Last updated 6 October 2026
This policy explains how CALIBRE collects, uses, and protects your personal data when you use our website and grading service, in line with UK GDPR and the Data Protection Act 2018.
CALIBRE is operated by Calibre Grading Ltd ("CALIBRE", "we", "us", "our"), a company registered in England and Wales (company number 17343831), registered office 66 Paul Street, London, EC2A 4NA. We are the data controller for the personal data described below. Contact: hello@calibregrading.co.uk.
What happens depends on what you choose on our cookie banner. Our Cookie Policy lists every cookie and how long it lasts. Separately, we keep anonymous visit statistics for everyone, without cookies (see below).
Whatever you choose on the cookie banner, our site counts how it is used without cookies and without storing anything on your device. We record which pages are opened, which buttons and links are tapped (by their label), how far down a page people scroll, how long a page is open, error messages shown, and the steps on the order page - for example searching for a card, adding one, or tapping Continue to payment. Card names you search for are recorded, as they aren't personal.
We never record what you type into a form - only which box was used and whether it was filled in. To tell one visit from another on the same day, our server combines your IP address and browser details with a random code that changes every day and is then thrown away. Your IP address itself is not stored, and a visit can't be linked to a visit on another day. We use this only to understand and improve our site, and delete it after 90 days.
If your browser sends a Global Privacy Control or Do Not Track signal, none of this is collected - that is the easiest way to opt out. Questions: hello@calibregrading.co.uk.
If you click Accept, we load Google Analytics. It uses cookies to recognise repeat visits and tells us how the site is used. Google receives your IP address and browser details. If you click Reject, or don't choose, Google Analytics is never loaded.
If you click Accept, we also run our own analytics, stored in our own database. It records:
Anything you type or select in a form is hidden in recordings. Other text shown on the page can appear in a recording, for example your order details when you view your account. We don't store your IP address with these records, and we don't use an outside company for recordings.
While a page is open, our analytics also keeps a live connection to our server so we can see how many people are on the site right now and roughly where they are: town or city, worked out from the IP address, never your exact location. To do this, your IP address is looked up using ip-api.com, or an offline database on our own server. We don't save this live view.
If you click Accept, we load Reddit's advertising pixel. It tells Reddit when someone visits a page, adds a card to an order, places an order or signs up as a seller on our site, so we can see whether our Reddit ads lead to visits and orders (for an order, Reddit gets the order number and value, not your name or contact details). Reddit receives the address of the page, your IP address and browser details, and sets its own cookies to recognise your browser. Reddit may link this to a Reddit account if you have one, and uses it under Reddit's privacy policy. If you click Reject, or don't choose, the pixel never loads and Reddit receives nothing from our site.
You can change your choice at any time with the Cookie settings button on our Cookie Policy page. If you switch from Accept to Reject, Reddit's pixel and our own analytics stop from the next page you open, and Google Analytics stops using cookies. Cookies already set stay in your browser until they expire or you clear them.
| Purpose | Lawful basis |
|---|---|
| Providing the grading service, processing orders, arranging postage, returning your cards | Performance of a contract |
| Taking payment and preventing fraud | Contract / legitimate interests |
| Customer support and service emails about your order, including up to three reminders if you start an order but don't finish it (each with an unsubscribe link) | Contract / legitimate interests |
| Site security, logging, and abuse prevention | Legitimate interests |
| Running the free pre-check on photos you upload | Legitimate interests |
| Anonymous visit statistics, without cookies (see section 3) | Legitimate interests - understanding and improving our site |
| Google Analytics cookies, our own analytics and session recordings, the Reddit advertising pixel, and any marketing emails | Consent (withdrawable at any time) |
| Meeting legal, tax, and accounting obligations | Legal obligation |
We use trusted providers to run the service. Where they act for us, they only process data on our instructions:
We do not sell your personal data. We may disclose data where required by law.
We aim to keep data in the UK/EEA. Where a processor (e.g. Stripe, Google or Reddit) transfers data outside the UK, it is protected by appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement.
We keep order and grading records for as long as needed to provide the service and to meet legal/accounting obligations (generally up to 6 years for financial records). Analytics data is retained per Google Analytics settings. Session recordings are deleted automatically after 90 days. Our own page-view and visit statistics - including the random visitor ID that lets us recognise a returning browser across visits - are deleted after 13 months. Anonymous visit statistics (no cookies) are deleted after 90 days. Reddit keeps what it receives under its own policies. We delete or anonymise data when it is no longer needed.
Under UK GDPR you have the right to: access your data; have it corrected or erased; restrict or object to processing; data portability; and withdraw consent at any time. To exercise any of these, email hello@calibregrading.co.uk.
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
We use technical and organisational measures (encryption in transit, access controls, reputable processors) to protect your data. No method is perfectly secure, but we take protection seriously.
We may update this policy; the "last updated" date shows the latest version. Material changes will be highlighted on the site.