Privacy Policy

Montrose Cards (“Montrose Cards,” “we,” “us”) respects your privacy. This policy explains, plainly, what personal data we collect through this website, why, on what legal basis, who else sees it, how long we keep it, and how you can exercise your rights over it.

Who this applies to

This policy covers everyone who uses montrosecards.com as a visitor, buyer, or consignor. Our admin back-office (the internal tool our staff use to manage inventory, sales and consignments) is a separate, access-controlled system and is not addressed here.

What we collect, and why

We only collect what a given form on the site actually asks for. Nothing is collected silently.

Making an offer on an item

Email, name, phone number (optional), the offer amount, and an optional message. Used to consider your offer and, if accepted, to create a reservation in your name. Legal basis: performance of a contract, or steps taken at your request prior to entering one (GDPR Art. 6(1)(b)).

Reserving items (cart checkout)

Email, name, destination country (to calculate shipping), and the items and amounts reserved. We do not collect a full shipping address or card details through this form — those are exchanged separately once a reservation is confirmed. Legal basis: performance of a contract (Art. 6(1)(b)).

Consigning items (the submission wizard)

First and last name, email, phone, Instagram handle (optional), the items you declare (description, grade, list price, minimum acceptable offer), photographs of those items, and an electronic signature evidence bundle — the signature image itself, the IP address it was signed from, and a timestamp. The signature evidence is kept specifically so the consignment agreement can be shown to be validly signed if ever disputed. Legal basis: performance of the consignment contract (Art. 6(1)(b)) and our legitimate interest in being able to evidence that agreement (Art. 6(1)(f)).

Newsletter

Email address only. Legal basis: your consent (Art. 6(1)(a)), given when you subscribe. You can withdraw it at any time using the unsubscribe link in any newsletter email, or by writing to us.

Book a call

Email, name, and your answers to a short qualification questionnaire (what you are buying or selling, budget or estimated value, timeline). Used to prepare for and schedule the call. Legal basis: steps taken at your request prior to entering a contract (Art. 6(1)(b)).

Waitlist

Email address, linked to the specific item you asked to be notified about. Legal basis: your consent, given by joining the waitlist.

Buyer accounts and saved favourites

Creating an account is never required — everything on this site works without one. If you choose to create one, we collect your email address (verified by the sign-in link we send you; we never store a password because there is none) and the items you save as favourites. This is linked to any details you may already have given us through the forms above, so you can see and edit them in one place. Legal basis: performance of a contract — providing the account you asked for (Art. 6(1)(b)). You can delete your account yourself at any time from the account page: this permanently removes your sign-in identity and your saved favourites. Records of enquiries, offers and purchases you made are business records and are retained as described below under “How long we keep it,” on the basis of our legitimate interest (Art. 6(1)(f)); you can request their erasure separately, subject to the retention obligations described there.

Technical / security data

We log IP addresses briefly, in memory only, to rate-limit abusive form submissions — this is never written to our database and is discarded automatically as each time window elapses. Legal basis: legitimate interest in keeping the site secure and usable (Art. 6(1)(f)).

Cookies and local storage

This site does not use advertising cookies, tracking pixels, or any ad network. Your cart selection is stored locally in your own browser (via localStorage, not a cookie) purely so it survives a page reload; it is never transmitted anywhere unless you submit the checkout form yourself.

We use Vercel Web Analytics and Speed Insights to see aggregate, anonymous traffic and performance metrics (e.g. page views, load times) for the site. These are cookieless by design — they do not set a cookie or use any other persistent identifier to track you, and the data cannot be tied back to an individual visitor.

Who else processes your data

We use a small number of specialist providers to run the site. Each only receives what it needs to perform its specific role, under a data processing agreement:

• Supabase (database, file storage, and authentication), hosted on AWS in Frankfurt, Germany (EU) — stores all the data described above.
• Vercel (hosting and content delivery) — serves the website itself.
• Resend (transactional email) — sends confirmations, reservation instructions, and similar account emails; receives your email address and the content of that specific message.
• Anthropic — used internally when we photograph and catalogue a consigned item, to help our team pre-fill the listing details from the slab photos. This processes item photographs, not buyer personal data.
• Revolut — a card-payment processor for the item deposit. This is not yet active; it will only process your data if and when card deposits are enabled, and only for the payment itself.

Where a provider is located outside the European Economic Area, the transfer is safeguarded by that provider's Standard Contractual Clauses or an equivalent legal mechanism under Art. 46 GDPR.

How long we keep it

• Completed sales, invoices, and consignment settlements: retained for the periods required by Spanish commercial and tax law (generally up to 6 years).
• Consignment agreements and their signature evidence: for the duration of the consignment relationship, plus the applicable statute-of-limitations period for contract claims.
• Offers, reservations, and call requests that do not lead to a sale: kept for a reasonable operational period and deleted when no longer needed.
• Newsletter and waitlist entries: until you unsubscribe or ask us to remove you.

Your rights

Under GDPR, you can ask us to:

• give you access to the personal data we hold about you;
• correct it if it is inaccurate;
• erase it, subject to the retention obligations described above;
• restrict or object to certain processing;
• receive a portable copy of the data you provided to us.

To exercise any of these rights, write to our contact email on the Imprint page. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).

These terms are provided for information; the binding version is confirmed at checkout/submission where applicable.