Last updated: 19 July 2026
Who is responsible for your data
Retro Relics Comics is a sole trader business run by Lee, based in Teesside, England. That means one person is the data controller and the same person answers your emails.
For anything in this policy, including exercising any of the rights below, contact lee@retrorelicscomics.co.uk.
What I collect, and why I am allowed to
Under UK GDPR I have to have a lawful basis for using your data, not just a reason. Here is every category, set out honestly rather than as a list of everything I could conceivably gather.
| What | When | Why | Lawful basis |
|---|---|---|---|
| Name, email address | You create an account or use the contact form | To run your account, reply to you, and send service emails about things you have asked for | Contract |
| Name, email, phone, rough location, photos of your comics | You request a valuation or send a collection to look at | To value your comics and get back to you with an offer | Legitimate interests, and steps taken at your request before any contract |
| Delivery address, order details | You buy something from the shop | To take payment, post your order and handle returns | Contract, and legal obligation for keeping sales records |
| Email address only | You sign up to the newsletter | To send the newsletter, nothing else | Consent, withdrawn any time via the unsubscribe link |
| Your eBay account connection, and the photos and listing details you upload | You use the eBay listing tool | To write your listings and put them on eBay for you | Contract |
| Your inventory, costs and sales figures | You use the profit tracker | To show you your own numbers | Contract |
| Subscription status and payment records | You subscribe to a paid tool | To manage your subscription and meet tax and accounting duties | Contract, and legal obligation |
| Pages visited, rough location from IP, device type | You browse the site with analytics cookies accepted | To see which pages are useful and fix what is not | Consent |
What I never collect
I do not see or store your card details. Payments go directly to Stripe, who are a regulated payment provider, and I only ever see the last four digits and whether it worked. I do not buy personal data from anyone, I do not build advertising profiles, and I do not sell your information. Not as a policy position, I simply have no interest in doing it.
Who else your data touches
Running this site means using other companies for hosting, payments and so on. Here is what each one is for and exactly what they get. Where the name itself is the reassurance, I have named them.
| Who | What they do | What they get |
|---|---|---|
| Stripe | Takes payments | Payment and billing details, given by you directly to them |
| Anthropic | Writes listing drafts using AI | Photos of comics and the notes you add. Not used to train their models |
| eBay | Where your listings go | Whatever your listing contains, sent on your instruction |
| Analytics and fonts | Usage data if you accept analytics cookies, and your IP address when fonts load | |
| Hosting and website infrastructure | Runs the site and keeps it online | Technical logs including IP addresses |
| Database and accounts provider | Stores your account and anything you save in the tools | Your account details and your saved data |
| Image hosting provider | Stores photos | Photos you upload |
| Email delivery provider | Sends emails | Your email address and the contents of the email |
| Queue provider | Holds listing jobs for a short time while they are processed | Listing jobs, including an encrypted copy of your eBay access token |
Where a category is given rather than a company name, that is the level of detail data protection law asks for. If you want the specific providers before deciding whether to use the tools, email me and I will tell you.
I share your data with law enforcement or a regulator only where I am legally required to. If I am ever compelled to hand over your information I will tell you, unless the law forbids it.
Data leaving the UK
Several of those companies are based in the United States, so your data does travel outside the UK. Where it does, transfers rely on the UK International Data Transfer Addendum or the equivalent standard contractual clauses, which is the legal mechanism designed for exactly this. If that is a dealbreaker for you, say so and I will tell you honestly which parts of the service you could still use.
A note about your eBay connection
When you connect eBay, I never see your eBay password. eBay gives the tool a token instead, that token is encrypted before it is stored, and it can only do the things you approved when you connected. You can disconnect at any time from your eBay account settings or from the tool, and the token is destroyed when you do.
Cookies
The site uses two kinds. Essential cookies keep you logged in and keep your basket working, and the site cannot function without them. Analytics cookies, through Google Analytics, tell me which pages people actually read. Those are optional and only run if you accept them. You can change your mind at any time by clearing your cookies, and nothing about the site stops working if you decline.
How long I keep things
- Account details: while your account is open, then twelve months after you close it in case you come back.
- Sales and payment records: six years after the tax year they fall in, because HMRC requires it. This one I cannot delete on request.
- Valuation enquiries and photos: twelve months, then deleted.
- Photos uploaded to the listing tool: deleted once eBay has its own copy, usually within days. Photos published to the shop are kept while that item is listed.
- Newsletter email: until you unsubscribe.
- Analytics: fourteen months.
Keeping it secure
Everything runs over HTTPS. Passwords are hashed by the accounts provider and I never see them. eBay tokens are encrypted before storage. Access to the admin side is restricted to me. Payment card data never reaches my systems at all.
I am not going to claim this is unbreakable, because nobody can honestly claim that. What I can say is that if there is ever a breach affecting your data I will tell you and the ICO within 72 hours, as the law requires, rather than hoping nobody notices.
Your rights
Under UK GDPR you can ask me to:
- Tell you what data I hold about you, and give you a copy.
- Correct anything that is wrong.
- Delete your data, where I am not legally required to keep it.
- Restrict or object to how I use it, including any use based on legitimate interests.
- Send your data to you or another service in a portable format.
- Withdraw consent at any time, where consent was the basis.
Email lee@retrorelicscomics.co.uk and I will respond within one month. There is no charge. You do not have to give a reason, and asking will not affect how I deal with you. If you think I have got something wrong, you also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Children
This site is not aimed at under 16s and I do not knowingly collect their data. If you are a parent and think I have, email me and I will delete it.
Changes to this policy
If I change anything meaningful I will update the date at the top, and if the change affects how your data is used I will email account holders rather than quietly editing the page and calling it notice.
Anything here you want explaining?
If a line in this policy does not make sense, that is my fault rather than yours. Ask and I will explain it properly.
Get in touch