Privacy Policy

As of November 2026. This is a translation for your convenience; only the German version is legally binding.

We process personal data only as far as the shop, your order and our legal obligations require. Here you can read which data that is, what we use it for and which rights you have.

1. Controller

The controller is the operator of Overpriced Cardboard, Wienerstraße 1, 2440 Moosbrunn, Austria, e-mail: order@overpricedcardboard.com. The operator's name and all further details are given in the legal notice: https://overpricedcardboard.com/en/legal-notice. We have not appointed a data protection officer because we are not required to; please send any questions to the e-mail address above.

2. Visiting the shop

• No access logs, no tracking. We do not store IP addresses when you visit the pages and we use no analytics, advertising or tracking tools.
• Everything from our server. Fonts and card pictures are delivered by our own server; your browser does not connect to third parties for them. We fetch the card pictures from TCGdex on the server side without passing on any data about you.
• Cookies. We use only technically necessary cookies: "pk_cart" remembers your cart (up to 30 days), form cookies such as "pk_app_form" keep your entries for two minutes when a field still needs fixing, and "pk_admin" keeps our staff signed in to the administration area. These cookies need no consent (§ 165 (3) TKG 2021).

The legal basis is our legitimate interest in a secure, working shop (Art. 6 (1) (f) GDPR).

3. Orders

For your order we process your name, delivery and, where given, billing address, e-mail address, your phone number if you choose to give it, the cards ordered, amounts and payment status. Without this data we cannot conclude and perform the contract.

The legal bases are performance of the contract (Art. 6 (1) (b) GDPR) and our statutory retention obligations (Art. 6 (1) (c) GDPR). We keep order and invoice data for seven years (§ 132 BAO) and delete it afterwards. Details entered and stored with the cart are deleted together with the cart after 30 days without activity.

When you buy a gift voucher, we process your name, your e-mail address, the amount and – if you enter them – the name of the person it is for and your message, which are printed on the voucher. We store when and for which order a voucher was redeemed. We store discount codes with the order and the e-mail address to keep campaign conditions such as “once per customer”.

4. Payment

Payments are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your card or account details directly with Stripe; we do not receive them, only the payment status, the payment method and a reference number. Stripe processes the data partly on our behalf and partly as a controller in its own right, for example for fraud prevention; in doing so Stripe checks payments automatically and may decline a payment. Stripe may also process data in the USA; Stripe is certified under the EU-US Data Privacy Framework and additionally uses standard contractual clauses. More at https://stripe.com/at/privacy.

If you choose PayPal, Stripe passes the necessary data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, which is itself responsible for it: https://www.paypal.com/at/legalhub/privacy-full.

The legal basis is performance of the contract (Art. 6 (1) (b) GDPR) and, for fraud prevention, our legitimate interest (Art. 6 (1) (f) GDPR).

5. Shipping

So that your parcel arrives, we pass your name and delivery address to Österreichische Post AG, Rochusplatz 1, 1030 Vienna, Austria; for international shipments the post hands the item over to the postal service of the destination country. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

6. E-mail

We send order confirmations, invoices and replies to your messages with Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as our processor. If you write to us, we use your details to answer your request (Art. 6 (1) (b) or (f) GDPR) and delete the message once it has been dealt with and no retention obligation applies.

7. Withdrawal through the online form

If you withdraw from the contract with "Return an order (withdraw from contract)", we store your details and the time of receipt, send you an acknowledgement of receipt and process the withdrawal (Art. 6 (1) (c) GDPR in conjunction with § 13a FAGG). We keep this data as long as claims may arise from it, usually three years.

8. App licences (ScanPM)

Licences for the app ScanPM are sold by Antalyse GmbH. It is the controller for the data of a licence purchase and of the licence service; what it processes is set out in the data protection section of its licence terms (https://overpricedcardboard.com/en/app/license-terms). We run the app page, the order form and the server the licence service also runs on, and process the data on its behalf (Art. 28 GDPR).

9. Hosting

The shop and the database run on servers of Exoscale (Akenes SA, Boulevard de Grancy 19A, 1006 Lausanne, Switzerland) in a data centre in Europe. Exoscale processes the data on our behalf. The European Commission has found that Switzerland ensures an adequate level of data protection.

10. Your rights

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on our legitimate interest (Art. 15 to 21 GDPR). To use them, write to us at order@overpricedcardboard.com.

If you believe that we do not process your data lawfully, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at. In Germany you can also contact the data protection authority of your federal state.