lawful basis is our legitimate interest in responding to enquiries, and for venue enquiries, taking steps at your request before entering into a contract.

Machine purchases

Payments at our machines are processed by our card payment provider, not by us. We never see or store your card number. What we receive is transaction data: the machine, the slot, the amount, the time, and a partial card reference used to match a payment to a vend. We use this to operate the machines, resolve failed vends and refunds, and meet our accounting and tax obligations. Our lawful basis is performance of a contract (your purchase) and legal obligation (financial record-keeping).

Failed vends and refunds

If you report a problem with a vend, we process what you tell us — the venue, slot, time, your description, any photo — plus the matching entry from the machine's vend log, and your contact details so we can respond. Our lawful basis is performance of a contract and our legal obligation under consumer law.

Website usage

This site does not run analytics, advertising or tracking scripts, and does not build a profile of you. Our hosting provider keeps standard server logs (including IP addresses) for security and reliability, as any web host does. Our lawful basis for that is our legitimate interest in keeping the site available and secure.

Cookies

This website sets no cookies of its own — no analytics cookies, no advertising cookies, no tracking pixels. That's why you aren't seeing a cookie banner.

We do load web fonts from Google Fonts, which means your browser makes a request to Google's servers (fonts.googleapis.com and fonts.gstatic.com) when you load a page. Google receives your IP address as part of that request. Google Fonts does not set cookies for this purpose, but if you would rather avoid the request entirely, blocking those domains in your browser will leave the site fully readable in fallback fonts.

If we ever add analytics, we'll add a proper consent mechanism first and update this notice.

Who we share data with

We do not sell personal data, and we do not share it for anyone else's marketing. We do use a small number of service providers who process data on our behalf under contract:

• our card payment provider, which processes machine payments and refunds
• our email provider, which hosts the inbox your enquiries arrive in
• our website host, which serves this site and keeps server logs
• where used, an email delivery service for machine-alert emails
• our accountant, for financial records

We may also disclose data where we're legally required to — for example to HMRC, or in response to a lawful request from a public authority.

Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to safeguard it.

How long we keep it

• Email alert sign-ups: until you unsubscribe, or after two years with no engagement.
• Enquiries: up to two years from our last exchange, so we have context if you come back.
• Venue hosting arrangements: for the life of the agreement plus six years, for contractual and tax reasons.
• Transaction and refund records: six years from the end of the relevant accounting period, as UK tax law requires.
• Server logs: as retained by our host, typically a short rolling window.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• ask us to erase data where we no longer have grounds to keep it
• restrict or object to our processing in certain circumstances
• receive your data in a portable format where processing is based on consent or contract
• withdraw consent at any time, where consent is the basis we rely on

Email info@edincardvending.com to exercise any of these. We'll respond within one month. There's no charge for a reasonable request.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, or on 0303 123 1113.

Security

The site is served over HTTPS. Enquiry data lives in our email system, protected by strong authentication. Card data never reaches us — it's handled entirely by our payment provider on PCI-compliant infrastructure. Access to any personal data is limited to the two directors of EdinCard Ltd and, where necessary, our accountant.

Children

This website isn't directed at children, and we don't knowingly collect personal data from anyone under 13 through it. Our machines sell trading cards, which are not age-restricted, and buying from one doesn't require you to give us any personal data at all.

Changes to this notice

If we change how we handle personal data, we'll update this page and change the "last updated" date above. Material changes affecting people on our email list will be sent to that list.