Privacy policy

Data controller

The controller of the personal data collected through the Website is Bulpex (“Bulpex”).

For any matter relating to the processing of personal data you can write to rgpd@bulpex.com.

Data we process

Bulpex may process the following categories of data:

• Identification and contact data (username, email address, language).
• Authentication data (credentials managed by our provider Supabase).
• Usage and technical data (pages visited, interactions, device/browser identifiers, IP address).
• TCG collection and preference data voluntarily provided by the user (binders, cards, watchlists).
• Cookie and marketing consent data.

Purposes of processing

Bulpex processes personal data for the following purposes:

• Creating and managing user accounts and providing the requested services.
• Operating the Website’s features (collection, binders, alerts, marketplace, etc.).
• Ensuring Website security and preventing fraudulent activity.
• Responding to enquiries and requests received through the contact channels.
• Managing waiting lists, marketing communications and campaigns, only with the user’s explicit consent.
• Performing aggregate analytics to improve the product and the user experience (only with consent).

Legal basis

The legal bases for the processing are:

• Performance of the contract or pre-contractual measures requested by the user (sign-up, service delivery).
• User consent, freely given and revocable at any time (analytics/marketing cookies, marketing communications).
• Bulpex’s legitimate interest in ensuring Website security and improving the product.
• Compliance with applicable legal obligations.

Data retention

Data is kept for as long as the relationship with the user continues and, once it ends, for the legally required retention periods to meet potential liabilities. Marketing consent data is kept until the user withdraws their consent.

Recipients and international transfers

Bulpex does not share data with third parties except where required by law. To provide the service we rely on the following processors:

• Supabase, Inc. — authentication and database.
• Vercel, Inc. — Website hosting.
• Cloudflare, Inc. — content delivery (CDN) and security.
• Upstash, Inc. — data caching.
• Google LLC — analytics (only with consent).
• Meta Platforms, Inc. — marketing (only with consent).
• Sanity.io — legal content management and translations.

Some of these providers are located outside the European Economic Area. Where that is the case, Bulpex ensures that the appropriate safeguards required by the GDPR are in place (standard contractual clauses, adequacy decisions, etc.).

User rights

Users may exercise their rights of access, rectification, erasure, restriction, objection and portability, as well as withdraw their consent, at any time by writing to rgpd@bulpex.com.

Users also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they believe the processing does not comply with applicable law.

Changes to this policy

Bulpex may update this Privacy Policy to adapt to regulatory changes or to the evolution of the Website. Changes will be published on this page indicating the date of the last update.