Privacy Policy

1. Who We Are

Brands & Pieces operates the marketplace at brandsandpieces.com. We are the data controller for the personal data we collect about you. Our primary markets are Sweden, Norway, and Denmark, and we operate under applicable EU/EEA data protection law, including the General Data Protection Regulation (GDPR).

Questions? Contact us at hello@brandsandpieces.com.

2. Data We Collect

We collect the following categories of personal data:

• Account data: email address, first name, last name, and company name (if applicable), country, city, and optional bio and profile photo.
• Transaction data: order history, shipping addresses, payment method type (e.g. card brand and last four digits — full card details are handled by Stripe and never stored by us).
• Communication data: messages sent through the platform between buyers and sellers.
• Listing data: item descriptions, photos, and pricing that sellers upload.
• Usage data: pages visited, actions taken, and timestamps, used to operate and improve the platform.
• Device data: browser type, operating system, and IP address, used for security and fraud prevention.

3. How We Use Your Data

We process your personal data for the following purposes:

• Providing the service – creating and managing your account, processing orders and payments, and facilitating communication between buyers and sellers. Legal basis: performance of a contract.
• Platform security & fraud prevention – detecting and preventing abuse, fraud, and policy violations. Legal basis: legitimate interests.
• Legal compliance – meeting our obligations under applicable laws, including tax and consumer protection law. Legal basis: legal obligation.
• Service communications – sending transactional emails about your orders, account status, and security. Legal basis: performance of a contract / legitimate interests.
• Platform improvements – understanding how users interact with the platform to improve it. Legal basis: legitimate interests.

We do not use your data for advertising, sell it to third parties, or share it for any purpose beyond what is described in this policy.

4. Cookies & Session Data

Brands & Pieces uses only functional, first-party cookies. These are strictly necessary for the platform to operate — specifically to keep you logged in during a session.

We do not use advertising cookies, analytics trackers, or any third-party tracking technologies. No data from cookies is shared with third parties.

5. Third Parties We Work With

We share personal data with a small number of trusted service providers who help us operate the platform:

• Stripe – payment processing. Stripe receives your payment information directly and is subject to its own privacy policy. We receive only a tokenised reference and card summary.
• Resend – transactional email delivery. We share your email address and name to send order and account emails.
• Vercel / cloud hosting – we host the platform on cloud infrastructure. Servers are located within the EU/EEA.

All third-party processors are bound by data processing agreements that comply with GDPR requirements.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where we are required to retain it by law (for example, transaction records for tax purposes, which we retain for 7 years in accordance with Swedish bookkeeping law).

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access – request a copy of the personal data we hold about you.
• Rectification – ask us to correct inaccurate or incomplete data.
• Erasure – request deletion of your data, subject to our legal retention obligations.
• Portability – receive your data in a structured, machine-readable format.
• Restriction – ask us to pause processing of your data in certain circumstances.
• Objection – object to processing based on legitimate interests.

To exercise any of these rights, contact us at hello@brandsandpieces.com. We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection authority. In Sweden: Integritetsskyddsmyndigheten (IMY). In Norway: Datatilsynet. In Denmark: Datatilsynet.

8. Children

The platform is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy as the platform evolves or legal requirements change. We will notify you of material changes by email before they take effect. The “last updated” date at the top of this page always reflects the current version.

10. Contact

For any privacy-related questions or requests, reach us at hello@brandsandpieces.com.

For the rules governing use of the platform, see our Terms of Service.