1. Who we are

This Privacy Policy explains how Stacked Technologies Limited ("Stacked", "we", "us", "our") collects, uses, and protects your personal data when you use our website at wearestacked.io and our related services (together, the "Services").

Stacked Technologies Limited is a company registered in England and Wales (company number 14652073), with its registered office at Red Lion House, Farnham, GU10 5HY.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Stacked is the data controller for the personal data described in this policy.

If you have any questions about this policy or how we handle your data, contact us at hello@wearestacked.io (or [privacy@wearestacked.io] if you set up a dedicated address).

2. What we do

Stacked is a platform for the hospitality technology community. Our Services include: a marketplace of technology providers; the Approved certification and Stacked Operator Score (SOS); Stacked Chat and Health Check / tech audits; a podcast, blog, newsletter and events; a recruitment / jobs board; and advisory services. This policy covers all of them.

3. The personal data we collect

Depending on how you use the Services, we may collect:

• Identity and contact data — name, job title, employer/company, email address, telephone number, and (for providers) business details.
• Operator and audit data — the technology you use, reviews, ratings and Net Promoter Score (NPS) feedback you provide through Health Check / tech audits, which we use to generate category insights and the Stacked Operator Score.
• Partner / provider data — company profile, product information, logos, website, contact details and the tier you subscribe to.
• Account and transaction data — records of subscriptions, orders, and payment status. Card payments are processed by our payment provider (Stripe); we do not store full card numbers.
• Recruitment data — information contained in job listings and job applications.
• Event and content data — event registrations and ticketing, newsletter sign-ups, podcast and blog interactions.
• Communications — messages you send us, including via Stacked Chat, contact forms and email.
• Technical and usage data — IP address, device and browser information, and how you interact with our website, collected through cookies and similar technologies (see section 9).

We collect this data directly from you, and in some cases from your employer, from publicly available sources, or from partners who introduce you to us.

4. How and why we use your data (lawful bases)

We use personal data only where the law allows. Our lawful bases are:

• Contract — to provide the Services you or your organisation have signed up for: creating and managing marketplace listings and subscriptions, running the Approved process, processing payments, delivering advisory work, and handling event bookings and job applications.
• Legitimate interests — to operate, improve and secure our Services; to generate aggregated market intelligence and the Stacked Operator Score from audit and NPS data; to match operators with relevant providers; to send relevant updates to existing contacts; and to understand how our Services are used. Where we rely on legitimate interests, we balance those interests against your rights.
• Consent — to send marketing communications and newsletters where required, and to set non-essential cookies. You can withdraw consent at any time.
• Legal obligation — to comply with our legal and regulatory duties (for example accounting and tax).

A note on the Stacked Operator Score and intelligence: feedback and ratings you provide about technology are used to produce scores and category insights that may be shown publicly (for example, a star rating on a marketplace tile) and shared with the relevant provider as market intelligence. Where these outputs identify or could identify you, we treat them as personal data and only share them in line with this policy. Individual free-text responses are not published against your name without a lawful basis to do so.

5. Marketing communications

We may send you information about Stacked news, events, insights and offers. You can opt out at any time using the unsubscribe link in any email or by contacting us. We will always give you the choice to opt out of marketing.

6. Who we share your data with

We do not sell your personal data. We share it only with:

• Service providers (processors) who help us run the Services, under contracts that require them to protect your data. These currently include, for example: Airtable (data storage and syncing), Supabase (database), Stripe (payments), Framer (website hosting), Ticket Tailor (event ticketing), Spotify (podcast distribution), and our email/newsletter and analytics providers. A current list of our processors is available on request.
• Technology providers ("Partners") — where you ask to be contacted by, or submit an enquiry to, a provider, we share the details necessary to connect you. For free ("Lite") listings, enquiries come to Stacked rather than directly to the provider.
• Professional advisers, and authorities — where required by law, regulation, or to establish, exercise or defend legal claims.
• Business transfers — if Stacked is involved in a merger, acquisition or sale of assets, in which case your data may be transferred to the relevant party subject to this policy.

7. International transfers

Some of our service providers may process data outside the UK. Where they do, we ensure appropriate safeguards are in place (such as the UK International Data Transfer Agreement, UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision).

8. How long we keep your data

We keep personal data only as long as necessary for the purposes described in this policy, including to meet legal, accounting or reporting requirements. Retention periods vary by data type. [Insert your retention schedule, e.g. account data for the life of the account plus X years; enquiry data for X months; financial records for 6 years.]

9. Cookies

Our website uses cookies and similar technologies to make the site work, remember your preferences, and understand usage. Non-essential cookies (such as analytics) are set only with your consent. You can manage your preferences through our cookie banner or your browser settings. [Link to a separate Cookie Policy / cookie settings if you maintain one.]

10. Your rights

Under UK data protection law you have the right to: access your data; have inaccurate data corrected; have your data erased in certain circumstances; restrict or object to processing; data portability; and to withdraw consent where processing is based on consent. Where processing is based on legitimate interests, you can object to it.

To exercise any of these rights, contact us at hello@wearestacked.io. We will respond within the timescales required by law (usually one month). You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO) at ico.org.uk, though we'd ask you to contact us first so we can try to help.

11. How we protect your data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. No system is completely secure, but we work to keep your data safe and to notify you and the relevant authority of any breach where required by law.

12. Children

Our Services are intended for professionals and businesses and are not directed at children under 18. We do not knowingly collect data from children.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a revised "Last updated" date, and where changes are significant we will take reasonable steps to notify you.

14. Contact us

Stacked Technologies Limited Registered office: Red Lion House, Farnham, GU10 5HY Company number: 14652073 Email: hello@wearestacked.io