Privacy Policy

Who is responsible for your information

Gastby, trading as Gatsby, is the controller of the personal information described in this policy. Our registered address is Aalsmeerweg 92 1059 Amsterdam. You can contact us about privacy at privacy@gatsby.com.

This policy applies when you visit the Gatsby marketplace, create or use a buyer or manufacturer account, submit a product or design request, place or fulfil an order, contact us, or otherwise use our services.

Information we collect

Account and business information includes your name, email address, login identifiers, business name, role, contact details, billing and delivery addresses, buyer or manufacturer profile, approval status, and communications with us.

Marketplace and transaction information includes products, quotations, custom-design requests, uploaded drawings or logos, order contents, prices, payment and refund status, delivery information, commissions, payouts, disputes, and the actions taken through your account.

Technical information includes IP address, device and browser information, timestamps, request and security logs, cookie or browser-storage identifiers, and information about how the marketplace performs. We do not directly store complete payment-card details; Stripe processes those details for us.

Where information comes from

Most information comes directly from you. We also receive transaction and payment-status information from Stripe, authentication information from Supabase, order or fulfilment information from the businesses involved in a transaction, and technical information generated when you use the marketplace.

Why we use information and our lawful bases

We process account, order, payment-status, delivery, quotation, and support information because it is necessary to provide the marketplace and perform our contract with you, or to take steps you request before entering a contract.

We process transaction records, tax information, and information required by authorities to comply with legal obligations. We process service, security, fraud-prevention, audit, and limited performance information for our legitimate interests in operating a safe, reliable, and commercially sustainable marketplace. Where the law requires consent, we rely on consent and you may withdraw it at any time without affecting earlier processing.

If you do not provide information marked as required, we may be unable to create your account, process an order, arrange payment or delivery, or provide the requested service.

How marketplace participants receive information

When a buyer and manufacturer transact, we share the information reasonably needed to quote, produce, pay for, fulfil, deliver, support, or resolve that transaction. This can include business contact details, delivery information, order specifications, and relevant communications.

A buyer or manufacturer that receives information for its own business purposes may be a separate controller of that information. Its handling of the information is then governed by its own privacy obligations and policies.

Service providers and other disclosures

We use service providers to operate the marketplace, including Stripe for payment processing, Supabase for authentication and data services, Render for backend hosting, and Vercel for frontend hosting. We may also use providers for storage, email, security, monitoring, support, and professional advice. They receive only the information needed for their role and are required to protect it as applicable.

We may disclose information when required by law, regulation, court order, or a lawful request; to protect people, rights, property, payments, or the marketplace; in connection with a dispute; or as part of a merger, financing, acquisition, reorganisation, or sale of all or part of the business. We do not sell personal information.

International transfers

Some marketplace participants or service providers may process information outside your country, the European Economic Area, or the United Kingdom. Where data-protection law requires it, we use an adequacy decision, approved contractual safeguards such as standard contractual clauses, or another lawful transfer mechanism. You may contact us for information about the safeguards relevant to your information.

How long we keep information

We retain account information while the account is active and for a reasonable period afterwards. We retain orders, payments, commissions, payouts, invoices, and related records for the periods required by tax, accounting, anti-fraud, and legal-claims rules. Support, security, and technical records are kept only as long as reasonably needed for their purpose.

When deciding a retention period, we consider the amount and sensitivity of the information, the risk of harm, why we need it, whether the purpose can be achieved another way, and applicable legal requirements. We delete or anonymise information when it is no longer required, unless preservation is legally necessary.

Security

We use reasonable technical and organisational measures designed to protect personal information, including access controls, authenticated services, transport encryption, restricted storage, and operational monitoring. No online service is completely secure, so you should use a strong password, protect your account credentials, and contact us if you suspect unauthorised access.

Your privacy rights

Depending on where you live and the lawful basis involved, you may have rights to access, correct, erase, restrict, or receive a portable copy of your personal information, and to object to certain processing. Where we rely on consent, you may withdraw it at any time. You also have an unconditional right to object to processing for direct marketing.

To exercise a right, contact us at privacy@gatsby.com. We may ask for information needed to confirm your identity and protect your account. Some rights are subject to legal exceptions, including where records must be kept for transactions, tax, fraud prevention, legal claims, or the rights of others.

Automated decisions and children

Gatsby does not currently make decisions based solely on automated processing that produce legal or similarly significant effects. We may use automated signals to support security and fraud detection, with appropriate human review where required.

The marketplace is intended for businesses and is not directed to children. You must be legally able and authorised to act for the business using the service.

Complaints, questions, and updates

Please contact Gatsby at privacy@gatsby.com first if you have a question or concern. You also have the right to complain to the data-protection authority where you live or work, or where you believe a breach occurred. Our lead supervisory authority is Autoriteit Persoonsgegevens.

We may update this policy when our services, providers, or legal obligations change. We will publish the revised policy here, update the date above, and provide additional notice when a change materially affects how we use personal information.