Skip to content

Privacy & cookie policy

Last updated: October 2026

This policy explains how CardStar collects, uses and protects personal data when you visit our website, create a card, place an order or contact us. CardStar is operated by Prodigi Group Ltd and its operating companies and affiliates. For orders placed on CardStar, the contracting entity and controller of your personal data is Prodigi (UK) Ltd.

1. Who we are

Prodigi (UK) Ltd (company number 10844939) is part of the Prodigi Group, which also includes Prodigi Group Ltd, Prodigi Global Ltd, Prodigi Platforms Ltd, Prodigi BV, Peecho BV, Prodigi USA Inc and Readymades Framing Ltd (together, “Prodigi”, “we”, “us”). Our principal address for data protection correspondence is Unit 20, Caker Stream Road, Alton, Hampshire, GU34 2QA, UK.

EU representative. Where Prodigi (UK) Ltd, as a UK-established controller, offers services to people in the European Economic Area, it has appointed Prodigi BV as its representative under Article 27 of the EU GDPR. Prodigi BV can be contacted in that capacity at Peecho, Herengracht 340, 1016 CG, Amsterdam, Netherlands, or by email at dpo@prodigi.com.

2. What we collect

When you use CardStar, we collect:

  • Your name, email address and delivery address (and phone number, if you give one) at Shopify checkout
  • Payment information — processed by Shopify; we never see your card details
  • What you put on your card: the photo you upload, the name, stats and text you enter, and the card image we make from them
  • For Team Orders: the players’ names, positions, ratings and stats a team manager enters, the club name and crest, and photos uploaded by the manager or by parents
  • Messages you send to the gift help assistant
  • Messages you send us, for example to customer support or sales
  • Only if you accept analytics cookies: which pages you visit, and your device and browser type, IP address, referring page and approximate location

3. How we use it, and why

We use your information to:

  • Print and deliver your order
  • Send order confirmations and shipping updates
  • Respond to customer service and sales enquiries and fix problems with an order
  • Prevent fraud and meet our legal, accounting and tax obligations
  • Improve the site, if you accept analytics cookies

Where UK GDPR or EU GDPR applies, we rely on these legal bases:

  • Performance of a contract with you, or steps you ask us to take before a contract (for example, making and delivering your card)
  • Compliance with our legal obligations (for example, accounting and tax records, fraud prevention, and lawful requests from authorities)
  • Our legitimate interests (for example, securing and improving the service, business administration, and establishing, exercising or defending legal claims), where those interests are not overridden by your rights and freedoms
  • Consent, where we expressly ask for it (for example, analytics cookies)

4. Photo handling

When you add a photo, it is resized in your web browser, and its background can be removed there. It is then uploaded to our cloud storage (Microsoft Azure) as soon as you add it, so we can print your card and so you can come back and edit it from your basket. When you add a card to your basket we also store the print-ready image we make from your photo.

We use these files only to print and deliver your order and to put right any problem with it. The print-ready image is sent to Prodigi, which prints and delivers your card. We do not sell your photos or use them for anything else.

5. Team Orders

A team manager can add a squad’s details and photos, and share a link so that parents can upload a photo for their own child. A parent with the squad’s link can see the squad’s names, add a photo for their own child, and see the photo already added for a player they choose. The link works only for people it’s shared with. The squad is stored in our cloud storage and is reached only through the private link the manager holds; the manager can replace that link, and the parents’ link, at any time.

6. Who we share it with

We share personal data with the following categories of recipients:

  • Other Prodigi Group companies, for the purposes in this policy
  • Service providers who act on our instructions, including print and fulfilment partners, hosting and storage providers, customer service tools, payment and fraud providers and shipping carriers
  • Independent third parties acting as their own controllers, such as shipping carriers (for delivery), payment providers (for payments), tax authorities and our professional advisers
  • Law enforcement, regulators and other authorities where we are required or permitted to by law, and the buyers and advisers in a sale of part or all of the Prodigi Group

The services we use to run CardStar are:

  • Shopify — checkout, payment and order management
  • Prodigi — printing and delivery. They receive your delivery details and the print-ready image
  • Microsoft Azure — storage for photos, print-ready images and Team Orders squads
  • Vercel — hosting for the website
  • Anthropic — the gift help assistant sends the messages you type to Anthropic to generate replies
  • Google — Google Analytics, only if you accept analytics cookies

We do not sell personal data.

