Template — the site operator must replace every [bracketed] value (legal entity, address, governing law, contact addresses, ICO/registration numbers) and have this reviewed by a qualified adviser before relying on it.
Scope
This statement supplements the Privacy Policy for individuals in the United Kingdom and the European Economic Area whose personal data is processed by PokeHive. Where this statement and the Privacy Policy overlap, read them together.
Controller and contact
Controller: [legal entity name], [address]. Data-protection contact: [privacy@your-domain]. [EU/UK representative under Article 27, if applicable: name and address.] [DPO, if appointed: name and contact.]
Principles we apply (Article 5)
- 1Lawfulness, fairness, transparencyEach processing activity has a documented lawful basis, set out in the Privacy Policy.
- 2Purpose limitationData is used only for the collection, pricing, sharing and security purposes described, not repurposed without a new basis.
- 3Data minimisationWe ask for the minimum needed — an email to sign in, plus whatever you choose to record about your cards.
- 4AccuracyYou can edit or delete your data at any time from your account.
- 5Storage limitationRetention periods are stated in the Privacy Policy; data is deleted or anonymised when no longer needed.
- 6Integrity and confidentialityTransport encryption, access controls, rate-limiting, and processor contracts protect your data.
- 7AccountabilityWe keep records of processing and review this documentation when the Service changes.
Your rights and how to use them
| Right | What it means | How |
|---|---|---|
| Access (Art. 15) | Get confirmation we hold your data and a copy of it | Email [privacy@your-domain] |
| Rectification (Art. 16) | Correct inaccurate or incomplete data | Edit in-app or email us |
| Erasure (Art. 17) | Have your data deleted (“right to be forgotten”) | Delete your account, or email us |
| Restriction (Art. 18) | Pause processing while a dispute is resolved | Email us |
| Portability (Art. 20) | Receive your data in a machine-readable format | CSV export in-app, or email us |
| Object (Art. 21) | Object to processing based on legitimate interests or to direct marketing | Toggle off in settings, or email us |
| Withdraw consent | Stop consent-based processing (e.g. marketing) | Unsubscribe link or settings |
We answer requests within one month (extendable by two further months for complex requests, with notice). We may ask you to verify your identity. There is no fee unless a request is manifestly unfounded or excessive.
Data breaches
If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will inform affected users without undue delay where the risk is high.
Automated decision-making
We do not carry out automated decision-making that produces legal or similarly significant effects about you. Grading estimates and pack-odds figures are informational models, not decisions about you.
Complaints
You can complain to your local supervisory authority. In the UK this is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF (ico.org.uk). We would appreciate the chance to resolve concerns first — contact [privacy@your-domain].