Privacy Policy

1. Who we are

This website is operated by Mafia Card Game (“we”, “us”, “our”), from the United Kingdom. The website is mafiacardgame.com (the “Site”).

For the United Kingdom General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we are the controller of the personal data described in this policy. For the EU General Data Protection Regulation (“EU GDPR”), we are the controller in respect of visitors and customers in the European Economic Area (“EEA”).

You can reach us at contact (at) mafiacardgame.com or through the contact page.

2. Who this policy covers

This policy applies to everyone who visits the Site, joins a waitlist or mailing list, sends us a message, or places an order. The company is based in the United Kingdom. The main market is the United States. We also serve the EEA and the rest of the world.

If a local law gives you rights that this policy cannot reduce, those rights still apply. Where this policy and a mandatory local law conflict, the local law prevails for you.

This policy does not apply to third-party websites that we link to (for example a payment page, a carrier tracking page, or an advertising platform). Those sites have their own privacy notices.

3. What we collect

We collect personal data that you give us, data that is created when you use the Site, and data about your orders. We also collect data for marketing, including through cookies, pixels, and similar technologies as described in section 6.

Information you provide

• Name, email address, postal address, telephone number, and billing or shipping details
• Checkout information, order notes, gift messages, and messages sent through the contact form
• Waitlist and marketing sign-up details, including your email address and whether you asked to be told when the deck is available
• Preferences you set, such as cookie choices where a banner or similar control is offered
• Any other information you choose to send us

Information from your use of the Site

• Internet Protocol (IP) address, device and browser type, operating system, language, screen size, and approximate location derived from IP address
• Pages viewed, links clicked, time on page, referring URL, landing page, and search terms used to reach the Site
• Session recordings, heatmaps, scroll depth, and interaction data where tools such as Microsoft Clarity are used
• Advertising identifiers, cookie identifiers, pixel identifiers, click identifiers (for example gclid, fbclid, ttclid), and similar online identifiers

Information from orders and payments

• Products ordered, quantities, prices, discounts, currency, and order status
• Delivery method, tracking numbers, fulfilment notes, and returns
• Payment status and limited payment metadata. Card numbers, CVV codes, and full payment credentials are processed by our payment provider and are not stored in full on our servers

We do not ask for special category data under UK or EU GDPR (such as health data, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation), and we ask that you do not send it to us. We do not collect Social Security numbers, national insurance numbers, or government ID as a condition of using the Site.

4. Categories, sources, and notice at collection

The following is provided as a notice at collection, including for residents of California and other US states with similar laws. In the last twelve months we have collected, or we intend to collect, the categories below.

We do not collect biometric information, precise geolocation, audio or visual recordings of you other than optional session replay of Site use, or education or employment information, except if you volunteer it in a message.

We do not collect “sensitive personal information” as California law defines that term for the purpose of inferring characteristics about you. We do not use or disclose sensitive personal information for purposes that would require a “Limit the Use of My Sensitive Personal Information” right.

5. Orders

When you place an order we use your details to take payment, confirm the order, pack and ship the goods, handle returns, prevent fraud, keep accounts, and contact you about the order.

Order records are kept as part of running the business. They include what you bought, what you paid, where we sent it, and how we communicated with you about that order.

Payment is processed by Stripe. Stripe is a service provider acting for us. We do not receive your full card number.

We also use order data for marketing as described in section 6: for example to understand which products sell, to measure advertising that led to a purchase, and (where the law allows) to email you about similar products. Using order data in that way is for our marketing of The Final Witness. It is not a sale of your order list to another company.

6. Marketing

We collect and use personal data to market the game and the Site. That includes:

• Email about availability, restocks, pre-orders, and related products
• Measuring which advertisements, pages, and emails work
• Building and refining audiences for our own advertising
• Showing you advertisements for our products on this Site and on other platforms (including retargeting)
• Using waitlist, browsing, and order data to decide what to show or send you about The Final Witness

If you join a waitlist or tick a marketing box, we will use the email address you gave us to tell you when you can buy the deck and, where the law allows, to send other marketing about The Final Witness.

You can opt out of marketing emails at any time by using the unsubscribe link in the email or by contacting us. Opting out of marketing does not stop messages we must send about an order you have already placed, or messages that are strictly necessary to provide a service you requested.

