Who We Are

Hobby Market Pro is the data controller responsible for the personal data described in this Privacy Policy.

Data Controller: Hobby Market Pro
Email: [email protected]
Address: 2335 W Foothill Blvd, Suite 9, Upland, CA 91786, United States

What Data We Collect

We collect personal data that is necessary to operate our B2B wholesale marketplace platform for sealed trading cards (for verified businesses only), provide information about our platform, plans and pricing, guides and resources, and to let you contact us, subscribe to email updates, book a call, and sign up for the marketplace application.

Data you provide to us may include:
Business and account information (such as your name, business name, business contact details, and information you submit as part of the marketplace application for business verification).
Contact and communications information (such as the information you provide when you contact us, email us, or submit inquiries).
Marketing subscription information (such as your email address and your subscription preferences when you sign up for email updates).
Call booking information (such as the details you submit when you schedule a call).
Payment and billing information (such as billing contact details and payment-related information needed to process payments).

Data we collect automatically may include:
Device and connection information (such as IP address, browser type, and similar technical information needed to load and secure the website).
Cookie consent preferences (your choices about cookies and similar technologies, recorded through our consent management system).

With your consent, we also collect:
Usage data via analytics (information about how you interact with our website and platform, collected through analytics technologies).
Advertising-related data for personalized advertising (information collected through advertising technologies to help deliver and measure personalized ads).

Sources of data:
We collect data directly from you when you fill out forms, subscribe to email updates, book a call, apply for an account, or communicate with us.
We collect some data automatically from your device and browser when you access our website.
We collect data from cookies and similar technologies; non-essential cookies are used only when you choose to allow them.

Whether you must provide data:
Some data is required to process your application, provide the marketplace service, process payments, and respond to your requests. Providing marketing and non-essential cookie data is optional, and you can withdraw your consent at any time.

How We Use Your Data

We use your personal data for the following purposes, each based on a specific legal basis under GDPR where applicable:

To provide the marketplace platform and manage your account and application, including business verification and access to platform features (contract).
To respond to your inquiries, requests, and support communications (contract).
To process payments and billing related to our plans or services (contract).
To send email updates and marketing communications you request or opt into (consent). You can unsubscribe at any time using the link in our emails or by contacting us.
To schedule and manage calls you book with us (contract).
To collect analytics data to understand how our website and platform are used and to improve performance and user experience (consent).
To deliver and measure personalized advertising and manage advertising preferences where available (consent).
To record, store, and demonstrate your cookie consent choices (legal obligation).
To maintain tax and accounting records (legal obligation).
To protect our website and platform, prevent fraud, and maintain security (legitimate interest).
To analyze aggregated statistics that do not rely on cookies, persistent identifiers, or other technologies that require consent (legitimate interest).

Who We Share Your Data With

We share personal data only as needed to operate our website and services, and only with recipients that support the purposes described in this policy. Where we use service providers, they process personal data according to their own privacy policies and our instructions as applicable.

We use our own consent management system (Trustwards) to record and manage your cookie preferences. This data is processed internally and not shared with third parties.

We may share personal data with the following categories of service providers, depending on how you use our services and the choices you make (for example, your cookie preferences):
Analytics services (to collect usage data and help us understand and improve how the website and platform are used).
Advertising networks (to deliver and measure personalized advertising where you have consented).
Payment processors (to process payments and handle billing-related transactions).
Email service providers (to send service communications and, where you have consented, marketing emails).
Tidio (live chat) (to provide real-time chat support and manage chat communications).
Bento (email and site analytics) (to manage email communications and measure engagement, and to support site analytics where enabled).
PostHog (product analytics) (to analyze product and platform usage where enabled).
Ahoy (first-party analytics) (to support analytics functionality; where it runs on our own servers, data is processed internally and not transferred to third parties).
Calendly (call scheduling) (to allow you to book calls and to manage scheduling details).

We may also share personal data when required by law, to respond to lawful requests, or to protect our rights, users, and services.

International Data Transfers

If you are located in the EU/EEA, the UK, or Switzerland, your personal data may be transferred to and processed in countries outside your jurisdiction. Some of our service providers are located outside the EU/EEA, specifically in the United States, including Google Analytics, Google Ads, Tidio, Bento, PostHog, and Calendly.

When we transfer personal data internationally, we use appropriate safeguards recognized under applicable data protection law. Depending on the provider and the transfer, this may include Standard Contractual Clauses approved by the European Commission and, where applicable, reliance on a provider’s certification under the EU-U.S. Data Privacy Framework.

Our consent management system (Trustwards) is based in Spain (EU), so consent data is not transferred internationally.

How Long We Keep Your Data

Account data: until the account is deleted or as required by law.
Contact form submissions and email inquiries: as long as needed to respond and for our business records.
Analytics data: per the retention settings of our analytics providers.
Cookie consent records: retained for compliance purposes.

