Global Privacy Notice
Last Updated: 5 October 2025
Effective Date: 5 October 2025
Multi-Jurisdictional Notice: This Privacy Notice complies with data protection laws in the European Union (GDPR), United Kingdom (UK GDPR), United States (including California, Virginia, Colorado, Connecticut, Utah, and other state laws), Canada (PIPEDA), Australia (Privacy Act 1988), New Zealand (Privacy Act 2020), and India (DPDPA 2023). Please read the sections applicable to your location.
Find Your Region
PART A: Universal Provisions (All Regions)
1. Who We Are (Data Controller / Business)
1.1 Stampier is the entity responsible for collecting, using, and protecting your personal information/personal data when you use our loyalty program platform and services (the "Services").
Business Details:
Trading Name: Stampier
Legal Entity: Terrene Tech
Type: Proprietary Firm (India)
Proprietor: Sanchit Varshney
Registered Address:
Behjoi Road, Hayatnagar
Sambhal, Uttar Pradesh 244302
India
GST Number: 09AYTPV7980M1ZW
1.2 Legal Roles:
- EU/UK: We are the "data controller" under GDPR and UK GDPR
- USA: We are a "business" under California CCPA/CPRA and similar state laws
- Canada: We are an "organization" under PIPEDA
- Australia: We are an "APP entity" under the Privacy Act 1988
- New Zealand: We are an "agency" under the Privacy Act 2020
- India: We are a "data fiduciary" under DPDPA 2023
1.3 EU & UK Representatives (GDPR Article 27):
Note: With our primary data storage located in Helsinki, Finland (EU), we maintain EU data residency compliance. However, as our company is registered in India, we are in the process of appointing GDPR Article 27 representatives.
Appointment Timeline:
- EU Representative: To be appointed within 6 months (target: Q3 2025)
- UK Representative: To be appointed within 6 months (target: Q3 2025)
- Current Contact: EU/UK residents may contact our Data Protection Officer at dpo@stampier.co
This Notice will be updated with representative contact details once appointments are finalized. Subscribe to updates: legal@stampier.co
2. Personal Information We Collect
Terminology Note: We use "personal information" and "personal data" interchangeably throughout this Notice. Both terms refer to information about an identified or identifiable individual.
2.1 We collect the following categories of personal information:
Identity Information
- Full name (first, last)
- Username/display name
- Date of birth (if provided)
- Title/designation
Contact Information
- Email address
- Phone number
- Business name & address
- Postal/mailing address
Financial Information
- Payment method (card type, last 4 digits)
- Billing address
- Transaction history
- Tax/VAT numbers
Note: Full card numbers are processed by our payment provider (Stripe) and never stored by us.
Technical Information
- IP address & geolocation
- Browser type & version
- Device type & OS
- Cookies & tracking data
- Login/authentication tokens
Usage Information
- Pages viewed & features used
- Session duration & frequency
- Click patterns & navigation
- Actions taken (stamps, redemptions)
- Error logs & diagnostics
Marketing & Communications
- Marketing preferences & consents
- Email engagement metrics
- Survey responses & feedback
- Support communications
Sensitive Personal Information
We do NOT intentionally collect "sensitive" personal information such as:
- Racial or ethnic origin, political opinions, religious beliefs
- Health data, genetic data, biometric data (for ID purposes)
- Sexual orientation or sex life information
- Social Security numbers, driver's license numbers, passport numbers
- Precise geolocation (within 1,850 feet/California definition)
- Financial account login credentials
If you accidentally provide such information, please contact us immediately at privacy@stampier.co so we can delete it.
2.2 Business Customer Data (B2B Processing):
If you are a business user, you may upload personal information of your end-user customers to our platform. In these cases:
- You act as the data controller/business/organization
- We act as the data processor/service provider
- Our obligations are detailed in our Data Processing Agreement (DPA), which includes EU Standard Contractual Clauses and UK IDTA
3. How We Use Your Personal Information
3.1 We use your personal information for the following purposes:
🛠️ Service Delivery & Account Management
- Create and maintain your account
- Provide access to loyalty program features
- Process stamp collection and reward redemptions
- Generate and manage QR codes
- Deliver customer support
💳 Payment Processing & Billing
- Process subscription payments
- Issue invoices and receipts
- Manage refunds and billing disputes
- Maintain financial records for tax/accounting
🔒 Security & Fraud Prevention
- Detect and prevent fraudulent transactions
- Monitor for security threats
- Protect against unauthorized access
- Enforce our Terms of Service
📊 Analytics & Service Improvement
- Analyze usage patterns and trends
- Improve user experience and interface
- Develop new features
- Conduct performance optimization
📧 Marketing & Communications
- Send product updates to existing customers
- Deliver marketing emails (with your consent)
- Provide information about new services
- Invite survey participation
Note: You can opt-out of marketing at any time using the unsubscribe link in our emails.
