CrateFlo
Privacy

Your data.
Handled carefully.

Effective date: 22 July 2026

Complete before publication Add your legal entity, registered address, VAT number, processors, analytics tools, cookie tools and actual retention periods before publishing.

1. Who controls your data

The controller is [FULL LEGAL ENTITY NAME], trading as CrateFlo, registered at [REGISTERED ADDRESS], company number [COMPANY NUMBER] and VAT number [VAT NUMBER].

Privacy contact: privacy@crateflo.com or hello@crateflo.com.

2. Personal data we collect

Depending on how you use CrateFlo, we may collect:

  • Identity and business data, including names, company details, tax details and authorised-user information.
  • Contact data, including email addresses, telephone numbers, billing addresses and shipping addresses.
  • Account and authentication data, including account IDs, login records and security information.
  • Order and fulfilment data, including products, SKUs, quantities, buyer notes, delivery instructions, tracking numbers and returns.
  • Financial and transaction data, including invoices, wallet entries, payment status and limited payment-method information supplied by payment providers.
  • Technical data, including IP address, browser, device, logs, API events and website usage.
  • Communications, support requests, feedback and records of instructions.

3. Where data comes from

We receive data directly from account holders and website visitors, and from stores or platforms they connect to CrateFlo, such as Bandcamp, Discogs, Shopify and Acid Nation.

We may also receive data from carriers, payment providers, fraud-prevention providers, analytics services, business partners and public company registers.

4. Why we use personal data

PurposeTypical legal basis
Open and manage accountsContract and legitimate interests
Import, validate, fulfil and track ordersContract; legitimate interests; legal obligations
Process billing, wallet charges and invoicesContract and legal obligations
Provide support and operational noticesContract and legitimate interests
Prevent fraud, abuse and security incidentsLegitimate interests and legal obligations
Improve services and analyse performanceLegitimate interests; consent where required
Send marketing communicationsConsent or legitimate interests where permitted
Comply with tax, customs, sanctions and legal requestsLegal obligations and public interest

5. Customer order data and processor role

When a label or merchant sends us its customer order data for fulfilment, that merchant will normally be the controller and CrateFlo will process the data on its behalf as a processor.

We process customer names, contact details, delivery addresses, order contents and shipping information only as needed to fulfil orders, provide support, prevent fraud, meet legal obligations and follow documented instructions.

Business customers may be required to enter into a separate Data Processing Agreement with CrateFlo.

6. Who receives personal data

We may share data where necessary with:

  • Carriers, postal operators, customs brokers and warehouse partners.
  • Payment processors, banks, accounting and invoicing providers.
  • Cloud hosting, database, security, communications and technical-support providers.
  • Connected platforms at the account holder’s instruction.
  • Professional advisers, insurers, auditors and potential corporate transaction counterparties.
  • Courts, regulators, customs, tax authorities and law enforcement where legally required.

We do not sell personal data.

7. International data transfers

Some service providers or fulfilment activities may involve countries outside the European Economic Area. Where required, we use an approved transfer mechanism, such as an adequacy decision or standard contractual clauses, together with appropriate safeguards.

8. How long we keep data

We keep personal data only for as long as needed for the purposes described above, including:

  • Account data: while the account is active and generally for [X years] afterward.
  • Orders, invoices and tax records: for the period required by applicable accounting and tax law.
  • Support and operational records: generally for [X months/years].
  • Security logs: generally for [X days/months], unless needed to investigate an incident.
  • Marketing data: until consent is withdrawn or an objection is made.

Data may be retained longer where necessary for a dispute, legal hold, fraud investigation or regulatory obligation.

9. Your data protection rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection to processing. You may withdraw consent at any time where processing relies on consent.

To exercise a right, email privacy@crateflo.com. We may need to verify your identity.

You may also complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

10. Security

We use technical and organisational measures designed to protect personal data, including access controls, authentication, logging, encryption where appropriate, backups, vendor controls and incident-response procedures.

No method of storage or transmission is completely secure. Account holders must also protect credentials and authorised-user access.

11. Cookies and analytics

CrateFlo may use essential cookies required for security, sessions and website operation. Analytics, advertising or preference cookies will be used only as described in our cookie notice and, where required, after consent.

[Add a Cookie Policy and cookie-consent tool before enabling non-essential cookies.]

12. Children

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children through account registration.

13. Changes to this policy

We may update this Privacy Policy. We will post the revised version and update the effective date. Material changes may also be communicated by email or through the dashboard.

14. Contact

For privacy questions or requests, contact privacy@crateflo.com.