Privacy Policy

This privacy policy explains which personal data we process when operating the STACKED online marketplace (www.stacked.clothing, including the Shopify app "STACKED"), for which purposes, on which legal basis, to whom we disclose it, how long we keep it and which rights you have.

1. Controllers

1.1 STACKED as marketplace operator

The controller within the meaning of Art. 4(7) GDPR for operating the marketplace (website, customer account, basket, checkout, customer service, withdrawal function, notice procedure, brand dashboard and Shopify app) is:

STACKED Schendelmann Strate GbR, Kurt-Schumacher-Strasse 6D, 33615 Bielefeld, Germany, email: info@stacked.clothing

Full provider details are in the imprint. No data protection officer has been appointed, as the requirements of § 38 BDSG are not met.

1.2 Brands as sellers

You conclude purchase contracts on STACKED with the respective brand. The respective brand is an independent controller for performing the purchase contract (shipping, invoicing, warranty, returns, tax retention). We transmit the necessary order data to it (see section 4). The brand's privacy notice is on its website; its contact details are on its imprint page on STACKED. For brands with their own Shopify checkout, you complete order and payment in the checkout of the brand's Shopify shop; there the brand and Shopify process your data under the privacy notices linked in that checkout.

1.3 Payment service providers

Payments are processed via Stripe in the respective brand's own Stripe account (see section 5.4). Stripe and – when paying with Klarna – Klarna process payment data partly as independent controllers (e.g. for fraud prevention and anti-money-laundering obligations). This applies to orders through the STACKED checkout. For brands with their own Shopify checkout, payment in the brand's checkout is processed by Shopify or the brand's payment service providers (e.g. Shopify Payments, PayPal, Klarna); STACKED receives no payment data.

2. Visiting the website

2.1 Server log files

When you access the website, our hosting provider Vercel automatically processes technical data: IP address, date and time, page accessed, referrer, browser and operating system. This is necessary to deliver the website, keep it stable and fend off attacks.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, functional operation); § 25(2) No. 2 TDDDG for access to the device.
• Retention: logs are deleted after 30 days at the latest.

2.2 Cookies and similar technologies

We use strictly necessary cookies and local storage (login/session, basket, security, beta access, chosen language stitchup.locale, storage of your cookie decision). No consent is required for these (§ 25(2) No. 2 TDDDG). The language choice is a setting you explicitly request.

All other services (preferences, statistics, marketing) are only used if you consent in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). We store your decision in the cookie stitchup.consent (formerly STACKED.consent) for 365 days and log it – with a pseudonymous session ID, timestamp, version and chosen categories – as evidence (Art. 7(1) GDPR). You can change or withdraw your consent at any time via "Privacy settings" in the footer.

Categories:

• Necessary: as described above.
• Preferences: storage of optional display settings (e.g. colour scheme), assignment to a page variant in variant tests (cookie ab_test_variant), address autocomplete and map preview with Google Maps (section 2.4).
• Statistics: Google Analytics 4, Vercel Web Analytics and Vercel Speed Insights (section 2.3).
• Marketing: currently not used.

2.3 Statistics (consent only)

• Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): analysis of website usage (pages viewed, time on page, device and browser data, approximate location, events such as "add to basket"). IP addresses are truncated by Google in the EU. Cookies: _ga, _ga_*, retention up to 14 months. Transfer to Google LLC in the USA is possible; Google is certified under the EU-US Data Privacy Framework.
• Vercel Web Analytics and Speed Insights (Vercel Inc., USA): aggregated, cookieless reach and load-time measurement. Transfer to the USA based on the Data Privacy Framework or standard contractual clauses.
• Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG. Consent can be withdrawn at any time with effect for the future.