⚖️ Legal & Regulatory Compliance
- Comply with tax, accounting, and financial regulations
- Respond to legal requests and court orders
- Meet anti-money laundering requirements
- Fulfill data protection obligations
4. Who We Share Personal Information With
WE DO NOT SELL OR RENT YOUR PERSONAL INFORMATION
We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We do not "sell" or "share" personal information as defined by California CCPA/CPRA or other US state privacy laws.
4.1 We may share your personal information with the following categories of recipients:
| Recipient Category | Purpose | Examples |
|---|---|---|
| Cloud Hosting Providers | Infrastructure, data storage, application hosting | AWS, DigitalOcean, Google Cloud |
| Payment Processors | Process subscription payments securely | Stripe |
| Email Service Providers | Transactional and marketing emails | SendGrid, Mailgun |
| Analytics Providers | Usage analytics, platform monitoring | Google Analytics (with IP anonymization) |
| Customer Support Tools | Help desk, ticketing system | Zendesk, Intercom |
| Professional Advisors | Legal, accounting, audit services | Lawyers, accountants, auditors |
| Law Enforcement / Regulators | When required by law or court order | Government authorities, courts |
| Business Acquirers | In event of merger, acquisition, sale | Potential buyers, investors |
4.2 Service Provider Obligations:
All third-party service providers we engage are contractually required to:
- Process personal information only on our documented instructions
- Implement appropriate security measures
- Comply with applicable data protection laws (GDPR, UK GDPR, PIPEDA, CCPA, etc.)
- Execute written data processing agreements with us
- Notify us of any data breaches without undue delay
- Not use your data for their own purposes
5. International Data Transfers
Important Notice About Cross-Border Transfers:
Our primary operations are based in India. Personal information collected from users in the EU, UK, USA, Canada, Australia, and New Zealand is transferred to and processed in India and may also be transferred to other countries where our service providers operate (including the United States).
5.1 Transfer Safeguards:
When we transfer personal information across borders, we ensure adequate protection through the following mechanisms:
🇪🇺 🇬🇧 For EU & UK Transfers:
- Standard Contractual Clauses (SCCs) - 2021 EU Commission-approved clauses
- UK International Data Transfer Agreement (IDTA) - UK ICO-approved mechanism
- Transfer Impact Assessments (TIAs) - Conducted to ensure adequate protection
- Additional Safeguards - Encryption, access controls, pseudonymization
🇺🇸 For US Transfers:
- Intra-US Transfers - Governed by contractual agreements
- To India - Contractual clauses with technical safeguards
- EU-US Data Privacy Framework - Used where service providers participate
🇨🇦 For Canadian Transfers:
- Comparable Protection Assessment - Verification of adequate safeguards
- Contractual Measures - Written agreements with all recipients
- Consent - Where required under PIPEDA
🇦🇺 🇳🇿 For Australia & New Zealand Transfers:
- Reasonable Steps - Ensuring overseas recipients comply with privacy principles
- Contractual Obligations - Written agreements with service providers
- Accountability - We remain responsible for transferred data
5.2 Data Storage Location:
Primary Data Residency: All personal data is primarily stored and processed in Helsinki, Finland (European Union). This ensures GDPR compliance and provides EU/EEA data subjects with adequate data protection.
5.3 Limited Third-Country Processing:
- Finland (EU) - Primary data storage and application hosting
- United States - Limited transfers for payment processing (Stripe) with EU SCCs protection
- India - Company operations and support (no personal data storage)
- Other Locations - Only as disclosed with appropriate safeguards
5.4 Requesting Transfer Documentation:
You may request copies of the safeguards we have in place for international transfers by contacting privacy@stampier.co. We will provide appropriate documentation, which may be redacted to protect confidential business information.
6. How We Protect Your Information
6.1 We implement industry-standard technical and organizational security measures to protect your personal information:
Technical Safeguards
- Encryption in transit (TLS/SSL)
- Encryption at rest
- Secure authentication (multi-factor where available)
- Regular security audits & vulnerability assessments
- Firewall protection
- Intrusion detection systems
Organizational Safeguards
- Access controls (need-to-know basis)
- Employee training on data protection
- Confidentiality agreements with staff
- Regular backups & disaster recovery
- Incident response procedures
- Third-party security assessments
Security Limitation Disclaimer: While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security. We strive to protect your personal information but cannot ensure or warrant the security of any information you transmit to us.
