Privacy policy - Inner Circle Grading

You send us cards, we submit them to a grading company and then send them back to you. To do that, we need a limited set of data from you: your name, address, contact details, what you submit and what you pay.

Four things are good to know in advance:

1. Your cards go abroad, including to the United States. Your name and submission details go with them, because otherwise the grading company cannot link the shipment to you.

2. We take photos and videos of every submission. That is our evidence in the event of damage, loss or a dispute. A separate regime applies to use on social media: we do that anonymously, or with your express consent.

3. We do not sell your data and we do not send you advertising emails. From us you only receive messages about your own submission.

4. You can always request, correct or delete your data. How that works is set out in Article 12.

Everything is set out in detail below.

Article 1 — Who is responsible for your data

Inner Circle Grading (hereinafter: ICG) is the controller for the data described in this statement.

Legal form: Sole proprietorship
Business address: Tabakvest 87, bus 4908, 2000 Antwerpen
Company number: 1035315147
VAT identification number: BE1035315147
Email: info@innercirclegrading.com
Phone/WhatsApp: +32456912538
Website: www.innercirclegrading.com

ICG is not required to appoint a data protection officer. We do not process personal data on a large scale and we do not process special categories of personal data. For all questions about privacy, you can contact the email address above.

Article 2 — Which data we process

2.1 Data you provide to us yourself

1. Identification and contact details: first and last name, delivery address, billing address, email address, phone number.

2. Submission details: the number and description of the cards submitted, the service category chosen and the grading company chosen, the value per card stated by you, and any particulars or instructions you send with them.

3. Payment details: the invoice amount, the payment method chosen, the payment reference and the payment status. We do not receive full bank account or card details; those are processed directly by our payment service provider.

4. Correspondence: the content of your emails, WhatsApp messages, contact forms and messages via social media, including any attachments and photos.

5. Data of business customers: company name, KvK or KBO number, VAT number and the name, position and contact details of the contact person.

6. Identity data, solely in the cases described in Article 6.

2.2 Data generated during performance of the service

1. Registration data: the submission number, the date of receipt, the number of cards established and the condition established.

2. Visual material: photos and video recordings of your cards and of the packaging, made on receipt, during any handling and on return shipment.

3. Status data: the progress of your submission, the shipping dates, track-and-trace codes and the outcome of the grading.

4. Damage and complaint files: reports, photos, correspondence and, where applicable, the communication with the carrier, grading company or insurer.

2.3 Data collected automatically

When you visit our website, technical data is processed, such as your IP address, browser type, the pages visited and the time of your visit. See Article 11.

2.4 Data we receive from others

We receive data about your submission from the grading company, from carriers (delivery status), from our payment service provider (payment status) and, if you use a drop-off point, from that drop-off point (your name and the submission number at hand-in).

Article 3 — What we use your data for and on what legal basis

We process your data solely for the purposes listed below. For each purpose, we state which legal basis under Article 6 GDPR we rely on and how long we keep the data.

Purpose	Data	Legal basis	Retention period
Processing your order and performing the service: receipt, registration, submission to the grading company, return shipment	Contact, submission, registration and status data	Performance of the contract (Art. 6(1)(b))	Duration of the assignment, then 24 months
Communicating with you about your submission	Contact details and correspondence	Performance of the contract (Art. 6(1)(b))	24 months after the last contact
Handling payments, invoicing and keeping the accounts	Contact and payment data, invoice	Legal obligation (Art. 6(1)(c)), statutory tax retention requirement	7 years after the end of the financial year
Customs declarations and international shipping	Name, address, description and stated value	Legal obligation (Art. 6(1)(c))	7 years
Recording evidence of the number and condition of cards on receipt, processing and return	Visual material and registration data	Legitimate interest (Art. 6(1)(f)): evidentiary position in case of damage, loss and disputes	24 months after completion; longer in the case of a pending claim
Handling complaints, damage claims and insurance files	Complaint file, visual material, correspondence	Performance of the contract and legitimate interest (Art. 6(1)(b) and (f))	5 years after settlement
Preventing fraud, theft and counterfeiting	Submission details, visual material, identity data	Legitimate interest (Art. 6(1)(f)): protection of the property of third parties and of our business	See Article 6
Showing cards and results on our website and social media	Visual material, and only with consent your name or account	Consent (Art. 6(1)(a)) for identifiable use; legitimate interest for anonymous use	Until consent is withdrawn
Operating, securing and improving our website	Technical and usage data	Legitimate interest (Art. 6(1)(f))	Maximum 12 months
Defending our rights or collecting claims	All relevant data from the file	Legitimate interest (Art. 6(1)(f))	Until settlement, then the statutory limitation period

