We use cookies to improve your experience and for marketing. Read our cookie policy & privacy policy.

GDPR Compliance

Stack Up & the GDPR

Our commitment to protecting your data under the General Data Protection Regulation.

Last Updated: January 8, 2026

At Stack Up, nothing is more important to us than our customers' success and the protection of their data. With customers across the globe, we go to great lengths to ensure our compliance with local privacy and data protection laws.

As an organization offering services to, and processing the personal data of, individuals in the EU, Stack Up has developed a robust privacy program in line with the requirements of European data protection laws, including the General Data Protection Regulation (GDPR).

Following Brexit, the GDPR was incorporated into local UK law, creating what is known as the "UK GDPR". Currently, the UK GDPR contains very similar requirements to the EU GDPR. When we refer to "the GDPR" we are referring both to the EU GDPR and to the UK GDPR.

Roles and Responsibilities

You as Data Controller

Customers using Stack Up's services to process personal data for their own purposes are typically considered the "Data Controller" and are primarily responsible for meeting applicable GDPR requirements.

Stack Up as Data Processor

Stack Up serves as its customers' "Data Processor" for the processing of personal data submitted onto the Stack Up platform. We process data only under your instructions.

The extent of our roles and responsibilities is further detailed in our Privacy Policy and Data Processing Agreement.

GDPR Principles We Follow

Our data processing activities adhere to the core principles established by the GDPR.

Lawfulness, Fairness & Transparency

We process personal data lawfully, fairly, and in a transparent manner, providing clear information about our data practices.

Purpose Limitation

Personal data is collected for specified, explicit, and legitimate purposes and not processed in ways incompatible with those purposes.

Data Minimization

We collect only the personal data that is necessary for the purposes for which it is processed.

Accuracy

We take reasonable steps to ensure personal data is accurate and kept up to date.

Storage Limitation

Personal data is retained only for as long as necessary for the purposes for which it was collected.

Integrity & Confidentiality

We implement appropriate security measures to protect personal data against unauthorized access, loss, or destruction.

How Stack Up Complies with the GDPR

At Stack Up, we regularly monitor and review our practices to ensure ongoing compliance with the GDPR, including by:

Data Processing Agreement

Robust DPA in place ensuring protection of personal data according to GDPR requirements.

Security Certifications

SOC 2 Type II, ISO 27001, and ISO 27018 certifications demonstrating our security commitment.

Sub-processor Management

Regular security and privacy assessments of all sub-processors to ensure GDPR adherence.

International Transfers

Standard Contractual Clauses (SCCs) in place for lawful international data transfers.

Transparency

Clear privacy policies and notices explaining our data collection and processing practices.

Ongoing Compliance

Regular monitoring, reviews, and updates to ensure continued GDPR compliance.

Additional Compliance Activities

Embedding a robust privacy program and regularly reviewing and updating policies and procedures to ensure the program remains appropriately targeted and fit for purpose.
Maintaining a vendor onboarding process requiring all vendors to comply with relevant data protection obligations.
Reviewing and strengthening our security infrastructure and processes, data encryption in transit and at rest, backup, logs, and security alerts.
Conducting periodical risk assessments and data mapping processes to ensure proper management of personal data in accordance with the GDPR's requirements.
Regularly monitoring guidance around GDPR compliance and ensuring ongoing compliance through internal procedures, processes, controls, and recurring internal training sessions.
Engaging external auditors to audit, on an annual basis, our various compliance certificates.
Notifying customers and Data Subjects when any substantive changes are made to public-facing policies.

Data Subject Rights

Under the GDPR, individuals have specific rights regarding their personal data. Stack Up supports these rights and provides tools and processes to help fulfill data subject requests.

Right of Access

Request a copy of personal data we hold about you

Right to Rectification

Request correction of inaccurate personal data

Right to Erasure

Request deletion of personal data under certain circumstances

Right to Restrict Processing

Request limitation of how we process your data

Right to Data Portability

Receive your data in a structured, machine-readable format

Right to Object

Object to processing based on legitimate interests

Rights Related to Automated Decision Making

Rights concerning automated profiling decisions

Right to Withdraw Consent

Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us at [email protected].

International Data Transfers

Stack Up may transfer personal data to countries outside of the European Economic Area (EEA). When we do so, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs): We enter into SCCs approved by the European Commission with customers and vendors for international data transfers.
Adequacy Decisions: Where applicable, we rely on adequacy decisions by the European Commission recognizing certain countries as providing adequate data protection.
Additional Safeguards: We implement supplementary measures where necessary to ensure the transferred data receives essentially equivalent protection.

Questions About GDPR Compliance?

If you have questions about our GDPR compliance practices or wish to exercise your data subject rights, our privacy team is here to help.

Contact Privacy Team View DPA