Privacy Policy

Last updated: 24 October 2026

TrainerStash LTD operates the TrainerStash online store and is the controller of personal information used to run our retail business. This means we decide why and how that information is used, subject to UK data protection law.

We are registered in England and Wales under company number 17107820. Our registered office and postal privacy contact address is:

3rd Floor, 86–90 Paul Street, London, EC2A 4NE, United Kingdom.

For privacy enquiries or requests, email [email protected]. You can also contact [email protected]; both inboxes are monitored.

This policy explains how we use personal information when you browse our store, create an account, contact us, subscribe to newsletters or price-drop alerts, or place an order. It is a notice about our practices, not a request for blanket consent to everything described here.

Depending on how you use the store, we collect:

• Contact and delivery information: your name, email address, billing and delivery addresses, and telephone number where provided or needed for delivery.
• Order and transaction information: items purchased, amounts paid, payment status and transaction references, refunds, returns, gift-card transactions and delivery information.
• Account information: account identifiers, email address, authentication information and saved preferences where account features are used. You should never send us your password by email.
• Customer communications: enquiries, complaints, cancellation requests, correspondence and any photographs or other information you send about an order.
• Marketing preferences: newsletter subscription status, the products or price-drop alerts you subscribe to, consent or opt-out records, and information needed to honour unsubscribe requests. Where an enabled email feature tracks interactions, this may also include message delivery and interaction information, subject to the controls explained in section 5.
• Technical information: IP address, browser and device information, access times, requested pages, security events and cookie or similar identifiers generated when you use the storefront. The precise technologies and their purposes are explained through our cookie information and controls.
• Return and fraud-prevention information: relevant order records and evidence reasonably needed to investigate payment disputes, missing parcels, suspected substitution or other misuse. Product scans, photographs or grading certification numbers may be linked to an order for this purpose.

Most information comes directly from you or your interaction with the store. We also receive relevant payment status and dispute information from Stripe, delivery updates from Royal Mail, and information generated by SortSwift as it operates the storefront and its email services.

If you ask us to deliver to someone else, we use the recipient details you provide to fulfil that delivery. Please make sure you are entitled to share those details and tell the recipient about this policy where appropriate.

We do not ask you to provide sensitive personal information, such as health information, to make a purchase. Please avoid including unnecessary sensitive details in messages to us.

Information used: Contact, order, transaction and delivery information.

Lawful basis: Performance of our contract with you, or steps you request before entering it.

Information used: Account, contact and order information.

Lawful basis: Performance of our contract with you.

Information used: Contact details, correspondence and relevant order information.

Lawful basis: Contract where related to providing your purchase; otherwise legitimate interests in responding and running our business.

Information used: Necessary transaction, contact and correspondence records.

Lawful basis: Legal obligation.

Information used: Relevant transaction, technical, delivery and investigation information.

Lawful basis: Legitimate interests in protecting customers, our business and our legal rights; legal obligation where applicable.

Information used: Email address and subscription preferences.

Lawful basis: Consent.

Information used: Email address, selected products and alert preferences.

Lawful basis: Consent for the alerts requested.

Information used: Contact details, relevant checkout or order details and marketing preferences.

Lawful basis: Consent; or legitimate interests in promoting our own similar products where all applicable electronic-marketing soft opt-in conditions are met.

Information used: Relevant preferences, technical identifiers and interaction information.

Lawful basis: Consent where required; necessary security and operational processing relies on legitimate interests or contract, as appropriate.

Information used: Minimum contact details and relevant preference or request records.

Lawful basis: Legitimate interests in respecting your choices and demonstrating compliance; legal obligation where applicable.

Where we rely on legitimate interests, we consider the purpose, necessity and effect on your rights and reasonable expectations. We do not rely on legitimate interests to bypass a requirement for cookie or electronic-marketing consent.

You do not have to provide optional marketing information. However, without the information necessary to process payment and deliver an order, we may be unable to fulfil it. Where a field is required, we identify it during the relevant process.

We use Stripe to process payments. Payment details are entered through Stripe's payment services. We do not store full payment-card numbers or card security codes in our own retail records. We receive information needed to administer your purchase, such as payment status, transaction references and limited payment-method details where supplied.