2.4 Google Maps: address autocomplete and map preview (consent only)

When entering addresses we may show suggestions via Google Places and, when you save an address you typed by hand, check it with Google (postal code and town). For this, your input is sent directly from your browser to Google. On the order confirmation and in order details we may show the delivery address on a map; for this, the address is sent via our server to Google's Geocoding API and the map is loaded from Google Maps (Google Ireland Limited; transfer to Google LLC, USA, possible, Data Privacy Framework). Google receives, among other things, your IP address. Address autocomplete, the address check, the map and the address lookup are only loaded once you have consented in the "Preferences" category, clicked "Search address with Google" in an address form (valid until the page is reloaded) or clicked "Enable map". Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

3. Customer account

For a customer account we process email address, password (hash only), first and last name, optionally phone number, addresses, language setting and – if you provide it – your date of birth. The date of birth is voluntary; we only use it for display in your profile.

• Legal basis: Art. 6(1)(b) GDPR (user agreement); for voluntary details Art. 6(1)(a) GDPR.
• Retention: until the account is deleted. Order data subject to statutory retention is then kept in restricted form (section 10).
• Login emails (confirmation, password reset) are sent via Supabase Auth and Resend.

4. Orders

For an order we process: name, email address, delivery and billing address, phone number where applicable, order contents, prices, shipping costs, payment status, the versions of the accepted terms and withdrawal policy (with an irreversible, salted hash of your IP address as evidence), and shipping and return status.

• Purpose: brokering and performing the purchase contracts with the brands, order confirmation, customer service, returns, evidence of contract terms.
• Recipients: the respective brand (independent controller) receives name, delivery address, email, phone number where applicable and the order contents – technically by writing the order into its Shopify shop. Each brand only receives the data of its own order.
• Brands with their own Shopify checkout: before you pay at the brand, we send its Shopify shop the basket, your email address and your delivery address (with name and phone number where applicable) so the checkout is prefilled, plus a STACKED basket reference and – if you are signed in – a customer reference to match the order. Once the order is placed we receive the order data from the brand's Shopify shop (order contents, prices, name, email, delivery address, order, shipping, cancellation and refund status) to show the order in your account, settle the commission and meet legal obligations. We do not store the shop's other orders.
• Legal basis: Art. 6(1)(b) GDPR; for evidence of contract terms Art. 6(1)(f) GDPR.
• Retention: invoice and accounting data 8 or 10 years (§ 147 AO, § 257 HGB, § 14b UStG), records under § 22f UStG 10 years; otherwise 3 years from the end of the year of the order (regular limitation period).

5. Service providers and recipients

We use the following service providers. Where they act on our behalf, we have concluded data processing agreements under Art. 28 GDPR.

5.1 Hosting and infrastructure

• Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) – website hosting, server functions, log files. Transfer to the USA: Data Privacy Framework and standard contractual clauses.
• Supabase Inc. (970 Toa Payoh North #07-04, Singapore) – database, authentication, file storage, edge functions. Database region: EU (Frankfurt). Transfers outside the EU only based on standard contractual clauses.

5.2 Email delivery

• Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) – sending transactional emails (order confirmation, shipping, refund and withdrawal confirmations, notice confirmations, login emails). Transfer to the USA: standard contractual clauses or Data Privacy Framework. Open and click tracking is disabled.

5.3 Shopify

• Shopify International Limited (Dublin, Ireland) or Shopify Inc. (Canada; adequacy decision) – brands run their shops on Shopify. Via the Shopify API we read product data, inventory and shipping profiles and write orders received through the STACKED checkout into the respective brand's shop. For brands with their own Shopify checkout we create a prefilled cart in the brand's shop via the Shopify Storefront API and receive the resulting order through Shopify webhooks (see section 4). We do not read brands' existing customer lists.

5.4 Payment processing: Stripe and Klarna

This section applies to orders through the STACKED checkout. For payment at brands with their own Shopify checkout, see section 1.3.

• Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Each payment is processed as a so-called direct charge in the respective brand's own Stripe account. You enter your payment data (e.g. card number, expiry date, name, billing address, device data for fraud prevention) directly into an input field provided by Stripe; it is processed by Stripe and stored in the brand's Stripe account. STACKED does not receive full card data, only payment status, payment method, the last four digits and a token. Stripe is partly an independent controller for payment data (stripe.com/privacy). Transfers to Stripe, Inc. (USA): Data Privacy Framework and standard contractual clauses.
• Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden) – if you choose Klarna, identity, contact and order data are transmitted to Klarna via Stripe. Klarna is an independent controller and may carry out an identity and credit check (klarna.com privacy).
• Legal basis: Art. 6(1)(b) GDPR; fraud prevention Art. 6(1)(f) GDPR.

