House of TCG Legal

Privacy Policy

Last updated: 9 September 2026

This Privacy Policy explains how House of TCG, trading as House of TCG ("House of TCG", "we", "us" or "our"), processes personal information when you visit houseoftcg.co.za, contact us, subscribe to marketing, or buy from our South African online store.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"), and other applicable South African law.

1. Responsible party and contact details

Responsible party: House of TCG
Privacy email: info@houseoftcg.co.za
Website: https://houseoftcg.co.za

You may submit an access, correction, objection, deletion, consent-withdrawal, or other privacy request through our contact form. We may need to verify your identity before acting on a request.

2. Personal information we collect

Depending on how you use the store, we may collect:

identity and contact information, including your name, email address, telephone number, and customer reference;
delivery information, including a physical or business address, PUDO locker details, delivery notes, and selected shipping method;
transaction information, including cart contents, orders, invoices, credit notes, refunds, store credit, payment status, and PayFast payment references;
communications, support requests, product reviews or messages that you send to us;
marketing preferences, subscription status, consent records, and unsubscribe records;
technical and security information such as IP address, browser/device information, session identifiers, request logs, fraud indicators, and cookie choices; and
information reasonably required to investigate a return, payment dispute, suspected fraud, or security incident.

We do not intentionally collect or store full payment-card numbers. PayFast processes payment details on its own systems and provides us with payment status and transaction references.

3. Sources of information

We collect information directly from you when you use forms, place an order, contact us, select delivery, or subscribe. We also receive limited information automatically from our website and hosting security logs, and from service providers such as PayFast and delivery providers where necessary to complete or verify a transaction.

4. Purposes and justification

We process information only for specific, lawful purposes, including to:

prepare a cart, conclude and perform a sale, process payment, deliver goods, and provide order support;
issue invoices, credit notes, refunds, and maintain customer store-credit records;
communicate order, payment, delivery, allocation, recall, or service information;
respond to enquiries, complaints, returns, and statutory requests;
comply with tax, accounting, consumer-protection, anti-fraud, recordkeeping, and other legal obligations;
secure, maintain, diagnose, and improve the website and prevent fraud or abuse; and
send lawful direct marketing where you have consented or where POPIA permits marketing to an existing customer for our own similar products, with a free opportunity to object.

Our justification may be your consent, steps requested by you before or during a contract, performance of the sale, compliance with law, protection of a legitimate interest, or our legitimate operational interests where those interests do not unjustifiably prejudice your rights.

5. Mandatory and voluntary information

Information marked as required during checkout is necessary to process payment, identify the order, communicate with you, and deliver the goods. If it is not supplied, we may be unable to accept or fulfil the order. Optional information is identified as such and may be withheld without preventing unrelated use of the site.

6. Sharing and operators

We do not sell personal information. We may provide only the information reasonably needed to:

PayFast and relevant financial institutions for payment processing, verification, fraud prevention, refunds, and disputes;
couriers, PUDO, locker networks, and fulfilment providers for delivery;
hosting, email, security, consented analytics, and technical service providers acting for us;
accountants, auditors, legal advisers, insurers, and professional service providers under appropriate confidentiality duties; and
regulators, courts, law-enforcement authorities, or other persons where disclosure is required or permitted by law.

Operators processing information for us must handle it only for authorised purposes and apply appropriate security safeguards.

7. Cross-border processing

Some payment, email, analytics, cloud, or technical providers may process information outside South Africa. Where personal information is transferred to another country, we take reasonable steps to satisfy section 72 of POPIA, for example through adequate legal protection, binding contractual obligations, consent where appropriate, or another lawful ground.

8. Cookies and analytics

Strictly necessary cookies support the cart, checkout, security, and your cookie preference. Google Analytics is not loaded unless you choose Accept analytics. You can withdraw that choice at any time through Cookie Settings in the footer. See our Cookie Policy for names, purposes, and retention information.

9. Direct marketing

Marketing emails identify House of TCG and provide a free unsubscribe method. You may object or unsubscribe at any time. We keep a minimal suppression record after an unsubscribe so that we can respect the request. Transactional messages about an order, payment, delivery, safety issue, or legal notice are not marketing and may still be sent where necessary.

10. Retention

We retain personal information only for as long as it is needed for the purpose collected or as required or authorised by law. Relevant transaction, tax, accounting, invoice, refund, and payment records are generally retained for at least the applicable statutory recordkeeping period, commonly five years, and may be kept longer where a dispute, investigation, legal hold, or another lawful requirement applies. Marketing information is retained until consent is withdrawn, an objection is received, or it is no longer needed, subject to a minimal suppression record.

When retention is no longer authorised or required, information is securely deleted, destroyed, or de-identified where reasonably practicable.

11. Security and compromises

We use reasonable technical and organisational safeguards appropriate to the information and risk, including access controls, password hashing, server-side validation, session security, restricted administration pages, transport encryption, backups, and monitoring. No internet system can be guaranteed completely secure.

If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will investigate and notify the Information Regulator and affected data subjects as required by POPIA.

12. Your rights

Subject to POPIA and other applicable law, you may request confirmation that we hold information about you; access to that information; correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained information; objection to certain processing; withdrawal of consent; and information about recipients where applicable.

You may also complain to the Information Regulator (South Africa). We encourage you to contact us first so we can try to resolve the concern promptly, but you are not required to do so.

13. Children

The store is not intended to knowingly collect personal information from a child without authorisation from a competent person or another lawful basis under POPIA. A parent or guardian who believes a child supplied information without proper authority should contact us.

14. Automated decisions

We do not intend to make decisions producing legal or similarly significant effects about customers solely through automated profiling. Automated fraud or security indicators may flag a transaction for human review.

15. Changes to this policy

We may update this policy when our processing or the law changes. The current version and update date will remain available on this page. Material changes will be communicated where required by law.