6.2 Your Security Responsibilities:
- Keep your password confidential and secure
- Do not share your account credentials
- Log out after using shared devices
- Report suspicious activity immediately
- Keep your contact information up to date
7. How Long We Keep Your Information
7.1 We retain your personal information only as long as necessary for the purposes outlined in this Notice and to comply with legal obligations.
| Data Category | Retention Period | Reason |
|---|---|---|
| Active Account Data | Duration of account + 90 days | Service provision, account recovery period |
| Financial/Transaction Records | 7 years from transaction date | Tax, accounting, and legal requirements |
| Marketing Data | Until consent withdrawn or opt-out | Marketing purposes with consent |
| Analytics Data | 26 months (Google Analytics default) | Service improvement, anonymized after period |
| Support Communications | 3 years from last interaction | Customer service quality, dispute resolution |
| Legal/Compliance Data | As required by law (varies) | Regulatory compliance, litigation |
7.2 Account Deletion:
When you close your account or request deletion:
- Active account data will be deleted or anonymized within 90 days
- Backup copies will be removed in accordance with our backup rotation schedule (maximum 180 days)
- Financial records will be retained for 7 years as legally required
- Anonymized analytics data may be retained indefinitely
7.3 Exceptions:
We may retain certain information longer when required by law or legitimate business purposes, including:
- Fraud prevention and security purposes
- Resolving disputes or enforcing agreements
- Complying with legal obligations (tax, audit, regulatory)
- Responding to legal claims or investigations
🇪🇺 🇬🇧 PART B1: European Union & United Kingdom (GDPR)
8. Legal Basis for Processing (EU/UK)
8.1 Under GDPR and UK GDPR, we must have a valid legal basis to process your personal data. We rely on the following:
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Account creation and service delivery | Contract performance (Article 6(1)(b)) | GDPR Art. 6(1)(b) |
| Payment processing, invoicing, tax compliance | Contract performance & Legal obligation | Art. 6(1)(b), 6(1)(c) |
| Marketing communications (email campaigns) | Consent (Article 6(1)(a)) | Art. 6(1)(a) |
| Service improvement, analytics, product development | Legitimate interests (Article 6(1)(f)) | Art. 6(1)(f) |
| Fraud prevention, security monitoring | Legitimate interests (Article 6(1)(f)) | Art. 6(1)(f) |
| Legal requests, regulatory compliance | Legal obligation (Article 6(1)(c)) | Art. 6(1)(c) |
8.2 Legitimate Interests:
Where we process your data based on legitimate interests, we have balanced our interests against your rights. Our legitimate interests include:
- Operating and improving our platform
- Ensuring network and information security
- Preventing fraud and abuse
- Understanding customer needs and preferences
- Direct marketing to existing customers (soft opt-in)
You have the right to object to processing based on legitimate interests. Contact privacy@stampier.co to exercise this right.
9. Your Rights Under GDPR & UK GDPR
9.1 EU and UK residents have the following rights regarding their personal data:
Right of Access (Art. 15)
Request a copy of your personal data and information about how we process it.
Right to Rectification (Art. 16)
Correct inaccurate personal data or complete incomplete data.
Right to Erasure (Art. 17)
Request deletion of your personal data ("right to be forgotten"), subject to legal exceptions.
Right to Restriction (Art. 18)
Limit how we use your data in certain circumstances (e.g., while disputing accuracy).
Right to Data Portability (Art. 20)
Receive your data in a machine-readable format and transfer it to another provider.
Right to Object (Art. 21)
Object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent (Art. 7)
Withdraw consent at any time where we process data based on consent.
Automated Decision-Making (Art. 22)
Not be subject to decisions based solely on automated processing. (We do not engage in this.)
9.2 How to Exercise Your Rights:
To exercise any of these rights, email us at privacy@stampier.co with:
- Your full name and email address
- The specific right you wish to exercise
- Any relevant details or information
- Proof of identity (if requested for security)
Response Time: We will respond within 1 month of receiving your request. This may be extended by 2 additional months for complex requests.
Free of Charge: Requests are free. We may charge a reasonable fee for manifestly unfounded or excessive requests.
10. Supervisory Authorities & Complaints (EU/UK)
10.1 You have the right to lodge a complaint with a data protection supervisory authority.
🇬🇧 UK Supervisory Authority:
Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, UK
🇪🇺 EU Supervisory Authorities:
You may complain to the data protection authority in your EU member state. Find your local authority:
Before lodging a complaint: We encourage you to contact us first at privacy@stampier.co so we can try to resolve your concerns directly.
