Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

• STACKED - Schendelmann Strate GbR
• Kurt-Schumacher-Strasse 6D, 33615 Bielefeld, Germany
• Email: info@stacked.clothing
• Website: www.stacked.clothing

STACK'D is a marketplace for independent fashion brands. This privacy policy applies to everyone who uses our platform - as a buyer, as a brand partner, or as a visitor to our website. We describe which personal data we collect, why we collect it, how long we retain it, and which rights you have.

3.1 Buyers

When you shop on STACK'D, we collect the following data:

At checkout

• Name, shipping address, email address
• Order details (items, quantity, price, participating brands)
• Payment data - processed exclusively by our payment service provider Stripe Inc. We do not store full card data.

Legal basis
Art. 6(1)(b) GDPR (performance of a contract)

When creating an account

• Email address, password (encrypted), optional display name

Legal basis
Art. 6(1)(b) GDPR (performance of a contract)

When visiting the website

• IP address, browser type, device information, pages visited, timestamps

Legal basis
Art. 6(1)(f) GDPR (legitimate interest in operation and security of the platform)

3.2 Brand partners

When you register your brand on STACK'D and connect your Shopify store, we collect:

Account data

• Company name, contact person, email address, billing address

Legal basis
Art. 6(1)(b) GDPR (performance of a contract)

Shopify integration

We connect to your store via the official Shopify API. Once you authorise the connection we receive access to:

• Product catalogue and inventory (for display on STACK'D)
• Shipping profiles, shipping rules, and delivery customisations (to calculate accurate shipping costs and delivery options)
• Order and draft-order write access (we push orders placed on STACK'D back into your Shopify store)
• Fulfilment and returns lifecycle (to synchronise shipping and return status with our platform)
• Order data of orders we initiated (order number, buyer email, phone, and shipping address) - solely to synchronise shipping updates and cancellation options

We only read order data for orders that were written into your store via STACK'D. We do not read, synchronise, or use your store's existing customer lists or customer profiles for marketing purposes. Collected order data is deleted in line with the documented retention periods or fully removed via the Shopify shop/redact webhook (within 48 hours of app uninstall).

Legal basis
Art. 6(1)(b) GDPR (performance of a contract)

3.3 Waitlist (early access)

If you join our pre-launch waitlist we collect:

• Email address
• Type of entry (buyer or brand)
• For brands additionally: the brand website
• Proof of the consents given: timestamp, version of the consent wording, and the language it was displayed in

Buyers: storing and processing your email address is based solely on your explicit consent, given via two separate, non-pre-ticked checkboxes in the form - one for storing your data, one for being contacted about early access.

Legal basis
Art. 6(1)(a) GDPR (consent); for email outreach additionally sec. 7(2) no. 3 UWG (German Act against Unfair Competition)

Brands: contact details submitted with a brand application are processed to take steps at your request prior to entering into a contract.

Legal basis
Art. 6(1)(b) GDPR (pre-contractual steps)

You can withdraw a consent at any time with future effect - informally, by emailing info@stacked.clothing. This does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR). After withdrawal we delete your waitlist entry. Waitlist data is never shared with third parties or sold.

We only share personal data where necessary to perform the contract or where a statutory basis applies.

We do not sell personal data. We do not share data with third parties for advertising purposes.

Stripe and Shopify are headquartered in the USA and Canada respectively. Transfers are based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or a valid adequacy decision of the EU Commission. We provide the corresponding safeguards upon request.

We use strictly necessary cookies to operate the platform (session management, cart, authentication). These cookies do not require consent.

If we also use analytics or marketing cookies, we will ask for your consent beforehand (Art. 6(1)(a) GDPR). You may withdraw consent at any time.

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR) - find out which data we store about you.
• Rectification (Art. 16 GDPR) - have inaccurate data corrected.
• Erasure (Art. 17 GDPR) - request deletion, unless statutory retention obligations apply.
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) - receive your data in a machine-readable format.
• Objection (Art. 21 GDPR) - object to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3) GDPR) - withdraw consent at any time with future effect.

To exercise your rights, contact: info@stacked.clothing

We answer requests within 30 days.

You also have the right to lodge a complaint with the competent data protection supervisory authority. The authority responsible for us is the Landesbeauftragte fur Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestrasse 2-4, 40213 Dusseldorf, Germany, Phone: +49 211 38424-0, Email: poststelle@ldi.nrw.de, Web: https://www.ldi.nrw.de.

We use HTTPS encryption for all data transfers. Shopify access tokens are stored encrypted. Production and development data are strictly separated. We carry out regular security reviews and restrict internal data access to the minimum necessary.

If you uninstall the Shopify integration or disconnect from STACK'D:

• Your access token is deactivated immediately.
• Your product data is removed from our system within 30 days.
• Completed order data is retained for commercial and tax reasons.

Mandatory Shopify privacy webhooks (GDPR webhooks)

As an official Shopify app we support the mandatory Shopify privacy webhooks. Requests are processed within the deadlines defined by Shopify:

• customers/data_request - customer access requests are processed within 10 days. We compile the order data we hold for the customer and provide it to the shop owner.
• customers/redact - deletion requests for an individual customer are executed within 30 days, unless a statutory retention obligation applies (e.g. German Commercial Code § 257 HGB or Fiscal Code § 147 AO).
• shop/redact - within 48 hours of app uninstallation, all shop data not subject to retention (access tokens, product cache, configuration data) is permanently deleted.

In the scope of the Shopify integration we process personal data of the brand partner's end customers (in particular name, shipping address, order content) as independent controller for the sales transaction conducted via STACK'D. For orders we write into your store, we act as a technical interface partner. A data processing agreement under Art. 28 GDPR is available to brand partners on request.

You may request deletion of all data not subject to retention obligations at any time by email to info@stacked.clothing.

We reserve the right to adapt this privacy policy to technical or legal changes. The current version is available on our website. We inform registered users of material changes by email.