Where we rely on a legitimate interest, we have weighed your interests against it. You can object to such processing; see Article 12.

Article 4 — Visual material, social media and consent

1. We record every submission photographically and, where necessary, on video. We do not do this for promotional reasons but because it is our evidence: in a discussion about the number of cards, about the condition on receipt or about transport damage, this material is decisive. This recording is a legitimate interest and is made for every submission.

2. A stricter regime applies to use on our website, Instagram, TikTok and other channels. We only publish visual material of your cards:

a. anonymously, that is, without your name, username, address, submission number or other data by which you can be recognised; or

b. with your express, prior consent, when we do want to mention or tag you.

3. A card itself is not personal data. However, in combination with other information, a submission can be traceable to you, for example in the case of a rare card or a striking collection. If in doubt, we ask for consent.

4. You can withdraw your consent at any time via info@innercirclegrading.com. We will then remove the material concerned from our own channels within a reasonable period. Withdrawing consent has no retroactive effect and does not affect the recording for evidentiary purposes referred to in paragraph 1.

5. We cannot guarantee that material that has been shared, downloaded or reposted by others will also disappear from those others. We make an effort to request removal where that is reasonably possible.

6. When you send us photos or videos yourself, we assume that you are entitled to use them. If other people appear in them, we ask you to make them unrecognisable beforehand.

Article 5 — Communication via WhatsApp and social media

1. You can reach us via WhatsApp. WhatsApp is a service of Meta Platforms Ireland Limited. When you contact us via WhatsApp, Meta processes your phone number and metadata about the message in accordance with its own terms and privacy policy, over which we have no influence. The content of messages is encrypted during transmission.

2. The same applies to messages you send us via Instagram or TikTok: those channels are operated by Meta Platforms and TikTok Technology Limited respectively, which process data as independent parties.

3. If you want to avoid this, you can always reach us by email at info@innercirclegrading.com.

4. Messages that are relevant to your submission are included in the file for that submission and kept in accordance with Article 3. We keep other messages for no longer than 24 months after the last contact.

5. We do not use your phone number for advertising, offers or group messages.

Article 6 — Identity checks for high-value submissions

1. For submissions with a high stated value, or where there is reasonable doubt about the origin or ownership of a card, we may ask for proof of identity or proof of purchase. We do this on the basis of our legitimate interest: preventing us from taking part in the processing of stolen or counterfeit goods, and protecting you, third parties and our business.

2. In doing so, we process no more data than necessary. Specifically:

a. we ask you to cover the citizen service number (BSN) or national register number and the passport photo;

b. we ask you to cover the machine-readable zone (MRZ) at the bottom of the document;

c. we record only that the check took place, on which date, and which type of document was shown.

3. We do not keep a copy of your proof of identity. We delete it immediately after the check and in any event within four weeks. Only the record referred to in paragraph 2(c) remains in the file, for 24 months.

4. If there is a reasonable suspicion that a card originates from a crime or is counterfeit, we may share data with the competent authorities or with the rights holder. This is a legal obligation or an overriding legitimate interest. In that case, we may not be permitted to inform you about this in advance.

5. When you ask us for access to or deletion of your data (Article 12), we do not ask for a copy of your proof of identity. We establish your identity via the email address or phone number that is already known to us, or via data from your file.

Article 7 — Customers under 16 years of age

1. Collecting cards is a hobby enjoyed at any age. We are aware that our customers also include young people.

2. For processing that is based on consent — in practice mainly showing cards with a name credit on social media (Article 4(2)(b)) — a young person under 16 cannot give that consent independently. In that case, we ask for consent from a parent or legal representative, or we publish the material anonymously.