5.5 Google

• Google Ireland Limited – Google Analytics 4 (section 2.3) and Google Maps and Geocoding (section 2.4), each only with consent.

5.6 Authorities and advisers

Where required by law, we transmit data to authorities (e.g. tax authorities under the platform reporting obligation (PStTG) for seller data, market surveillance authorities, law enforcement upon order) and to tax advisers and lawyers bound by confidentiality. Legal basis: Art. 6(1)(c) or (f) GDPR.

We do not sell personal data.

6. Withdrawal function

If you withdraw from a contract via /widerruf, we process name, email address, order number, your message, time of declaration, IP address and browser identifier. We forward the declaration to the brand concerned and send you an acknowledgement.

• Purpose: receiving the declaration as the brand's receiving agent, evidence of content and time (§ 356a BGB).
• Legal basis: Art. 6(1)(c) GDPR in conjunction with § 356a BGB; Art. 6(1)(f) GDPR (evidence).
• Retention: 3 years from the end of the year of the declaration; the IP address is deleted after 90 days.

7. Notices of illegal content (DSA)

If you report content via /melden, we process the reported content, your explanation, the chosen category, your good-faith confirmation and – voluntarily – your name and email address. We use them to review and decide, to inform the brand concerned (without your contact details, except for infringements that can only be assessed with your identity, e.g. copyright or trademark infringements) and to notify you of our decision.

• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16, 17 DSA.
• Retention: 3 years after the case is closed.

8. Brands (sellers) and Shopify app

For brands we process contact and account data, company and tax data (company name, address, authorised representatives, commercial register, VAT ID, tax number, small-business status), Stripe account information (brands on the STACKED checkout), Shopify access tokens (encrypted), product data, billing data and correspondence.

• Purposes: performance of the platform agreement, issuing invoices and credit notes, verification of seller details (§ 22f UStG, Art. 30 DSA), reporting to the Federal Central Tax Office under the PStTG (DAC7).
• Legal basis: Art. 6(1)(b) and (c) GDPR.
• Retention: term of the agreement plus statutory retention periods (up to 10 years). After uninstalling the Shopify app the access token is deactivated immediately; shop data not subject to retention is deleted at the latest 48 hours after the Shopify shop/redact webhook. customers/data_request and customers/redact requests are handled within Shopify's deadlines.

9. Waitlist and contact

• Waitlist: email address, type of entry, website for brands, and evidence of consent (time, text version, language). Legal basis: Art. 6(1)(a) GDPR (buyers) or (b) (brands). Stored until withdrawal, at the latest 12 months after marketplace launch.
• Contact: if you write to us, we process your details to respond (Art. 6(1)(b) or (f) GDPR) and delete them once the matter is closed and no retention obligation applies.

10. Retention overview

• Order, invoice and accounting data: 8 or 10 years (§ 147 AO, § 257 HGB, § 14b UStG)
• Seller records under § 22f UStG: 10 years
• DAC7 reporting data: 10 years (§ 22 PStTG)
• Customer account: until deletion
• Withdrawal declarations, DSA notices: 3 years
• Cookie consent records: 3 years after the consent expires
• Email send log: 2 years
• Server logs: up to 30 days

11. Transfers to third countries

Some service providers are based in or process data in the USA (Vercel, Resend, Stripe, Google). Transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR). An adequacy decision exists for Shopify Inc. (Canada). You can request a copy of the safeguards.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

Contact info@stacked.clothing. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the alleged infringement.

13. Obligation to provide data, automated decisions

Providing the order data is required to conclude the contract; without it we cannot broker the order. STACKED does not carry out automated decision-making including profiling within the meaning of Art. 22 GDPR. When paying with Klarna, Klarna may carry out an automated credit check.

14. Changes

We update this privacy policy when our processing or the law changes. The version published here applies.