Stripe also processes information for its own purposes, including fraud prevention, security and compliance with financial-services requirements. It may act as an independent controller for those activities. Its privacy information is available at https://stripe.com/gb/privacy.

We use SortSwift's built-in email services for communications such as order confirmations, payment updates, dispatch notifications and replies about your purchase. These messages are separate from optional marketing and may still be sent if you unsubscribe from promotional emails.

You can create a store account without subscribing to marketing. Account registration does not by itself add you to our newsletter or authorise promotional emails.

When you sign up to our newsletter, we use your email address and subscription preferences to send the newsletters and offers described at signup. When you request a price-drop alert, we use your email address and the relevant product or alert preference to provide that alert. Requesting a price-drop alert does not by itself subscribe you to unrelated newsletters or offers.

You may unsubscribe from newsletters or cancel alerts using the controls provided in the message or your account, where available, or by emailing [email protected]. Tell us if you want to stop all marketing or only a particular subscription. We do not make a purchase conditional on marketing consent.

If we enable other promotional messages, including abandoned-checkout reminders, we send them only where we have valid consent or meet all the conditions of the products-and-services soft opt-in.

The soft opt-in applies only where we obtain your details directly during a sale or negotiations for a sale, market our own similar products, give you a clear chance to opt out when collecting your details, and provide an opt-out in each subsequent marketing message. Creating an account or simply entering an email address does not automatically authorise marketing.

You can object to direct marketing at any time. Use the unsubscribe link in a marketing email or email [email protected]. Where marketing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. We keep a minimal suppression record so we do not accidentally contact you again for marketing.

The storefront uses cookies or similar technologies for functions such as the shopping basket, login, security and payment processing. Some technologies are necessary to provide a service you request; others, if enabled, support optional preferences, analytics or marketing.

Where consent is required, optional technologies must not run before you agree. You can use the storefront cookie banner and available preference controls to make your choices. Refusing optional cookies does not prevent you buying goods. Browser settings can also remove or block cookies, although blocking necessary cookies may affect checkout or login.

We have not separately installed Google Analytics, Meta Pixel or TikTok Pixel for this storefront. This does not mean that SortSwift, Stripe or their service providers use no technical logging or similar technologies. Refer to the cookie banner and any associated cookie details for the choices available on this storefront. You can also contact [email protected] with questions about the technologies in use.

If enabled email features use tracking pixels, link tracking or similar technologies, we apply the relevant consent requirements. You can contact us about cookie or email tracking choices. An email unsubscribe and a cookie preference are separate controls.

We disclose relevant information to:

• SortSwift: our storefront, order-management and built-in email platform, including its authorised hosting, infrastructure and email-delivery providers as needed to supply those services.
• Stripe: to process payments, administer refunds and disputes, and support payment security and fraud prevention.
• Royal Mail: recipient name and address, service and parcel details, and contact information where needed for the delivery service or notifications, when creating postage labels and arranging delivery.
• Professional advisers and authorities: accountants, legal advisers, insurers, HMRC, regulators, courts or law-enforcement bodies where reasonably necessary and lawful for accounting, advice, a legal obligation or a specific dispute or investigation.

We limit disclosures to information reasonably needed for the purpose. Some recipients process information on our instructions; others, such as payment providers and carriers for parts of their activities, have their own legal responsibilities and privacy policies.

We do not sell or rent customer personal information or provide it to other businesses for their independent marketing.

Our service providers operate internationally. Information may be accessed or processed outside the UK, including in the United States. SortSwift's public privacy policy identifies a US location, and Stripe describes international processing in its privacy information. A provider's location does not by itself confirm where every copy of your information is stored.

Where we make a restricted international transfer, UK data protection law requires an appropriate transfer arrangement. Depending on the recipient and destination, this may be a UK adequacy regulation, the UK Extension to the EU–US Data Privacy Framework for an eligible certified recipient, or approved contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, together with any required assessment and additional protections.

We are currently confirming the storefront-specific processing locations and transfer safeguards with SortSwift. We will update this section when these details are confirmed. We do not currently claim that SortSwift holds a particular certification or that a specific contractual transfer mechanism is in place. Contact [email protected] for information about this enquiry and any confirmed safeguards applicable to your information. Stripe's published transfer information is available at https://stripe.com/legal/privacy-center. SortSwift's public privacy policy is at https://sortswift.com/privacy.