3. For Belgian customers, this age limit is 13. We apply the strictest standard and assume 16, unless it is clear that Belgian law applies.

4. A minor under 18 years of age in principle needs the consent of a parent or legal representative to place an order. We assume that this consent is present when an order is placed.

5. If you believe that we have processed a minor’s data without the required consent, please contact us via info@innercirclegrading.com. We will then delete that data as soon as possible, insofar as we do not need it to perform the contract or to comply with a legal obligation.

Article 8 — Business customers, dealers and contact persons

1. If you work with us on behalf of a company, we process, in addition to the company details, the name, position, business email address and phone number of the contact person. That is also personal data.

2. The legal basis is the performance of the contract with your business, and our legitimate interest in workable contact.

3. If you send us data of your own customers — for example in a collective submission on behalf of third parties — you are yourself the controller for that data. You guarantee that you may lawfully provide that data to us and that you have informed your own customers about it. We process that data solely to perform your assignment.

4. Contact persons of business customers have the same rights as other data subjects; see Article 12.

Article 9 — Who we share your data with

We do not sell your data and do not provide it to third parties for their own marketing purposes. We share data solely with the following parties, and only insofar as necessary:

Recipient	Purpose	What we share
Grading companies: Beckett Grading Services (United States and Germany) and PSA / Collectors (United States and Europe)	Assessment and certification of your cards	Name, submission details, stated value, ICG’s return address
mijn.host B.V. (Amsterdam)	Hosting of the website and web shop, and e-mail	Account, order and contact data
Mollie B.V. (Amsterdam)	Payment processing	Name, email address, invoice amount and payment reference
Billit (Belgium)	Preparing and sending invoices	Name, address, e-mail address, telephone number, VAT number (for business customers) and order and invoice details
Carriers, including (PostNL / DHL / FedEx / UPS)	Shipping and return shipping	Name, address, phone number, description of contents
MyParcel (Netherlands)	Creating shipping labels and track & trace	Name, address and, where provided, company name, e-mail address and telephone number
Customs authorities and customs brokers	Declarations required by law on import and export	Name, address, description and stated value
Insurers, loss adjusters and intermediaries	Handling of a damage or loss claim	File data, visual material and correspondence
Drop-off points	Hand-in and collection of cards	Name and submission number
Meta Platforms Ireland Limited and TikTok Technology Limited	Communication via WhatsApp, Instagram and TikTok	Phone number or account name and the content of the message
Our bookkeeper, accountant and, if necessary, legal adviser or debt collection agency	Administration, advice and debt collection	The data required for this
Competent authorities	Only when we are legally required to do so, or in the case of a suspicion as referred to in Article 6(4)	The data required for this

With parties that act solely on our instructions, we conclude a data processing agreement. Grading companies, carriers, payment service providers and insurers partly determine their own purposes and means; for that processing they are independently responsible and apply their own privacy policies.

Article 10 — Transfers outside the European Economic Area

1. To be able to provide our service, transfer to countries outside the European Economic Area is unavoidable. Your name and submission details go with the shipment, because otherwise the grading company cannot link the cards to you. This concerns in particular the United States: Beckett Grading Services and PSA are established there. Meta and TikTok also process data outside the EEA.

2. For these transfers, we rely on the safeguards of Chapter V GDPR:

a. the adequacy decision of the European Commission for the EU-US Data Privacy Framework, insofar as the receiving party is certified under it; and/or

b. the standard contractual clauses adopted by the European Commission, supplemented by an assessment of the circumstances in the receiving country and, where necessary, additional measures.

3. We limit transfers to what is necessary. We do not send payment details, identity data or correspondence to a grading company.

4. You can request from us a copy or a description of the safeguards that apply to a specific transfer, via info@innercirclegrading.com.

5. If you do not want your data to be transferred to the United States, we cannot submit your submission to a US grading company. We will then gladly discuss whether a European branch or an alternative service offers a solution.

Article 11 — Website and cookies

1. Our website runs on WordPress with WooCommerce.

2. We do not use analytics, tracking or marketing cookies. For that reason we do not show a cookie notice.

3. The website only places cookies that are strictly necessary for the site to work: remembering your language choice, your shopping cart and checkout, and keeping you logged in to your account. No consent is required for these.

