Last updated: 1 July 2026
This Privacy Policy explains how Stocklane B.V. ("Stocklane", "we", "us") collects, uses and protects personal data when you use the Stocklane platform. It is written to comply with the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and applicable Dutch privacy law.
Stocklane B.V., incorporated in The Netherlands, is the data controller for personal data collected via the Stocklane account and public-facing website (stocklane.eu). For personal data of B2B buyers submitted through a wholesaler's Portal, Stocklane acts as a data processor on behalf of that wholesaler (the "Seller"). See our Data Processing Agreement for the details of that relationship.
We collect: • Account data: name, work email, company name, hashed password, preferred language, subscription plan. • Usage data: sign-in timestamps, IP address, browser type, feature usage (for security and product analytics). • Portal & product data: uploaded stock lists, product images, portal configuration. • Order data submitted by buyers: company name, work email, order line items, order totals. • Payment metadata (when online payments are enabled): Stripe payment intent identifiers and payment status — Stocklane never stores raw card numbers.
We process personal data on the following GDPR bases: • Performance of a contract (Art. 6(1)(b)) — providing the Stocklane platform to you. • Legitimate interests (Art. 6(1)(f)) — securing the platform, preventing fraud, product analytics. • Compliance with legal obligations (Art. 6(1)(c)) — tax, accounting, and lawful requests. • Consent (Art. 6(1)(a)) — non-essential cookies and marketing emails, where applicable.
To operate the platform we use vetted sub-processors bound by written data processing agreements: • Supabase (EU region) — database, authentication and file storage. • Cloudflare — content delivery and DDoS protection. • Stripe Payments Europe, Ltd. — payment processing when online payments are enabled. • Resend / SendGrid — transactional email delivery. An up-to-date list is available on request at legal@stocklane.eu.
Personal data is stored in the European Union. Where a sub-processor is established outside the EU/EEA, transfers are covered by the European Commission's Standard Contractual Clauses (2021/914) with supplementary technical measures where required by the Schrems II ruling.
Account data is retained for the life of the account and up to 12 months after termination for accounting purposes. Buyer personal data attached to orders is automatically anonymised 30 days after the corresponding Portal is closed. Server access logs are retained for 90 days for security.
You have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Requests can be sent to dpo@stocklane.eu and are handled within one month.
We apply appropriate technical and organisational measures: TLS 1.2+ in transit, encryption at rest, least-privilege access, row-level security in our database, mandatory 2FA for staff with production access, and continuous logging & monitoring.
We use strictly necessary cookies to keep you signed in and to secure sessions. Analytics cookies are only set with your consent via the cookie banner. No advertising cookies are used.
We will notify you of material changes to this Policy by email or in-app notice at least 14 days before they take effect.
Data Protection Officer — dpo@stocklane.eu. General privacy questions — legal@stocklane.eu.