🇺🇸 PART B2: United States (CCPA/CPRA & State Laws)
11. Your Rights Under US State Privacy Laws
11.1 Applicable Laws:
This section applies to residents of states with comprehensive privacy laws, including:
- California: California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)
- Virginia: Virginia Consumer Data Protection Act (VCDPA)
- Colorado: Colorado Privacy Act (CPA)
- Connecticut: Connecticut Data Privacy Act (CTDPA)
- Utah: Utah Consumer Privacy Act (UCPA)
- Other States: Laws enacted after this Notice's effective date
11.2 Your Privacy Rights:
🔍 Right to Know / Access
Request disclosure of the personal information we collected, used, disclosed, or sold about you in the past 12 months.
✏️ Right to Correction
Request correction of inaccurate personal information we maintain about you.
🗑️ Right to Deletion
Request deletion of personal information we collected from you, subject to legal exceptions.
📥 Right to Data Portability
Request a copy of your personal information in a portable, readily usable format (California, Virginia, Colorado, Connecticut).
🚫 Right to Opt-Out of Sale/Sharing
Opt out of the "sale" or "sharing" of your personal information for targeted advertising. Note: We do not sell or share your data.
🛡️ Right to Limit Sensitive Personal Information
Limit use of sensitive personal information (California). Note: We do not collect sensitive PI for purposes requiring limitation.
⚖️ Right to Non-Discrimination
We will not discriminate against you for exercising your privacy rights (no denial of service, different prices, or reduced quality).
11.3 How to Exercise Your Rights:
Submit a request by:
- Email: privacy@stampier.co
- Subject Line: "Privacy Rights Request - [State]"
Response Time: We will respond within 45 days (California, Virginia, Colorado, Connecticut, Utah). May be extended by 45 additional days with notice.
Verification: We will verify your identity before fulfilling requests. You may be asked to provide:
- Your name and email address associated with your account
- Recent account activity details
- Government-issued ID (for sensitive requests)
Authorized Agents: California residents may designate an authorized agent to make requests on your behalf. The agent must provide written authorization or power of attorney.
12. California-Specific Disclosures (CCPA/CPRA)
12.1 Categories of Personal Information Collected (Last 12 Months):
| Category | Collected? | Sold/Shared? |
|---|---|---|
| Identifiers (name, email, IP address) | ✓ Yes | ✗ No |
| Commercial information (transactions, purchase history) | ✓ Yes | ✗ No |
| Internet/network activity (browsing, usage data) | ✓ Yes | ✗ No |
| Geolocation data (approximate, not precise) | ✓ Yes | ✗ No |
| Sensitive personal information | ✗ No | ✗ No |
We Do NOT Sell or Share Your Personal Information
Stampier does NOT sell or share personal information as defined by California law. We do not:
- Sell your data to third parties for monetary consideration
- Share your data for cross-context behavioral advertising
- Provide data to data brokers or advertising networks for their own use
Result: You do not need to opt out of sale/sharing because we don't engage in these practices.
12.2 "Shine the Light" Law (California Civil Code § 1798.83):
California residents may request information about disclosures of personal information to third parties for direct marketing purposes. Since we do not share personal information for third-party direct marketing, this does not apply.
12.3 California Financial Incentive Notice:
We do not offer financial incentives or price differences related to the collection, retention, or sale of personal information.
🇨🇦 PART B3: Canada (PIPEDA)
13. Your Rights Under PIPEDA
13.1 The Personal Information Protection and Electronic Documents Act (PIPEDA) grants Canadian residents the following rights:
📋 Right to Know
You have the right to know what personal information we hold about you, how it's used, and to whom it has been disclosed.
👁️ Right of Access
Request access to your personal information. We will provide it within 30 days, subject to limited exceptions.
✏️ Right to Correction
Challenge the accuracy and completeness of your information and have it corrected as appropriate.
🚫 Right to Withdraw Consent
Withdraw your consent at any time, subject to legal or contractual restrictions. We will inform you of the implications.
📧 Right to Opt-Out of Marketing
Unsubscribe from marketing communications at any time using the unsubscribe link in our emails.
13.2 Consent Under PIPEDA:
We obtain your consent before or when we collect, use, or disclose your personal information, except where permitted by law. Consent may be:
- Express consent: You explicitly agree (e.g., checking a box, signing a form)
- Implied consent: Your consent is inferred from your actions (e.g., providing information for account creation)
The form of consent depends on the sensitivity of the information and your reasonable expectations.
