Privacy policy

Last updated: 23 October 2026

Aureon Cards is the trading name used by Aureon Medical GmbH for its trading card and collectibles business at aureoncards.com. Aureon Medical GmbH is the legal seller, contracting party and website operator.

1. Controller and scope

The controller for personal data processed through this shop is Aureon Medical GmbH, trading as Aureon Cards. This policy covers aureoncards.com, shopping, customer accounts, support, collection-sale enquiries and app launch-list registrations. A released app may require additional privacy information describing its actual data flows and permissions; a coming-soon feature description does not establish that a data collection feature is already active.

Aureon Medical GmbH, trading as Aureon Cards
Feldmark 12B
46419 Isselburg
Germany

This is our registered business and postal address only, not a visitor address. Please contact us by email at info@aureoncards.com.

Email: info@aureoncards.com
Aureon Cards website: aureoncards.com
Store support: Contact Aureon Cards

2. Information we process and its sources

Depending on your interaction, we process your name, billing and delivery details, contact information, order and return details, payment status, customer account information, consent preferences, correspondence and information you choose to include in a collection enquiry, such as card lists or photographs. Please avoid including unrelated personal information in card photos or uploads.

Our website and service providers also process technical information such as IP address, browser and device information, requested pages, timestamps, referring pages, session identifiers and interactions with the store. Information comes from you, your device, Shopify and providers involved in payment, delivery, security or another service you use.

Full payment card numbers and security codes are handled by the selected payment provider; we do not store them ourselves. A physical redemption code is not information you need to provide for ordinary customer support.

3. Purposes and legal bases

• Orders, accounts and support: preparing and performing a contract, taking payment, delivering goods, processing returns and answering related enquiries, under Article 6(1)(b) GDPR.
• Legal obligations: invoices, accounting, tax records and lawful regulatory requests, under Article 6(1)(c) GDPR.
• Security and business administration: proportionate fraud prevention, technical diagnostics, service reliability, claim handling and responding to general business enquiries, under Article 6(1)(f) GDPR. Our interests are operating a secure store, protecting customers and administering our business.
• Optional marketing, app launch updates and non-essential tracking: consent under Article 6(1)(a) GDPR where required. Consent is optional and can be withdrawn for future processing. An enquiry or purchase does not automatically subscribe you to marketing.

4. Shopify and service providers

The store is hosted on Shopify. Shopify provides hosting, checkout, account, order, security and related store functions. Information is shared with Shopify and other service providers only as needed for the relevant service or another lawful purpose.

Recipients may include payment providers, postal and parcel companies, IT and customer-support providers, communications providers, accountants, tax advisers, legal advisers and authorities where disclosure is legally required. They receive the information necessary for their role. Providers acting on our behalf are subject to appropriate data-processing arrangements where required.

Shopify may also process certain data under its own responsibility, including in connection with Shop, Shopify accounts or enhanced features that you use or that are enabled for the store. See the Shopify Consumer Privacy Policy and Shopify Privacy Portal for the relevant practices and choices. We do not sell your personal information for payment.

5. Payments and delivery

The payment methods actually available are shown at checkout. The selected provider processes the information needed to authorise and complete payment under its own privacy information where applicable. Accelerated checkout may involve a wallet or account provider chosen by you.

To fulfil a physical order, we share necessary recipient and parcel details with the selected postal or parcel service, which may include DHL/Deutsche Post or DPD. Contact details may be used for delivery notifications where lawful and appropriate.

6. Cookies, analytics and advertising

Essential storage and similar technologies support functions such as security, sessions, carts, checkout and remembering privacy choices. Where applicable law requires consent, optional analytics, personalisation or advertising technologies are used only after that consent.

You can use the privacy choices presented by the store and your browser’s cookie controls to manage preferences. Withdrawing optional consent does not prevent ordinary shopping, although blocking essential storage can affect checkout. Optional tools may process browsing events, device identifiers and approximate location; their applicable provider details and purposes should be presented when consent is requested. We do not treat simply browsing the website as consent to non-essential tracking.

7. Communications, collection enquiries and app updates

We use the information in emails, contact forms and assistant messages to answer your request and administer the relevant service. Collection-sale enquiries may require assessing the card details and photos you provide. Do not send sensitive personal data or payment credentials in chat or enquiry forms.

If you join an app launch list or another marketing list, we use your details for the updates you requested. You can unsubscribe using the email link or by contacting us. We may still send necessary messages about an existing order or account.

8. International transfers

Some providers, including Shopify, may process information outside the European Economic Area. Where required, transfers use an applicable adequacy decision or recognised safeguards such as the European Commission’s Standard Contractual Clauses, with supplementary measures where necessary. Contact us for further information about the safeguards relevant to your data.

9. Retention and security

We retain information for the time needed for its stated purpose, including handling orders, enquiries, complaints and claims. Accounting and tax records are retained for applicable statutory periods. Consent records are retained as necessary to demonstrate compliance; other information is deleted or anonymised when it is no longer needed, subject to lawful retention obligations.

We use appropriate technical and organisational measures to protect personal information. No online system is completely secure. Please protect account access and avoid sending unnecessary confidential data.

10. Your rights

Subject to the applicable legal conditions, you can request access, correction, erasure, restriction and data portability. You can withdraw consent at any time without affecting earlier lawful processing. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time.

Contact us at the address above to exercise these rights. We may ask for proportionate information to verify your identity. We respond within the GDPR time limits, normally within one month; where a lawful extension is necessary, we explain it within that period. We do not discriminate against you for exercising your rights.

11. Complaints

You may complain to a competent supervisory authority, including in the EU country where you live, work or believe an infringement occurred. For our location in North Rhine-Westphalia, the relevant state authority is Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW). You may also contact us first so we can address your concern.

12. Children, automated checks and external sites

Minors must involve a parent or guardian where required to make a lawful purchase or provide consent. If you believe a child’s information has been provided without an appropriate legal basis, contact us so we can review and address it.

We do not ourselves make solely automated decisions with legal or similarly significant effects on individuals. Payment or fraud-prevention providers may perform checks under their own responsibility; their relevant privacy notices explain those practices.

External sites, including card-price references and social platforms, apply their own privacy rules when you visit them. Their inclusion does not imply that every visitor’s data is automatically sent to them.

13. Policy updates

We update this policy when our practices or legal requirements change. The date above identifies this version. We provide additional notice or request consent where the law requires it; publication alone does not replace required consent.

Related information: Privacy Policy · Returns & Refunds · Terms of Service · Contact Information · Legal Notice · Shipping Policy.