7. International transfers

The Prodigi Group operates in the United Kingdom, the Netherlands and the United States, and uses production partners and service providers in a range of countries, so personal data is transferred internationally. Where data moves from the UK or the EEA to a country without an adequacy decision, we put appropriate safeguards in place, such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another lawful transfer mechanism. You can ask for more information at dpo@prodigi.com.

8. How long we keep it

We keep personal data only for as long as is necessary for the purposes it was collected for, including to meet legal, accounting, tax or reporting requirements and to resolve disputes. As a general guide, order and account records are kept for the period our accounting, tax and audit obligations require; marketing data is kept until you opt out or it is no longer accurate or relevant; and records relating to legal claims may be kept for as long as such claims could be brought. Backups are overwritten in line with our standard backup cycles.

At the moment we keep uploaded photos and print files after an order, so that we can reprint a card or sort out a problem with it. They are not yet deleted automatically. If you want yours deleted, email us at dpo@prodigi.com and we will delete them.

9. Security

We use technical and organisational measures to protect personal data, including access controls, encryption in transit, network security, logging and monitoring, staff training, supplier controls and incident response procedures. Our staff who handle personal data are bound by confidentiality. No system can be guaranteed to be entirely secure; if you believe your data has been compromised, contact dpo@prodigi.com.

10. Cookies and storage

Cookies are small text files placed on your device that let a website remember information about your visit. We keep your basket, your cookie choice and, for team managers, the link to their squad and the squad’s cards already prepared for the basket (for up to a week, so a long squad isn’t prepared twice) in your browser’s own storage on your device. Shopify’s checkout sets its own cookies.

We set analytics cookies (Google Analytics) only if you choose Accept on the cookie notice. If you choose Decline, none are set. You can change your mind at any time with “Cookie settings” at the bottom of any page. We do not use advertising cookies. We never send Team Orders private links to analytics. Strictly necessary storage, such as your basket and your cookie choice, cannot be switched off because the site needs it to work. More about controlling cookies is at aboutcookies.org.

11. Your rights

Depending on the law that applies to you, you may have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate or incomplete data
  • Erase your data, subject to certain exceptions
  • Restrict processing in certain circumstances
  • Object to processing based on our legitimate interests, and to direct marketing
  • Portability: receive the data you gave us in a structured, commonly used, machine-readable format
  • Withdraw consent at any time, where we rely on it
  • Complain to a supervisory authority

To use any of these rights, email dpo@prodigi.com. We may need to verify your identity first. Residents of other places, including the United States, may have additional rights under local law; contact the same address to find out how they apply.

Where to complain

If you are in the United Kingdom, or your concern is about processing by Prodigi (UK) Ltd, you can complain to the Information Commissioner’s Office at ico.org.uk. If your concern is about processing by Prodigi BV or Peecho BV, the lead supervisory authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you are in the European Economic Area and your concern is about processing by Prodigi (UK) Ltd as a non-EEA controller, you may complain to the data protection authority in your country of residence.

12. Children

CardStar is intended for adults. We do not knowingly collect personal data from children, other than photos and names of players that a parent or team manager chooses to add to a card or squad. If you believe we have collected a child’s data without a parent’s knowledge, contact dpo@prodigi.com and we will delete it.

13. Personal data breaches

We have processes for identifying, escalating, investigating and responding to security incidents and personal data breaches. If a breach affects your personal data, we will tell you in line with applicable data protection law.

14. Changes to this policy

We may update this policy from time to time. The current version, with its date, is always on this page.

15. Contact

  • Data protection requests, security incidents and anything about your personal data: dpo@prodigi.com. Postal: Data Protection, Prodigi, Unit 20, Caker Stream Road, Alton, Hampshire, GU34 2QA, UK
  • Help with an order or the site: support@cardstar.me
  • Sales and bulk enquiries: sales@cardstar.me