4. Our website may contain links to third-party websites, including the grading companies and our social channels. Those websites are governed by their own privacy policies; we are not responsible for them.

Article 12 — Your rights

1. You have the following rights with regard to your personal data:

a. Access: you can request which data we process about you and receive a copy of it.

b. Rectification: you can have inaccurate data corrected and incomplete data completed.

c. Erasure: you can ask us to erase your data, insofar as we do not need it to perform the contract, for a statutory retention obligation or to substantiate a legal claim.

d. Restriction: you can have the processing restricted, for example while we assess an objection or a dispute about accuracy.

e. Objection: you can object to processing that is based on a legitimate interest. We will then stop that processing, unless we have compelling legitimate grounds that override your interests.

f. Data portability: you can receive, or have transferred, in a commonly used file format, the data that you yourself have provided to us and that we process by automated means on the basis of consent or contract.

g. Withdrawal of consent: where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of the processing before the withdrawal.

2. You can submit a request via info@innercirclegrading.com. Please state as clearly as possible what your request concerns and, where applicable, your submission number.

3. We respond within one month of receipt. If your request is complex or we receive multiple requests, we may extend that period by two months. We will let you know within the first month.

4. There is no charge for a request. In the case of manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse the request, stating our reasons.

5. To prevent us from providing data to the wrong person, we establish your identity in the manner described in Article 6(5).

Article 13 — Complaints and supervision

1. If you disagree with the way we handle your data, please let us know first via info@innercirclegrading.com. We would much prefer to resolve any issue ourselves.

2. You also always have the right to lodge a complaint with a supervisory authority:

Netherlands: Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ Den Haag — www.autoriteitpersoonsgegevens.nl
Belgium: Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussel — www.gegevensbeschermingsautoriteit.be

3. If you live in another member state of the European Union, you can turn to the supervisory authority of your own country.

4. You also have the right to take the matter to court.

Article 14 — Security

1. We take appropriate technical and organisational measures to protect your data against loss and against unlawful processing. These include in any event:

a. encrypted connections (TLS) on our website and when transmitting data;

b. access to files and visual material solely for persons who have a functional reason for it;

c. two-factor authentication on the accounts with which we manage the webshop, the email and the administration;

d. physical security of the space where cards and submissions are stored;

e. regular backups of our administration.

2. Our service providers are contractually bound to a comparable level of security.

3. If you discover a vulnerability or a possible leak, please report it via info@innercirclegrading.com. We take such reports seriously and respond as quickly as possible.

4. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will report it within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). In the event of a high risk, we will also inform you directly.

Article 15 — No automated decision-making

We do not make decisions about you that are based solely on automated processing and that have legal effects or similarly significant effects on you. We do not create profiles to predict your behaviour or preferences. The assessment of your cards is carried out by human graders at the grading company and is not processing of your personal data.

Article 16 — Retention periods in brief

Data	Period
Invoices, payment and accounting data	7 years after the end of the financial year (statutory tax retention requirement)
Customs documentation	7 years
Submission file, registration and visual material	24 months after completion of the submission
Correspondence by email, WhatsApp or social media	24 months after the last contact
Damage, complaint and insurance files	5 years after settlement
Record of an identity check	24 months; the copy itself is deleted within 4 weeks
Visual material on social media with consent	Until consent is withdrawn
Website data	Maximum 12 months

In the event of an ongoing dispute, an ongoing claim or legal proceedings, we keep the relevant data for longer, until that matter has been settled and the statutory limitation period has expired.

Article 17 — Changes to this statement

1. We may amend this privacy statement, for example when our services change or when legislation gives cause to do so.

2. The current version is always available at www.innercirclegrading.com. At the top of this statement you will find the version number and the effective date.

3. In the event of a material change, we will inform existing customers by email.

Article 18 — Contact

Questions about this privacy statement, about your data or about a request as referred to in Article 12:

Inner Circle Grading
Tabakvest 87, bus 4908, 2000 Antwerpen
Email: info@innercirclegrading.com
Phone/WhatsApp: +32456912538