Privacy policy

Lichcards processes personal data of customers and visitors of lichcards.nl. This privacy policy explains which data we collect, why we do so, who we share it with, how long we keep it and which rights you have. In doing so we comply with the General Data Protection Regulation (GDPR).

1. Who is responsible for your data

Lichcards is the controller for the data described in this policy.

Lichcards
De Trompet 18C
1601 MK Enkhuizen
The Netherlands

E-mail: info@lichcards.nl
Telephone: +31 85 744 4550
Chamber of Commerce (KvK) number: 86527789
VAT identification number: NL004270747B85

We do not have a data protection officer. If you have a question about your data, e-mail info@lichcards.nl; your question will reach us directly.

2. Which data we process

What we process depends on what you do with us. This may include:

  • Name, e-mail address, telephone number, billing address and delivery address
  • Order data: which items you order, the order number, the amount and the status of your order
  • Payment data: the chosen payment method and the confirmation of the payment. Full card details never reach us; they are processed by the payment provider
  • Account data if you create a customer account, including your order history and saved addresses
  • Your loyalty points balance and the changes to it
  • Correspondence with our customer service, and the content of complaints and return requests
  • Reviews you leave, with your name or the display name you choose yourself
  • Data you enter when you want to sell cards to us: your card list, your contact details, photos of cards and your payout details
  • Technical data about your visit: IP address, device and browser type, pages viewed and cookie identifiers

3. What we use your data for and on which legal basis

We only process your data for the purposes listed below, and always on one of these legal bases: the performance of the contract with you, compliance with a legal obligation, your consent or our legitimate interest.

  • Handling your order — processing, packing, shipping, invoicing and handling returns. Basis: performance of the contract.
  • Processing payments and preventing fraud — basis: performance of the contract and our legitimate interest in preventing misuse.
  • Customer service — answering your questions, complaints and warranty claims. Basis: performance of the contract and our legitimate interest in good service.
  • Managing your customer account and loyalty points — basis: performance of the contract.
  • Buying cards from you — assessing your offer, making a bid and paying you out. Basis: performance of the contract and the steps preceding it.
  • Asking you for a review — after delivery we ask you how you liked it. Basis: our legitimate interest in improving our shop and our range. You can opt out of this.
  • Sending our newsletter — basis: your consent.
  • Statistics and advertising — measuring how the site is used and showing advertisements. Basis: your consent via the cookie banner.
  • Keeping our records — basis: our legal obligation to retain tax records.

4. Your order: webshop, payment and records

Our webshop runs on Shopify. Shopify is our processor and stores your order, account and contact data for us so that we can handle your order.

Payments are processed via Shopify Payments and via external payment methods, including Klarna. These parties process your payment data and carry out their own checks where necessary, for example for pay-later options. They are themselves responsible for the data they process and have their own privacy policies. We only see that and how you paid, not your full card or bank account details.

Invoices and payment data are part of our financial records. We keep them for as long as the law requires.

5. Shipping and returns

We ship with PostNL and process our shipments and return labels via Sendcloud. For this we pass on your name, address, e-mail address and telephone number. This data is needed to deliver your parcel and to send you track-and-trace notifications.

For a return we additionally process your order number, the reason for your return and, if you send them, photos of the item.

6. Ratings and reviews

We use our own review system, which runs on a Cloudflare Worker. After your order has been delivered, we automatically send you an e-mail asking whether you would like to leave a review. That system stores your e-mail address, your order number and the rating you give. The e-mail is sent via Resend, from the subdomain send.lichcards.nl.

Don't want to receive such an invitation? Let us know via info@lichcards.nl and we will add you to the exclusion list.

For product reviews we also use Judge.me. If you leave a review there, your name or display name, your e-mail address and your review are processed by Judge.me.

On the site we also show our scores and reviews from Google Reviews and Trustpilot. We retrieve the overall scores daily via the Google Places API. This happens at fixed times from our own environment and not from your browser, so no data about you is sent to Google in the process. If you leave a review at Google or Trustpilot yourself, you do so directly with that party. They are then responsible for your data and have their own privacy policies.

7. Loyalty points

We have our own loyalty points system, available at lichcards.nl/apps/spaarpunten. That system links your points to your customer account and stores your customer number, your balance and the changes to it, such as points you earn with an order and points you redeem.

You only have loyalty points if you have a customer account. If you delete your account, your points expire. Points that have not been used for 720 days expire automatically.

8. Selling cards to Lichcards

If you want to sell cards to us, you use our own buying tool. In it we store the card list you submit, your contact details, the photos of your cards that you upload and the payout details you provide, such as your bank account number and the name of the account holder.

We use this data to assess your offer, make a bid, check the cards we receive and pay you out. Payout details then become part of our records and are subject to the statutory retention obligation. If no purchase takes place, we delete your submission and the photos within a reasonable period.

