Direct Shop · 20 August 2026

Direct Shop Privacy Notice

This notice covers physical products bought directly from the LVLING shop. The closed collector platform has a separate Privacy Notice.

1. Who controls the data

Taskm8 Ltd, company number 16527524, is the data controller. Its registered office is Flat 1009, 4 Legacy Point, Victoria Road, London, W3 6FH. Contact admin@tcgleveling.io for shop privacy or order requests.

2. What is collected and why

Stripe collects your name, email, telephone number, UK delivery address, payment method and payment result to take payment and perform the sales contract. Royal Mail receives the recipient name, email, telephone number, UK delivery address, order reference and parcel value needed to create and deliver the Click & Drop order. Taskm8 Ltd uses those providers to perform the contract, handle refunds and meet legal and accounting duties.

3. What LVLING stores

The LVLING database does not store the raw delivery address, email, telephone number, Stripe webhook body or Royal Mail request body. It stores the product version, quantity and amounts; Stripe Session and PaymentIntent references; signed-event identifiers and payment state; a pseudonymous Royal Mail reference, Royal Mail order identifier, payload hash and fulfilment/recovery state. Stripe and Royal Mail retain the data held in their systems under their own privacy notices.

4. Retention and security

Shop accounting and transaction references are retained for six years from the end of the financial year they relate to, or longer where a live legal claim or HMRC requirement applies. Operational failure data is code-only and contains no address. Provider keys are server-side secrets and are never sent to the browser.

5. Your rights

You can ask for access, correction, restriction, objection or deletion where the law allows it. Some transaction records must remain for tax, accounting, refunds, disputes or legal claims. Email us from the checkout address so we can match the request safely. You can also complain to the Information Commissioner's Office.