TCGplayer will honor the rights of all data subjects regarding their personal data, including the right to be forgotten (covered under the General Data Protection Regulation or "GDPR"), when the data is no longer needed for its original purpose or the user withdraws their consent.
When a customer asks TCGplayer that they be forgotten, we will terminate their TCGplayer account and delete their personal data (e.g. name, email address, shipping address, telephone number) from our systems. We will complete data deletion within 30 days for those in the European Union (EU) and within 90 days for non-European users barring any pending transactions, customer service, or fraud-related activity.
We will delete backup copies of that personal data from our archives as soon as is practically possible, to the extent allowed by our other data retention obligations (e.g. to protect other data stored in the same backup archives, or meet other regulatory or legal requirements). As soon as those obligations have been fulfilled, we will permanently delete those archives as quickly as possible.
TCGplayer will also retain audit logs showing the history of all operations on the customer’s personal data for the period required by legal obligations. Certain items the user might consider personal data (e.g. customer feedback may be retained according to the Terms of Service that the user agreed to when they posted). TCGplayer will always take reasonable steps to keep all personal data secure and inaccessible to unauthorized individuals.