Where the law requires consent for electronic marketing (including the UK Privacy and Electronic Communications Regulations 2003 (“PECR”) and similar EEA rules), we will ask for it. In other cases we may rely on a “soft opt-in” for existing customers about similar products, or on legitimate interests, as the law allows.

If you live in a jurisdiction that requires opt-in consent for marketing, we will not send marketing until we have that consent, except where another lawful ground applies.

7. Cookies, pixels, Clarity, and similar tools

The Site uses cookies, pixels, tags, software development kits, local storage, and similar technologies. We intend to use a full set of common marketing, analytics, and advertising tools. These may include, without limitation:

• Website analytics (for example Google Analytics 4 or an equivalent)
• Session replay and heatmaps (for example Microsoft Clarity)
• Advertising pixels and conversion tracking (for example Meta / Facebook, Instagram, Google Ads, Google Tag, TikTok, Pinterest, Snapchat, LinkedIn, Reddit, X / Twitter, and similar networks)
• Tag managers (for example Google Tag Manager) that load the tools above
• Essential cookies needed for the cart, checkout, security, load balancing, and remembering cookie choices

These tools collect identifiers and activity so we can understand how the Site is used, measure campaigns, retarget visitors, attribute sales, and improve the Site. Some of these tools set cookies on your device or fire a pixel when a page loads, including after you leave the Site if a network has stored an identifier.

Types of cookies and similar technologies

• Strictly necessary — required for the Site, cart, checkout, security, and storing your cookie choice. These do not require consent in the UK or EEA.
• Analytics — help us count visits and see how pages are used.
• Functional — remember preferences that are not strictly necessary.
• Advertising and marketing — pixels, conversion tags, retargeting, and lookalike or similar audiences for our campaigns.

A cookie banner on the Site lets you accept, or open Manage cookies to turn Analytics and Marketing on or off. Those tools do not run until you agree. You can open the same choices later from Cookies in the footer.

Where UK or EU law requires consent for non-essential cookies and similar technologies, we will request it before those tools run, except where an exemption applies. You can also control cookies in your browser. Blocking some cookies may affect how the Site works. Browser settings do not always stop pixels that fire without a persistent cookie.

California and some other US states treat certain advertising cookies as a “sale” or “share” of personal information for cross-context behavioural advertising. See sections 15 and 16.

8. How we use personal data

We use personal data to:

• Operate, secure, debug, and improve the Site
• Take and fulfil orders, including shipping, returns, tax, and customer service
• Run waitlists and tell you when a product is available
• Send marketing, measure it, attribute conversions, and show advertising for our products
• Create aggregated statistics that no longer identify you
• Prevent fraud, abuse, chargebacks, and technical problems
• Keep records required by tax, accounting, and consumer law
• Respond to questions, complaints, and legal requests
• Establish, exercise, or defend legal claims

9. Legal bases (United Kingdom and EEA)

Where UK GDPR or EU GDPR applies, we rely on these bases:

• Contract — to take and fulfil an order, run checkout, provide support you asked for, and perform a waitlist confirmation you requested
• Legitimate interests — to keep the Site secure, understand how it is used at a basic level, prevent fraud, improve the shop, and (where allowed) market similar products to existing customers. We balance those interests against your rights
• Consent — for non-essential cookies, pixels, and similar tools, and for some electronic marketing. You may withdraw consent at any time without affecting processing that already took place
• Legal obligation — to keep invoices, tax records, consumer-law records, and to respond to lawful requests from authorities

You may object to processing based on legitimate interests. If you do, we will stop unless we have compelling legitimate grounds or the processing is needed for legal claims.

10. Sharing — we do not sell your data to other companies, and we do not pass it to unrelated third parties

We do not sell your personal data for money. We do not give, rent, or trade your personal data to other companies so that they can market their own products to you. We do not sell lists to data brokers. We do not share your personal data with any third party for that third party’s independent commercial use.

