Privacy Notice

1. Who we are

Untapped Potential TCG (Pty) Ltd ("Untapped Potential", "we", "us"), a private company registered in South Africa, is a trading card game and collectibles store at 63E 3rd Ave, Linden, Randburg, 2195, trading online at untappedpotentialtcg.co.za. We are the "responsible party" under POPIA for the personal information described in this notice. Our company registration number is available on request.

Our PAIA Manual sets out the records we hold and how to request access to them.

2. What personal information we collect

• Identity and contact details: name, email address, phone number, delivery address, billing address.
• Order and delivery information: purchase history, courier preference (PUDO locker, PostNet branch or in-store collection), delivery and tracking details.
• Payment information: we do not store full card numbers. Card payments are processed by Stitch, and we receive only limited transaction data such as payment confirmation, the last four digits, authorisation references and payment status. For EFT payments we receive the payment reference and any proof of payment you send us.
• Event and tournament information: player names, game-specific player IDs (for example Pokémon Player ID or Wizards Event Link details), registrations, decklists where required, and results.
• Marketing information: newsletter and drop-alert subscriptions, store credit and loyalty records, and your communication preferences.
• Website and device information: account login details, order history, IP address, browser and device type, pages visited, items added to your cart, and usage data collected through cookies (see section 6).
• CCTV footage: video recordings of our store premises for safety and security.

3. Children's information

Many of our customers and event participants are under 18. Online accounts and orders are intended for people aged 18 or older, or for a parent or guardian acting on a child's behalf. Where we need to process a child's personal information — for example to register a child for a tournament — we do so with the consent of a parent, guardian or other competent person as required by POPIA, or as otherwise permitted by law. Parents and guardians may contact our Information Officer at any time about their child's information, including to ask us to delete it.

4. How and why we use your information

We process your personal information for the following purposes, on the following lawful bases:

• To process and deliver your orders, take payment, and handle returns, warranties and customer queries — performance of a contract.
• To register you for tournaments and events, run those events, and report results to the relevant game publisher's official event platform where the event is sanctioned — performance of a contract / legitimate interest.
• To operate our store credit and loyalty records and to send newsletters, drop alerts and promotions where you have asked us to — consent. You can unsubscribe at any time.
• To email you about a checkout you started but did not complete, so you can pick it up again — legitimate interest in the context of your purchase. We send at most one of these per checkout, each one tells you how to stop them, and you can tell us at checkout or at any time afterwards that you would rather not receive them.
• To measure how our website and adverts perform, using the analytics and advertising tools described in section 6 — consent, given through our cookie banner.
• To detect and prevent fraud, chargebacks and abuse, including verifying unusual or high-value orders — legitimate interest.
• To keep our store, staff, customers and stock safe through CCTV — legitimate interest.
• To comply with tax, consumer protection, company law and other legal obligations — legal obligation.

What is required and what is optional. To place an order we need your name, email address, and the delivery details for the method you choose — without these we cannot conclude or deliver the sale. Everything else is optional: creating an account, subscribing to marketing, and accepting analytics and advertising cookies. Declining any of those does not affect your ability to browse or buy, and the store works fully without them.

We do not sell your personal information.

5. Who we share it with

We share personal information with the following categories of recipients, who act as our operators under written agreements or as independent parties where the law requires it:

• Hosting and platform: Vercel Inc. (website hosting and edge delivery) and Supabase Inc. (database, authentication and file storage).
• Payments: Stitch (card and instant EFT processing) and our bank.
• Email: Resend (order confirmations, delivery notifications, newsletters and other messages we send you).
• Delivery: PUDO and PostNet, to deliver or hold your parcel.
• Analytics and advertising: Google (Google Analytics 4, and Google sign-in if you use it) and Meta (the Meta Pixel and the Meta Conversions API, which receives purchase events including your email address and phone number in hashed form so Meta can measure our adverts). These only receive information if you accept analytics and advertising cookies.
• Sign-in providers: Google and Discord, if you choose to sign in with them, which tells us your name and email address for that account.
• Marketing audiences: if you have subscribed to our newsletter, we may upload your email address to advertising platforms such as Meta and Google so we can show our adverts to existing subscribers, or exclude you from adverts aimed at new customers. Unsubscribing removes you from these uploads.
• Game publishers and their organised-play platforms, to sanction events and record official results.
• Professional advisers, regulators and law enforcement, where the law requires it or to protect our rights in cases of fraud, chargebacks or disputes.