Cookie consent records: 10 years (to demonstrate compliance and address potential claims within legal limitation periods).
Security logs and technical records: 12 months.
Tax and accounting records: 10 years (legal requirement).

Analytics data: until consent is withdrawn or according to the analytics tool retention settings.
Advertising/marketing tracking data: until consent is withdrawn.
Marketing email data: until consent is withdrawn or user unsubscribes.

Your Rights

If you are located in the EU/EEA, the UK, or Switzerland, you have the right to:
Access your personal data.
Correct inaccurate or incomplete data.
Delete your personal data.
Restrict how we process your personal data.
Receive a copy of certain personal data you provided to us in a portable format and request that it be transferred to another provider where technically feasible.
Object to our processing of your personal data in certain circumstances.
Withdraw your consent at any time where we rely on consent (this does not affect processing already carried out before you withdrew consent).
Not be subject to automated decision-making that produces legal effects or similarly significantly affects you.

If you are a California consumer, you have the right to:
Know what personal information is collected, used, shared, or sold.
Delete personal information.
Opt out of the sale or sharing of personal information for cross-context behavioral advertising through “Do Not Sell or Share My Personal Information.”
Correct inaccurate personal information.
Limit the use and disclosure of sensitive personal information.
Not be discriminated against for exercising your privacy rights.

To exercise your rights, contact us at [email protected]. We may need to verify your identity before completing certain requests.

Response timing:
For GDPR requests, we aim to respond within one month.
For CCPA/CPRA requests, we respond within 45 days, and we may extend this by an additional 45 days when reasonably necessary, with notice.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Data Security

We implement appropriate technical and organizational measures designed to protect personal data. However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions to reduce risk.

Data Breach Notification

We maintain procedures to detect, report, and investigate security incidents. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and provide information about the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

If you suspect a security issue, please contact us at [email protected].

How to Lodge a Complaint

If you are located in the EU/EEA, the UK, or Switzerland, you have the right to lodge a complaint with the competent data protection authority in your jurisdiction.

California consumers may also submit complaints to the California Privacy Protection Agency (CPPA) at https://cppa.ca.gov/ and may contact the California Attorney General.

We encourage you to contact us first so we can try to resolve your concern quickly and fairly.

Updates to This Policy

We review and update this Privacy Policy periodically. The “Last updated” date at the top of this policy indicates when changes were last made. If we make significant changes, we will provide notice through the website or by email where appropriate. Changes take effect from the date indicated at the top of this policy. Where we rely on consent for certain processing, we will request new consent when required.

Contact Us

Email: [email protected]
Address: 2335 W Foothill Blvd, Suite 9, Upland, CA 91786, United States
Data Controller: Hobby Market Pro

California Privacy Rights (CCPA/CPRA)

This section applies to California consumers and describes our Notice at Collection and your rights under the CCPA/CPRA.

Categories of personal information we collect (in the last 12 months):
Identifiers (such as name, email address, IP address, and other similar identifiers).
Internet or other electronic network activity information (such as information about your interaction with our website and platform, including through analytics and advertising technologies where enabled).

Business and commercial purposes for collecting personal information:
To operate and provide our B2B wholesale marketplace platform, including account applications and business verification.
To communicate with you, respond to inquiries, and provide support.
To process payments and manage billing.
To send email updates and marketing communications where you choose to receive them.
To schedule and manage calls you book with us.
To measure, improve, and maintain our website and platform, including analytics where you allow it.
To provide and measure advertising, including cross-context behavioral advertising where you allow it.
To help maintain safety, security, and integrity, and to prevent fraud.
To comply with legal obligations and maintain required records.

Sale and sharing of personal information:
We do not sell personal information.
We share personal information for cross-context behavioral advertising.
Categories of personal information shared for cross-context behavioral advertising: Identifiers; Internet or other electronic network activity.

Your right to opt out of sharing for cross-context behavioral advertising:
You can opt out through “Do Not Sell or Share My Personal Information” by contacting us at [email protected]. We also honor Global Privacy Control (GPC) signals as valid opt-out requests where they are received.

Sensitive personal information:
We do not collect or use sensitive personal information for purposes that would require offering a right to limit beyond what is described in this policy. If you believe we process sensitive personal information about you, you may contact us at [email protected] to request limitation of use and disclosure as applicable.

How to submit a request:
Email us at [email protected] and describe the request you want to make (know, delete, correct, or opt out).

Verification:
To protect your information, we will take steps to verify your identity before fulfilling certain requests. The verification steps depend on the nature of the request and the sensitivity of the information involved. If you have an account, we may verify through your account or by requesting information that matches our records.

Response timing:
We respond within 45 days. If we need more time, we may extend by an additional 45 days and will notify you of the reason for the extension.

Non-discrimination:
We do not discriminate against you for exercising your CCPA/CPRA rights.