9. Newsletter

If you subscribe to our newsletter, we use your e-mail address and your name to send you offers, new releases and shop news. We do this on the basis of your consent.

You can unsubscribe at any time via the unsubscribe link at the bottom of every newsletter or by e-mailing info@lichcards.nl. We will then remove you from our mailing list.

10. Statistics and advertising

To understand how our site is used and to advertise our products, we use Google Analytics and Google Ads. Our products are also listed in the Google Merchant Center, which we connect via the Google & YouTube sales channel in Shopify. We also use our own product feed pixel to measure which products from our feed are viewed and purchased.

This involves processing data about your visit, such as your IP address, the pages you view, the products you view and whether you complete an order. These processing activities only take place if you have given consent for them in the cookie banner.

11. Cookies and consent

Cookies are small files that are stored on your device. We use three types:

  • Necessary cookies — needed to make the site work, for example to remember your shopping cart, keep you logged in and secure the site. No consent is required for these.
  • Analytical cookies — to measure how the site is used.
  • Marketing cookies — to show advertisements and measure their effect.

For analytical and marketing cookies we ask your consent via the cookie banner you see on your first visit. You can change your choice at any time via the cookie settings on the site, and you can always delete cookies via your browser settings. Withdrawing your consent does not affect processing that has already taken place.

12. Who we share your data with

We never sell your data. We only share it with parties that help us run the shop, and only to the extent necessary. We conclude a data processing agreement with processors.

  • Shopify — webshop platform, order and account data
  • Shopify Payments and external payment providers, including Klarna — payments
  • Sendcloud and PostNL — shipping and return labels
  • Cloudflare and Resend — our own review system and its e-mails
  • Judge.me — product reviews
  • Google — Analytics, Ads, Merchant Center and the Places API
  • Our accountant and, only if there is really no other way, a debt collection agency or legal adviser

In addition, we may disclose data if we are legally obliged to do so, for example to the Dutch tax authorities or to a law enforcement agency on the basis of a valid request.

13. Transfers outside the European Economic Area

Some of the parties above are established outside the European Economic Area or use servers outside it, in particular in the United States and Canada. This applies, among others, to Shopify, Google, Cloudflare and Resend.

Where a transfer outside the EEA takes place, we ensure that there is a valid legal basis for it. We rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the European Commission's standard contractual clauses, supplemented with appropriate additional measures.

14. How long we keep your data

We do not keep your data longer than necessary for the purposes for which we collected it.

  • Order, invoice and payment data: 7 years. This is the statutory retention period for our records.
  • Customer account data: as long as your account exists. If you delete your account or ask us to do so, we delete your account data, except for data that falls under the statutory retention obligation.
  • Loyalty points: points expire 720 days after they were last used or earned. We delete the associated records when your account is deleted.
  • Review data: as long as the review is on the site. If you ask for removal, we take it down.
  • Newsletter data: until you unsubscribe.
  • Buying submissions that do not lead to a purchase: we delete the submission and the photos within a reasonable period after completion.
  • Customer service correspondence: up to 2 years after your question or complaint has been resolved, so that we can look back if you come back to it later.
  • Cookie data: depends on the cookie; the retention periods are listed in the cookie banner.

15. How we protect your data

We take appropriate technical and organisational measures to protect your data against loss and unlawful use. Our site works entirely over a secure connection (HTTPS), access to customer data is limited to the people who need it for their work, and we only work with suppliers who apply appropriate security themselves.

Do you think something is going wrong with your data, or have you spotted a vulnerability? E-mail info@lichcards.nl and we will look into it.

16. Your rights

You have the following rights regarding your personal data:

  • Access — you may ask which data we hold about you.
  • Rectification — if your data is incorrect, we will correct it.
  • Erasure — you may ask us to delete your data, unless we are legally required to keep it.
  • Restriction — you may ask us to temporarily suspend processing, for example if you dispute the accuracy of data.
  • Objection — you may object to processing based on a legitimate interest, such as our review request.
  • Data portability — you may receive the data you provided to us in a common digital format, or have it transferred.
  • Withdrawing consent — if you have given consent, you may withdraw it at any time.

You exercise these rights by e-mailing info@lichcards.nl. State clearly what you want. We may ask you to identify yourself so that we can be sure we are giving the data to the right person. We respond within one month. If your request is complex, we may extend that period by two months; we will let you know within the first month. There is no charge for a request.

17. Filing a complaint with the Dutch Data Protection Authority

If you disagree with how we handle your data, please contact us first at info@lichcards.nl. We would like to resolve it together.

If we cannot work it out together, you have the right to file a complaint with the supervisory authority, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). You can do so via autoriteitpersoonsgegevens.nl. If you live in another EU country, you can also contact the supervisory authority of your own country.

18. Changes to this privacy policy

We amend this privacy policy when our working methods or the law give reason to do so. The current version is always on this page. In the case of a significant change, we will let you know on the site or by e-mail.

Last modified: 16 August 2026.