If our business is sold or merged, your information may transfer to the new owner, and we will tell you if that happens.

6. Cookies and tracking

Some cookies and stored values are needed to make the store work. Analytics and advertising cookies are only set once you press Accept on our cookie banner. If you choose Essential only, nothing in the analytics or advertising rows below is loaded at all, and the store stays fully usable. You can change your mind at any time using the Cookie Preferences link in our footer; withdrawing consent also deletes the analytics and advertising cookies already on your device. The map in our footer is an image we host ourselves, not an embedded Google map, so viewing it tells Google nothing — only clicking through to Google Maps for directions does.

You can also block or delete cookies in your browser settings, though blocking the essential ones will break your cart and sign-in.

7. International transfers

Our hosting, database, email, analytics and advertising providers (Vercel, Supabase, Resend, Google and Meta), and some game publishers' event platforms, store or process information outside South Africa. Where personal information is transferred across borders we do so in accordance with section 72 of POPIA — the recipient is subject to a law, binding corporate rules or a written agreement (including standard contractual clauses) that provides a level of protection substantially similar to POPIA, or the transfer is necessary to perform our contract with you.

8. How long we keep your information

• Orders, invoices and payment records: at least 5 years, as required by tax law.
• Company and accounting records: 7 years, as required by the Companies Act.
• Account details: for as long as your account is open, and after that only where a retention obligation above applies.
• Marketing subscriptions: until you unsubscribe, plus a suppression record so we do not accidentally email you again.
• CCTV footage: 30 days, unless it is needed for an investigation.
• Event and tournament records: for as long as needed for the event and any publisher reporting obligations.

After these periods records are deleted or de-identified.

9. How we protect your information

• Payment card details are handled by Stitch, not stored on our systems.
• Our database enforces row-level access rules, so customers can only reach their own records and staff only what their role permits.
• Newsletter addresses are stored encrypted.
• Traffic to and from our site is encrypted in transit, and access to staff systems is restricted and permission-controlled.
• Access to CCTV footage is restricted, and staff are under confidentiality obligations.

No online system is completely secure. If a security compromise occurs that affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

10. Your rights and how to use them

You have the right to:

• Ask what personal information we hold about you, and get a copy of it.
• Ask us to correct information that is wrong or out of date.
• Ask us to delete your personal information.
• Object to processing based on legitimate interest, and withdraw consent where we rely on consent.
• Opt out of direct marketing at any time — our newsletter and drop-alert emails each carry an unsubscribe link, and for anything else you can email us and we will stop. Emails about an order you have placed are part of that order rather than marketing, so those are not something you can opt out of while the order is open.
• Lodge a complaint with the Information Regulator (see section 11).

About deletion. We will delete what we can, but the law does not let us delete everything on request. Where you have placed orders, we must keep the order, invoice and payment records for the retention periods in section 8. In practice that means we will remove your login, delete your marketing subscriptions and wishlists, and stop using your information for anything other than those retained records. We will tell you exactly what we have kept and why.

To use any of these rights, contact our Information Officer at untappedpotentialtcg@gmail.com. POPIA requests are made on the Regulator's prescribed forms (Form 2 for access to a record, Form 3 to object to processing, Form 4 to request correction or deletion), which you can get from inforegulator.org.za or from us. We may ask for proof of identity before acting, and we will respond within 30 days. Access to records under PAIA follows the process in our PAIA Manual.

11. Complaints

If you are unhappy with how we handle your personal information, please contact us first so we can try to put it right. You may also complain to the Information Regulator (South Africa):

• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• PO Box 31533, Braamfontein, 2017
• Email: POPIAComplaints@inforegulator.org.za or enquiries@inforegulator.org.za
• Website: https://inforegulator.org.za

12. Third-party links

Our site links to third-party websites (for example game publishers such as Wizards of the Coast and The Pokémon Company, and courier tracking pages). Those sites have their own privacy notices and we are not responsible for their practices.

13. Changes to this notice

We may update this notice from time to time. The latest version is always available on this page and in-store. If we make a significant change to how we use your information, we will tell you.