Privacy policy

Last updated: 11 September 2026

This policy explains what personal data PrimerDeck collects, why, how long we keep it, and what you can do about it. We have written it in plain language. If anything is unclear, write to info@primerdeck.com and we will explain it.

Who we are

PrimerDeck is a trading name of Nexus E-Com B.V., a company registered in the Netherlands.

Chamber of Commerce (KvK) number: 42107724
VAT number: NL869767513B01
Contact: info@primerdeck.com

We work by e-mail. Our postal address is on our Contact information page.

Nexus E-Com B.V. is the controller for the personal data described here.

What we collect and why

When you buy a guide. Your name, e-mail address, billing country and the details of your order. We need this to take your payment, deliver the file, send you the confirmation and keep the invoice our tax authority requires. Legal basis: performance of a contract, and a legal obligation for the invoice.
Payment details. We never see or store your card number. Payments run through our shop platform's checkout and, depending on what you choose, one of our other payment providers. We receive only the result of the payment and the last digits of the method used.
When you create an account. Your e-mail address, your name if you fill it in, and the list of guides you own. Our shop platform hosts the account and handles the login with a six digit code. Legal basis: performance of a contract.
When you save a guide to your wishlist. The list of guides you saved, stored with your account so that it follows you across devices. Legal basis: performance of a contract.
When you leave feedback on a guide. Your feedback text, the rating, the display name you choose and whether you bought the guide. We show approved feedback publicly with the display name only. Legal basis: performance of a contract and our legitimate interest in showing honest reviews.
When you use your reading record. If you take a comprehension check, we store which guide it was about, when you took it, how many questions you answered correctly, whether you passed, and which version of the question set you saw. From those records we calculate your experience points, your rank, your badges and your reading points balance. We keep this as a list of events that is only added to, so that your progress can always be recalculated and explained. Legal basis: performance of a contract, because the reading record is part of the account you asked for.
When you spend reading points. The reward you chose, the number of points, the date, and the discount code we created for you. If we ship you something, we also process your delivery address. Legal basis: performance of a contract.
When you personalise a merch item. If a fan shop item can be personalised, we collect the name or text you choose to have printed or embroidered on it, together with the order it belongs to. We need it to make the item correctly. It is visible to our print and shipping partner, because they produce and ship it, and once made, it is visible on the item itself. We keep it for as long as we keep the order it belongs to (see "How long we keep it"). Legal basis: performance of a contract. Please choose what you have printed with that in mind.
When you subscribe to our e-mails. Your e-mail address, the language you chose, and which of our messages you opened or clicked. You can unsubscribe from every e-mail we send. Legal basis: consent.
When you visit the website. Two things happen here and they are separate. Before you answer the cookie banner, a privacy friendly visit counter that sets no cookie counts visits for us in a way that cannot identify you: page views, country and referrer, with no profile. We also count a few anonymous events of our own, such as "a comprehension check was started", with no customer identifier attached. Only if you accept analytics cookies do we additionally load our own statistics tool, and only if you accept marketing cookies do we load advertising measurement. Legal basis: consent for cookies and for marketing, and our legitimate interest in knowing whether the site works at all.
When you write to us. Your e-mail address and whatever you tell us, kept so that we can answer and refer back to it later. Legal basis: legitimate interest.
Security. We record technical data such as request rates to stop abuse, spam and automated attacks. Our shop platform's own spam protection also runs on our forms, on sign-in and at checkout. It works quietly in the background and only asks you to complete a challenge if a submission looks automated. Legal basis: legitimate interest.

Who processes data for us

We use a small number of suppliers. Each of them acts on our instructions under a processing agreement, grouped here by what they actually do. If you want the names of the individual companies behind these categories, write to info@primerdeck.com and we will give them to you.

Our shop platform and payment providers. They run our online shop, checkout, customer accounts and order records, and they process payments. Location: Canada, the European Union and the United States.
Our guide delivery service. Delivers the guide files you bought to your account. Location: European Union.
Our membership service. Runs the Library Access membership. Location: European Union.
Our e-mail service providers. Send our correspondence, our newsletter and our automated e-mails. Location: European Union and United States.
Our security, delivery and measurement network. Protects the site against abuse, powers the technical side of your reading record, and runs the privacy friendly visit counter described above. Location: European Union and a worldwide network.
Our advertising measurement partner. Only with your consent, measures the results of our marketing campaigns. Location: United States.
Our print and shipping partner. Prints and ships fan shop items, including anything you personalise. Location: European Union and United States.

Some of these suppliers are outside the European Economic Area. For those transfers we rely on the European Commission's standard contractual clauses, or on the EU-US Data Privacy Framework where the supplier is certified.

About advertising measurement. If you accept marketing cookies, our shop platform also sends purchase and page view events to our advertising measurement partner from its own servers, not only from your browser. Both stop when you refuse or withdraw consent.

Cookies

When you first visit, you choose which cookies you accept. Necessary cookies always run: they keep your cart, your login and your language working. Analytics and marketing cookies only run if you accept them. You can change your choice at any time through the cookie settings on the site.

Our own visit counter runs on a server we control and sets no cookies. Even so, we only load it after you accept analytics cookies. That is stricter than the law asks for a tool that sets no cookies, and we prefer it that way.

How long we keep it

Invoices and order records: seven years, because Dutch tax law requires it.
Your account, wishlist, reading record and points: as long as your account exists.
Reading points: expire 24 months after you last earned any, and we warn you before that.
Personalised merch text: kept with the order it belongs to, see invoices and order records above.
Approved feedback: as long as the guide is on sale, unless you ask us to remove it.
Newsletter data: until you unsubscribe.
E-mail correspondence: two years after the last message.
Anonymous statistics: 24 months, and they never identify you.

If you delete your account, we remove your reading record, your points, your wishlist and your profile. We keep the invoices, because we have to.

Automated decisions

Your comprehension checks are marked automatically, and your rank, badges and points follow from those results. That is arithmetic, not judgement, and it has no legal effect on you. If you think a result is wrong, write to us and a human will look at it.

We do not sell your data, we do not trade it, and we do not use it to train anything.

Your rights

You can ask us to show you your data, correct it, delete it, limit what we do with it, or hand it to you in a portable form. You can object to processing based on our legitimate interest, and you can withdraw consent at any time without affecting what we did before. Write to info@primerdeck.com and we will answer within one month.

If you are not satisfied, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Children

Our guides are written for adults. We do not knowingly collect data from children under sixteen. If you believe a child gave us data, write to us and we will delete it.