Privacy Policy
Last updated: 20 August 2026
1. Who we are
Staqq Ltd ("Staqq", "we", "us", "our") is a company registered in England and Wales (Company No. 17336294), with its registered office at Suite 7, 94 Chatsworth Road, Croydon, Surrey, CR0 1HB, United Kingdom.
For the purposes of UK data protection law, Staqq Ltd is the controller of the personal data described in this policy. Where Stripe processes payment and identity-verification data as part of providing the payment service, Stripe acts as an independent controller for that processing (see section 6).
We are registered with the Information Commissioner's Office (ICO), registration number ZC203848. You can contact us about privacy matters at info@staqq.co.uk.
2. Scope and legal framework
This policy explains how we collect, use, share and protect your personal data when you use the Staqq mobile application and the staqq.co.uk website. It is governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for cookies and electronic messages, the Privacy and Electronic Communications Regulations (PECR).
3. The personal data we collect
- Identity and contact data — your name, email address and (if you choose to provide it) your mobile number.
- Account data — your login credentials and any preferences you set.
- Transaction data — for payments you make or receive through the marketplace, we receive limited transaction information from Stripe (such as the amount, the merchant, the date and the payment status) so we can operate the marketplace and support you. We do not collect or store your full card number or bank account details — these are provided by you directly to Stripe.
- Merchant verification status — for merchants, identity-verification (KYC) documents and details are collected by Stripe directly during onboarding. Staqq does not collect or store these documents, but may receive verification status and account identifiers from Stripe.
- Device and technical data — device type, operating system, unique device identifiers and IP address.
- Usage data — how you interact with the app, features used and session information.
- Communications and preferences — your messages to us and your marketing choices.
4. How and why we use your data
We only use your personal data where the law allows. The table below sets out our purposes and the lawful basis for each:
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create and administer your account | Performance of a contract / legitimate interests |
| Connect you with merchants and facilitate payments processed by Stripe | Performance of a contract / legitimate interests |
| Send you service messages about your account and transactions | Performance of a contract / legitimate interests |
| Product analytics and service improvement | Legitimate interests |
| Keep the app and your account secure and prevent fraud or misuse | Legitimate interests / legal obligation |
| Marketing communications | Consent |
| Comply with legal and regulatory obligations | Legal obligation |
5. Marketing
Where we send marketing, we do so on the basis of your consent, which you can withdraw at any time using the unsubscribe link in any message or by contacting us. Withdrawing marketing consent does not affect service messages about your account or transactions, which we may need to send to operate your account.
6. Who we share your data with
- Stripe — our payment processor and, for merchants, the provider of onboarding and identity verification. We share the data necessary to enable payments and, for merchants, to create and verify a Stripe Connect account. Stripe acts as an independent controller for the payment processing and identity verification it carries out; its use of your data is governed by Stripe's own privacy policy.
- Merchants — where you transact with a merchant, we share the limited data needed to enable and record the transaction.
- Service providers — carefully selected suppliers (for example cloud hosting, communications and analytics) who process data on our instructions under written data-processing agreements.
- Regulators, authorities and law enforcement — where required by law, regulation or court order.
- Professional advisers and in a corporate transaction — for example auditors and lawyers, or a buyer/investor under confidentiality.
We do not sell your personal data.
7. International transfers
Where a provider (including Stripe) processes personal data outside the United Kingdom, we ensure an appropriate safeguard is in place — for example a UK adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Details are available on request.
8. Automated decision-making
Staqq does not carry out automated decision-making that produces a legal or similarly significant effect on you. As part of payment processing and identity verification, Stripe may carry out automated fraud, sanctions and verification checks; these are governed by Stripe's terms and privacy policy.
9. How long we keep your data
We keep your account and transaction data for as long as your account is active, and for a limited period afterwards to handle queries and meet our legal obligations, after which we securely delete or anonymise it. Identity-verification (KYC) records and the anti-money-laundering retention obligations that attach to them are held by Stripe as the regulated payment provider, under Stripe's own retention policies.
10. How we protect your data
We use appropriate technical and organisational measures, including encryption of data in transit and at rest, access controls, continuous monitoring and a documented incident-response process. Where a personal data breach is likely to result in a risk to your rights, we will notify the ICO and, where required, you.
11. Your rights
Subject to conditions and exemptions in UK data protection law, you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request erasure of your data (subject to our legal retention obligations).
- Request restriction of, or object to, certain processing.
- Data portability — receive certain data in a portable format.
- Withdraw consent where processing is based on consent.
To exercise any right, contact info@staqq.co.uk or use our account deletion request page. For payment or identity-verification data held by Stripe as an independent controller, you may need to exercise your rights directly with Stripe. We will respond within one month, and will tell you if we need longer for complex requests. There is normally no fee.
12. Cookies
Our website uses cookies. Strictly necessary cookies (for example those that maintain your session) are always on. Non-essential cookies (for example analytics) are only set with your consent, which you give through our cookie banner and can change at any time. Our separate Cookie Notice explains each cookie and its purpose.
13. Children
Staqq is intended for individuals aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it.
14. Complaints
If you have a concern about how we handle your personal data, please contact us first at info@staqq.co.uk so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
15. Changes to this policy
We may update this policy from time to time. We will notify you of material changes through the app or by email, and will update the "Last updated" date above.
16. Contact us
Staqq Ltd, Suite 7, 94 Chatsworth Road, Croydon, Surrey, CR0 1HB, United Kingdom. Email: info@staqq.co.uk.