We do use service providers who process personal data for us so that we can run the Site, the shop, and our own marketing. They are instructed to process data only for those purposes. They include:

• Website hosting and infrastructure (including SiteGround or a successor host)
• Payment processing (Stripe)
• Email delivery and waitlist tools
• Shipping carriers and fulfilment partners, once an order is being sent
• Analytics and advertising platforms that power the cookies, pixels, and Clarity-style tools described above, so those tools can work for our Site and our campaigns
• Professional advisers (for example accountants or lawyers) where needed

Those providers only receive what they need to perform their service. Advertising and analytics providers receive the technical and usage data those tools are designed to collect, as described in section 7, so that we can measure and run our marketing. They are not given your order list to use as their own customer list.

We may also disclose data if the law requires it, to protect our rights or users, in an emergency involving danger of death or serious injury, or if we transfer the business (in which case this policy would still apply or you would be told of a change). We may disclose data to a competent court, regulator, or law-enforcement body where we are legally obliged or entitled to do so.

11. International transfers

We are based in the United Kingdom. Some service providers, including analytics and advertising platforms, are in the United States or other countries. That means personal data may be processed outside the UK and the EEA.

Where UK GDPR or EU GDPR requires a safeguard for that transfer, we rely on adequacy regulations where they exist (including, where applicable, the UK-US data bridge and EU-US Data Privacy Framework for certified organisations), or on standard contractual clauses or the UK International Data Transfer Agreement / Addendum, together with any extra measures the law expects.

If you access the Site from outside the United Kingdom, you understand that your data will be processed in the United Kingdom and in the countries where our providers operate.

12. How long we keep data

We keep personal data only as long as we need it for the purposes above, including legal record-keeping. Typical periods are:

• Order, invoice, and tax data — typically six years after the end of the UK tax year of the order, or longer if a dispute, chargeback, or legal claim is open
• Waitlist and marketing contacts — until you unsubscribe, plus a short period to honour the opt-out and to evidence consent
• Contact messages — as long as needed to answer you and keep a record of the enquiry, usually up to two years unless a longer period is needed
• Analytics and advertising logs — according to the settings of each tool, often between 14 months and 26 months unless a shorter period is set
• Cookie consent records — for the life of the consent plus a period needed to demonstrate compliance
• Server and security logs — for a short operational period unless needed for an investigation

When we no longer need personal data we delete it or irreversibly anonymise it.

13. Security

We use reasonable technical and organisational measures appropriate to the risk, including HTTPS, access controls, least-privilege access to order data, and storing secrets outside public web directories. Payment card data is handled by our payment provider to the standards that provider maintains (including PCI DSS where applicable).

No method of transmission or storage is completely secure. You should keep your own devices and email account secure. If we become aware of a personal data breach that the law requires us to notify, we will notify the relevant authority and, where required, affected individuals.

14. Your rights in the United Kingdom and the EEA

If UK GDPR or EU GDPR applies to you, you may have the right to:

• Be informed about how we use your data (this policy)
• Access your personal data
• Correct inaccurate data
• Erase data in certain cases (“right to be forgotten”)
• Restrict or object to certain processing, including processing based on legitimate interests and processing for direct marketing (you may object to direct marketing at any time)
• Receive data you provided in a portable format and, where technically feasible, have it transmitted to another controller
• Withdraw consent where we rely on consent
• Lodge a complaint with a supervisory authority

We will respond without undue delay and in any event within one month, or within the longer period the law allows if the request is complex. We may need to verify who you are. We may refuse a request where the law allows, for example if it is manifestly unfounded or excessive, and we will tell you why.

In the United Kingdom the supervisory authority is the Information Commissioner’s Office (ico.org.uk). In the EEA you may complain to your local data protection authority. We would rather you contact us first so we can try to put things right.

To use these rights, contact us as set out in section 20. We may need to verify who you are.

15. Your rights in the United States

Depending on the state you live in — including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and other states that enact similar laws — you may have some or all of the following rights, subject to exceptions in those laws:

• To know and access the personal information we collect, use, disclose, and retain
• To correct inaccurate personal information
• To delete personal information, subject to legal exceptions (including records of an order)
• To obtain a copy of personal information in a portable format
• To opt out of targeted advertising, and of any “sale” or “sharing” of personal information as those words are defined in state law
• To opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, where we engage in that activity (we do not currently do so)
• To appeal a refusal of a request, where state law provides an appeal
• To use an authorised agent, where the law allows, if we can verify both you and the agent

We will not discriminate against you for exercising privacy rights, including by denying goods, charging a different price, or providing a different quality, except as the law allows in connection with a loyalty or similar programme we may offer.

