Privacy policy

We are the data controller for the personal information described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Your account. Your name, email address and password. Your password is stored only as a scrambled one-way hash — nobody here can read it.

Your contact and delivery details. Phone number and postal address, so we can reach you about your cards and send them back.

Your submissions. The cards you send, the values you declare for them, any notes you add, the services you choose, and the tracking numbers for parcels in both directions.

Payments. The amount, what it was for, and a payment reference. Card payments are taken by SumUp; we never see or store your card number.

Photographs. We photograph parcels when they arrive, and your cards and slabs as we work on them. These show the cards, not you.

Messages. Copies of the emails we send you about your submissions, and anything you send us.

Affiliate applications. If you apply to become an affiliate: your name, email, phone number, address, business name, the platform you sell on, and our decision.

Technical information. When you sign in we record the IP address and browser your session was started from, to keep your account secure. Our web server keeps a short rolling log of requests (IP address, time and page) to keep the site running and investigate abuse; it is overwritten as it fills, usually within a few weeks.

• To provide the grading service you asked for — booking your cards in, grading them, keeping you updated, taking payment and returning them. Our legal basis is that this is necessary for our contract with you.
• To keep financial records that tax law requires. Our legal basis is legal obligation.
• To keep the site and your account secure, prevent fraud, and deal with disputes. Our legal basis is our legitimate interest in running a safe, honest service.
• To consider an affiliate application and run the arrangement if it is approved. Our legal basis is taking steps towards, and performing, a contract with you.

The emails we send are about your submissions and your account. We do not send marketing emails; if that ever changes, we will ask you first.

Every graded card has a public certificate page and is counted in our population report, so anyone can check a slab is real. These show the card — its name, set, number, grade, subgrades and photographs of the slab. They never show who sent it, or anything else about you.

We do not sell your information. We share it only with:

• SumUp, which processes card payments;
• couriers, which need your name and address to deliver your cards back to you;
• the companies that host our website and send our email, which handle it only on our instructions;
• HMRC, the police or a court, where the law requires us to;
• our professional advisers, such as accountants, where they need it.

Where one of these providers handles information outside the UK, we make sure it is protected by safeguards the law recognises, such as the UK International Data Transfer Agreement or an adequacy decision.

• Your account — for as long as it is open. Ask us to close it and we will, subject to the records below.
• Submissions, payments and the emails about them — six years from the end of the financial year they belong to, because tax law requires us to keep them.
• Certificates and their photographs — permanently, because they are how a slab is verified for as long as it exists. They contain nothing about you.
• Sign-in sessions — until they expire or you sign out.
• Affiliate applications — for as long as the arrangement lasts, then six years for the payment records; a declined application for up to a year.

Our site only runs over an encrypted connection. Passwords are hashed. Staff see only what their job needs, through role-based permissions. Photographs are served through links that expire, and our database is backed up daily.

You have the right to:

• get a copy of the personal information we hold about you;
• have anything wrong corrected — you can change most of it yourself in your account;
• have your information deleted, where we no longer need to keep it;
• restrict or object to how we use it;
• receive the information you gave us in a format you can take elsewhere.

To use any of these, email support@beyondcardgrading.com or use our contact page. There is no charge, and we will reply within one month. We may need to confirm it is really you first.

If you are unhappy with how we have handled your information, please tell us. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

We use only the cookies the site needs to work — to keep you signed in and to remember your place in the submission form. No analytics, no advertising, and nothing that follows you around the web. The details are in our cookie notice.

Our service is for adults. If you are under 18, please ask a parent or guardian to submit cards for you.

If we change how we use your information, we will update this page and the date at the top. If a change is significant, we will tell you by email before it takes effect.