Privacy Policy

Montrose Cards (“Montrose Cards,” “we,” “us”) respects your privacy. This policy explains, plainly, what personal data we collect through this website, why, on what legal basis, who else sees it, how long we keep it, and how you can exercise your rights over it.

Who this applies to

This policy covers everyone who uses montrosecards.com as a visitor, buyer, or consignor. Our admin back-office (the internal tool our staff use to manage inventory, sales and consignments) is a separate, access-controlled system and is not addressed here.

What we collect, and why

We only collect what a given form on the site actually asks for. Nothing is collected silently.

Making an offer on an item

Email, name, phone number (optional), the offer amount, and an optional message. Used to consider your offer and, if accepted, to create a reservation in your name. Legal basis: performance of a contract, or steps taken at your request prior to entering one (GDPR Art. 6(1)(b)).

Reserving items (cart checkout)

Email, name, destination country (to calculate shipping), and the items and amounts reserved. We do not collect a full shipping address or card details through this form — those are exchanged separately once a reservation is confirmed. Legal basis: performance of a contract (Art. 6(1)(b)).

Consigning items (the submission wizard)

First and last name, email, phone, Instagram handle (optional), the items you declare (description, grade, list price, minimum acceptable offer), photographs of those items, and an electronic signature evidence bundle — the signature image itself, the IP address it was signed from, and a timestamp. The signature evidence is kept specifically so the consignment agreement can be shown to be validly signed if ever disputed. Legal basis: performance of the consignment contract (Art. 6(1)(b)) and our legitimate interest in being able to evidence that agreement (Art. 6(1)(f)).

Newsletter

Email address only. Legal basis: your consent (Art. 6(1)(a)), given when you subscribe. You can withdraw it at any time using the unsubscribe link in any newsletter email, or by writing to us.

Book a call

Email, name, and your answers to a short qualification questionnaire (what you are buying or selling, budget or estimated value, timeline). Used to prepare for and schedule the call. Legal basis: steps taken at your request prior to entering a contract (Art. 6(1)(b)).

Waitlist

Email address, linked to the specific item you asked to be notified about. Legal basis: your consent, given by joining the waitlist.

Technical / security data

We log IP addresses briefly, in memory only, to rate-limit abusive form submissions — this is never written to our database and is discarded automatically as each time window elapses. Legal basis: legitimate interest in keeping the site secure and usable (Art. 6(1)(f)).

Cookies and local storage

This site does not use advertising or third-party analytics cookies of any kind — there is currently no tracking pixel, analytics script, or ad network on montrosecards.com. Your cart selection is stored locally in your own browser (via localStorage, not a cookie) purely so it survives a page reload; it is never transmitted anywhere unless you submit the checkout form yourself. If this changes in the future, this policy will be updated first.

Who else processes your data

We use a small number of specialist providers to run the site. Each only receives what it needs to perform its specific role, under a data processing agreement:

• Supabase (database, file storage, and authentication), hosted on AWS in Frankfurt, Germany (EU) — stores all the data described above.
• Vercel (hosting and content delivery) — serves the website itself.
• Resend (transactional email) — sends confirmations, reservation instructions, and similar account emails; receives your email address and the content of that specific message.
• Anthropic — used internally when we photograph and catalogue a consigned item, to help our team pre-fill the listing details from the slab photos. This processes item photographs, not buyer personal data.
• Revolut — a card-payment processor for the item deposit. This is not yet active; it will only process your data if and when card deposits are enabled, and only for the payment itself.

Where a provider is located outside the European Economic Area, the transfer is safeguarded by that provider's Standard Contractual Clauses or an equivalent legal mechanism under Art. 46 GDPR.

How long we keep it

• Completed sales, invoices, and consignment settlements: retained for the periods required by Spanish commercial and tax law (generally up to 6 years).
• Consignment agreements and their signature evidence: for the duration of the consignment relationship, plus the applicable statute-of-limitations period for contract claims.
• Offers, reservations, and call requests that do not lead to a sale: kept for a reasonable operational period and deleted when no longer needed.
• Newsletter and waitlist entries: until you unsubscribe or ask us to remove you.

Your rights

Under GDPR, you can ask us to:

• give you access to the personal data we hold about you;
• correct it if it is inaccurate;
• erase it, subject to the retention obligations described above;
• restrict or object to certain processing;
• receive a portable copy of the data you provided to us.

To exercise any of these rights, write to our contact email on the Imprint page. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).

These terms are provided for information; the binding version is confirmed at checkout/submission where applicable.