Last updated: [29 October 2026]
1. Who we are
This policy explains how personal information is collected and used when you visit thedndgeek.co.uk or shop at shop.thedndgeek.co.uk (together, the “websites”).
The data controller is The D&D Geek, operated by Richard Eccles.
You can contact us about this policy or your personal information at thedndgeek@gmail.com or through our contact page.
2. Personal information we collect
The information we collect depends on how you use the websites. It may include:
- Website and device information: IP address, browser and device details, pages visited, referring website, approximate location, and information about how and when you use the websites. This may be collected through server logs, cookies and similar technologies.
- Contact enquiries: information you provide, such as your name, email address and the contents of your message.
- Newsletter subscriptions: your email address, IP address, and the time and date you subscribed. Mailchimp may also record information about your interaction with marketing emails, such as opens and link clicks.
- Shop orders: contact details, billing and delivery addresses, items ordered, order and transaction details, and communications about your purchase. Payment information is handled by the payment provider presented at checkout. We receive information needed to confirm and manage the transaction, such as payment status and a transaction reference.
- Account and checkout information: if the shop allows you to create an account, we may also process your account details and purchase history.
Please do not include sensitive personal information in a contact form unless it is necessary for your enquiry.
3. How and why we use your information
We use personal information to:
- operate, maintain and protect the websites;
- understand website use and improve our content and services;
- respond to enquiries;
- provide the shop, process orders and payments, arrange delivery, and handle returns or customer service;
- send newsletters and other marketing where you have agreed to receive them;
- measure the performance of marketing and advertising, where permitted;
- meet legal, accounting and regulatory obligations; and
- detect or prevent fraud, misuse and security incidents.
4. Lawful bases for processing
Under UK data protection law, we rely on the following lawful bases, as appropriate:
- Consent: to send email marketing and, where required, to use non-essential cookies or similar technologies.
- Contract: to take steps you request before placing an order and to process and fulfil purchases, including payment, delivery and customer service.
- Legitimate interests: to operate and secure the websites, understand and improve their performance, respond to general enquiries, and administer our business. We consider the effect on your rights and use this basis only where your interests do not override ours.
- Legal obligation: to keep records and provide information where the law requires us to do so.
Where analytics involves storing information on, or accessing information from, your device, we will also seek consent where required by the Privacy and Electronic Communications Regulations (PECR). A UK GDPR lawful basis does not replace any consent required under PECR.
5. Cookies and similar technologies
Cookies are small files stored on your device. We and our service providers may also use similar technologies. They can help the websites work, remember your choices, measure site use and support advertising.
We use the following categories:
- Strictly necessary: needed for core functions such as security, shopping basket and checkout. These do not require consent where they are strictly necessary to provide a service you have requested.
- Analytics: help us understand how visitors use the websites so we can improve them. We will seek consent before using these where required.
- Advertising: may be used to measure advertising or show and personalise adverts. We will seek consent before using these where required.
A cookie consent banner lets you accept or reject non-essential categories. You can change or withdraw your choices at any time through the cookie settings available on the websites, or through your browser settings. Blocking some cookies may affect website features.
The cookies and their expiry periods can vary as our services change. The consent banner or cookie settings should be checked for the current choices and details. Where a third party sets cookies, that third party may also process information under its own privacy policy.
6. Advertising, affiliates and sponsored links
The websites may use advertising or affiliate services, including Google AdSense, eBay Partner Network and Amazon Affiliates. We may earn a commission if you follow an affiliate link and make a qualifying purchase, at no additional cost to you.
These services may use cookies or similar technologies to measure activity, prevent fraud, report advertising performance or personalise adverts. Personalised advertising may involve using information about your browsing activity. Where required, we will seek your consent before advertising cookies or similar technologies are used. Non-personalised advertising may still use limited technologies for purposes such as frequency capping, aggregated reporting and fraud prevention; any use that requires consent will be subject to your cookie choices.
When you follow a link to another website, that website’s privacy policy and cookie practices apply. We do not control the privacy practices of third-party websites or services.
7. Email marketing
If you subscribe to our newsletter, we use Mailchimp as our email marketing service provider. We rely on your consent to send you marketing emails. We hold your email address, IP address, and subscription time and date in our mailing list.
Marketing emails may include tracking beacons or tracked links to help us understand whether emails are opened or links are clicked. Where required, we will obtain consent for these technologies. You can unsubscribe at any time using the unsubscribe link in each marketing email, or by contacting us at thedndgeek@gmail.com or through our contact page.
We send marketing emails in accordance with applicable data protection and electronic marketing laws, including UK GDPR and PECR. Withdrawing consent does not affect processing that took place before you withdrew it.
8. Who we share information with
We may share relevant information with service providers who help us operate the websites and our business. Depending on how you use the websites, these may include:
- website hosting, maintenance and security providers;
- Mailchimp, for newsletter administration;
- payment providers and delivery services, to process and fulfil shop orders;
- analytics and advertising providers, including Google AdSense, eBay Partner Network and Amazon Affiliates, where applicable; and
- professional advisers, regulators, law enforcement or other parties where required by law or necessary to protect our rights or the rights of others.
Service providers may process information on our instructions or, in some cases, as separate controllers under their own privacy policies. We do not sell your personal information.
9. International transfers
Some of our service providers may process personal information outside the United Kingdom. Where personal information is transferred internationally, we will use a lawful transfer mechanism and appropriate safeguards where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for further information about relevant safeguards.
10. How long we keep information
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including to meet legal, accounting or reporting requirements. Our usual retention periods are:
- Shop and accounting records: generally up to six years after the end of the relevant financial year, or longer where needed for a dispute or legal obligation.
- Newsletter details: until you unsubscribe or withdraw consent. We may retain a minimal record of your unsubscribe request so we can respect it.
- Contact enquiries: normally up to 24 months after the enquiry is closed, unless it leads to a longer-running matter or we need the information for a legal claim.
- Website and security logs: normally up to 12 months, unless needed to investigate a security issue or meet a legal requirement.
- Analytics information: in line with the relevant analytics service settings and cookie expiry periods, and no longer than necessary for the analytics purpose.
- Cookies: for the period set for each cookie, or until you delete it or withdraw consent where applicable.
We may retain information for longer where necessary to establish, exercise or defend legal claims.
11. Your data protection rights
Depending on the circumstances, you may have the right to:
- access your personal information;
- rectify inaccurate or incomplete information;
- erase your information;
- restrict how we use your information;
- port certain information to you or another organisation, where the right applies;
- object to processing based on legitimate interests, and to direct marketing; and
- withdraw consent at any time where we rely on consent.
These rights are subject to legal conditions and exceptions. For example, the right to data portability generally applies to information you provided to us where processing is automated and based on consent or contract.
To exercise a right, contact us at thedndgeek@gmail.com or through our contact page. We may need to verify your identity before responding. We will respond within the time required by law.
12. Complaints
Please contact us first if you have a concern about how we use your information, and we will do our best to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.
13. Security
We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration or disclosure. No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security.
14. Changes to this policy
We may update this policy from time to time to reflect changes to the websites, our services or the law. The latest version will be published on this page with its updated date.