We keep information only for as long as needed for its purpose and applicable legal obligations. Our retention approach is:

• Order, payment and accounting records: normally six years from the end of the company financial year to which they relate. Longer retention may be necessary for a tax enquiry, an ongoing dispute or another legal requirement. We do not retain unnecessary technical or marketing data merely because an accounting record must be kept.
• Customer-service and returns correspondence: while the matter is active and afterwards where reasonably needed to evidence its resolution, meet legal obligations or deal with a potential claim. Routine enquiries with no continuing purpose should be removed sooner; where a contractual claim remains reasonably possible, relevant records may be kept for up to six years after closure, subject to review and any live proceedings.
• Account information: while the account is used or needed to provide its features. Inactive accounts should be reviewed and unnecessary details removed. Closing an account does not require deletion of records we must retain for a separate lawful purpose.
• Newsletter and price-alert records: while your subscription or alert remains active and the information remains relevant, with periodic review. Price-alert records include the products you ask us to monitor. After an unsubscribe or objection, we retain only what is needed for suppression, evidence of preferences or another lawful purpose.
• Incomplete checkouts: only while reasonably needed to support the checkout or a permitted reminder, unless the information is separately required for a completed order, a consent record or a specific security investigation.
• Security and investigation records: only for as long as reasonably necessary to manage the relevant risk or resolve the incident or claim, with restricted access and review.
• Cookies and technical identifiers: for the duration specified for the relevant technology in the cookie information; durations differ between session and persistent technologies.

The criteria we consider include whether an order or dispute remains open, legal recordkeeping duties, the sensitivity of the information, reasonable claim periods and whether anonymised or reduced information would meet the purpose. Where a provider holds information for us, deletion and retention must also be addressed through our arrangements with that provider. Providers acting as independent controllers apply their own retention rules for those activities.

We use proportionate technical and organisational measures to protect information and restrict access to those who need it for their role. Our store and payment providers also apply their own security measures. No internet service can guarantee absolute security. Please protect your account credentials and contact us promptly if you suspect misuse.

Subject to the applicable legal conditions, you can ask us to:

• Provide access to your personal information and a copy of it.
• Correct inaccurate or incomplete information.
• Delete information where there is no lawful reason to retain it.
• Restrict particular uses of your information.
• Provide qualifying information in a portable format.
• Stop processing based on legitimate interests where your circumstances justify an objection, unless we establish a legal basis to continue.

Your right to object to direct marketing is absolute: we must stop using your information for that purpose when you object. You can also withdraw consent at any time where we rely on it.

Rights are not all available in every situation. For example, a deletion request does not require us to remove records we must retain under tax law. We will explain any lawful reason for refusing or limiting a request.

Email [email protected] or [email protected] to make a request. We may ask for proportionate information to confirm your identity. We normally respond within one month, subject to extensions or other adjustments permitted by law, and will explain any applicable delay. Requests are normally free of charge.

Payment security checks may involve automated tools used by our providers. If you believe a decision affecting you was made solely by automated processing with a legal or similarly significant effect, contact us so we can explain the process and help you exercise applicable rights, including obtaining human review where required.

Our purchase terms ask customers under 18 to have a parent or guardian place the order. We do not intentionally target marketing at children or seek unnecessary information about them. As trading cards may interest younger visitors, we do not assume that no child will ever visit the store or contact us.

If you believe a child has supplied information inappropriately, contact us. We will review the circumstances and remove or restrict information where appropriate, while retaining anything legally necessary. A child's information receives the protections required by applicable law.

Contact [email protected] if you are concerned about our handling of personal information. We will investigate and respond.

You can also complain to the Information Commissioner's Office, the UK data protection regulator, at https://ico.org.uk/make-a-complaint/ or by telephone on 0303 123 1113. You do not have to obtain our permission to contact the ICO.

We may update this policy to reflect changes in the store, our providers or legal requirements. The date above identifies the version. Where required, we will bring material changes to your attention or obtain new consent before using information in a new way. Continuing to browse does not by itself constitute consent to new processing that requires consent.