We do not use personal information for decisions that produce legal or similarly significant effects based solely on automated processing in the way those state laws describe.

California residents may also have rights under the “Shine the Light” law (Civil Code section 1798.83) to ask about certain sharing with other companies for their direct marketing. We do not share personal information with other companies for their own direct marketing.

Nevada residents may opt out of the “sale” of covered information under Nevada law. We do not sell covered information as Nevada defines that term. You may still send an opt-out request using the contact details below.

To make a request, contact us as in section 20. We will verify the request as the law requires, using information we already hold (for example matching an email to an order). We will respond within the time the applicable statute requires, typically 45 days, with an extension where the law allows. If we deny a request and your state provides an appeal, you may appeal by contacting us and stating that you wish to appeal. We will decide the appeal within the statutory period (often 45 or 60 days) and tell you how to contact your state attorney general if you remain unsatisfied.

16. Do not sell or share; targeted advertising; Global Privacy Control

We do not sell personal information for money. We do not share personal information with unrelated companies for their own marketing.

We do use advertising and analytics technologies that, in California and some other states, can count as “sharing” personal information for cross-context behavioural advertising, or as targeted advertising. That is limited to the identifiers and usage data those tools collect so that we can advertise The Final Witness.

You may opt out of that sale, sharing, and targeted advertising by:

• Rejecting non-essential cookies and advertising pixels in Manage cookies on the Site (Accept turns them on; Save choices lets you leave Analytics and Marketing off)
• Sending a request as set out in section 20, stating that you wish to opt out of sale, sharing, and targeted advertising
• Using industry tools such as the Digital Advertising Alliance opt-out (aboutads.info) and, where available, your device’s advertising-limit settings
• Using a browser signal that qualifies as an opt-out preference signal under applicable law, including Global Privacy Control (GPC), where we have implemented recognition of that signal. Where we recognise a valid GPC signal, we will treat it as an opt-out of sale and sharing for that browser

Opting out of sale, sharing, or targeted advertising does not stop strictly necessary cookies, order processing, or marketing emails you have separately subscribed to (you can unsubscribe from those emails independently).

17. Your rights in the rest of the world

If you live outside the UK, EEA, and United States, you still have the rights this policy describes to access, correct, and ask us to delete data we hold, except where we must keep it for an order, a legal duty, or a legitimate record. We will also honour mandatory local rights where they apply to our processing of your data, including without limitation:

• Brazil — Lei Geral de Proteção de Dados (LGPD)
• Canada — Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws
• Australia — Privacy Act 1988 (Cth) and the Australian Privacy Principles
• New Zealand — Privacy Act 2020
• Singapore — Personal Data Protection Act 2012
• Switzerland — Federal Act on Data Protection
• Other jurisdictions that grant similar access, correction, deletion, or complaint rights

Contact us to use those rights. You may also complain to your local privacy or consumer authority. For Australia, that includes the Office of the Australian Information Commissioner. For Canada, that includes the Office of the Privacy Commissioner of Canada.

18. Children

The Site and the shop are aimed at adults. We do not knowingly collect personal data from children under 13, or under 16 where a local law sets that higher age for this kind of online service (including the UK and EEA where applicable). We do not sell goods through the Site to anyone under 18. We do not sell or share personal information of consumers we know are under 16.

If you believe a child has given us data, contact us and we will delete it where we are not required to keep it.

19. Automated processing

We use automated tools to measure advertising, to decide which ads to show, and to flag possible fraud. Those tools do not produce legal or similarly significant effects about you of the kind described in UK GDPR Article 22 or equivalent US state rules. You may still object to marketing profiling as set out in sections 14 to 16.

20. How to contact us, and changes to this policy

Questions about privacy, requests to exercise rights, and opt-out requests should be sent to contact (at) mafiacardgame.com or through the contact page.

Please include enough information for us to find you in our records (for example the email used at checkout or on the waitlist). Do not send payment card numbers.

We may update this policy. The “Last updated” date at the top will change. The current version is the one published on this page. If a change is material, we will take additional steps the law requires, such as a notice on the Site or an email where we have your address and the law requires notice.

This policy should be read with our Terms and Conditions and, where relevant, our Shipping and returns page.