13.3 How to Exercise Your Rights:
Contact us at:
- Email: privacy@stampier.co
- Subject Line: "PIPEDA Privacy Request"
We will respond within 30 days of receiving your request.
14. Complaints to the Privacy Commissioner
14.1 If you believe we have not complied with PIPEDA, you may file a complaint with the Office of the Privacy Commissioner of Canada.
Office of the Privacy Commissioner of Canada
Website: www.priv.gc.ca
Toll-Free: 1-800-282-1376
Address: 30 Victoria Street, Gatineau, Quebec K1A 1H3, Canada
Filing a Complaint: Report a Concern
We encourage you to contact us first at privacy@stampier.co so we can address your concerns directly.
🇦🇺 🇳🇿 PART B4: Australia & New Zealand
15. Your Rights Under Australian Privacy Principles (APPs)
15.1 The Privacy Act 1988 (Australia) and Australian Privacy Principles (APPs) grant Australian residents the following rights:
🔍 Right to Access (APP 12)
Request access to your personal information. We will provide it within 30 days.
✏️ Right to Correction (APP 13)
Request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading information.
🌍 Right to Know About Overseas Disclosures (APP 8)
Be informed when your personal information is disclosed overseas (see Section 5 above).
📧 Right to Opt-Out of Marketing
Opt out of direct marketing communications. Use the unsubscribe link in our emails.
15.2 How to Exercise Your Rights:
Contact us at privacy@stampier.co with "Australian Privacy Request" in the subject line. We will respond within 30 days.
15.3 Complaints to OAIC:
Office of the Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Filing a Complaint: Privacy Complaints
16. Your Rights Under New Zealand Privacy Act 2020
16.1 The Privacy Act 2020 (New Zealand) grants New Zealand residents the following rights:
👁️ Right of Access (Principle 6)
Request access to your personal information. We will respond within 20 working days.
✏️ Right to Correction (Principle 7)
Request correction of inaccurate personal information. We will correct it or attach a statement of correction.
🔔 Right to Notification of Breach
Be notified if a privacy breach is likely to cause serious harm.
📧 Right to Opt-Out of Marketing
Opt out of marketing communications at any time.
16.2 How to Exercise Your Rights:
Contact us at privacy@stampier.co with "New Zealand Privacy Request" in the subject line. We will respond within 20 working days.
16.3 Complaints to Privacy Commissioner:
Office of the Privacy Commissioner (New Zealand)
Website: www.privacy.org.nz
Phone: 0800 803 909
Email: enquiries@privacy.org.nz
Filing a Complaint: Making a Complaint
🇮🇳 PART B5: India (DPDPA 2023 & IT Act 2000)
17. Your Rights Under Digital Personal Data Protection Act 2023
17.1 The Digital Personal Data Protection Act, 2023 (DPDPA) grants Indian residents (Data Principals) the following rights:
ℹ️ Right to Information (Section 11)
Receive information about personal data processing, including summary of data held and processing activities.
✏️ Right to Correction & Erasure (Section 12)
Correct inaccurate or misleading personal data, complete incomplete data, and update personal data.
🗑️ Right to Erasure (Section 12)
Request erasure of personal data when retention is no longer necessary, subject to legal obligations.
👤 Right to Grievance Redressal (Section 13)
File complaints about data processing violations with us or with the Data Protection Board of India.
🏛️ Right to Nominate (Section 14)
Nominate another individual to exercise your rights in the event of death or incapacity.
17.2 Consent Under DPDPA:
We obtain your free, specific, informed, and unambiguous consent before processing your personal data, except where permitted by law. You may withdraw consent at any time.
17.3 How to Exercise Your Rights:
Contact our Data Protection Officer at:
- Email: dpo@stampier.co
- Privacy Inquiries: privacy@stampier.co
- Subject Line: "DPDPA Rights Request"
We will respond within the timeframes specified by DPDPA rules (to be finalized by the Data Protection Board).
18. Data Protection Board of India & Compliance
18.1 The Data Protection Board of India is the regulatory authority for DPDPA compliance.
Data Protection Board of India
Status: The Board is being established. Contact details will be updated once operational.
Interim: You may file grievances with us at dpo@stampier.co
18.2 IT Act 2000 Compliance:
We comply with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- We implement reasonable security practices to protect personal data
- We obtain consent before collecting sensitive personal data or information
- We do not publish or disclose sensitive personal data without consent
- We comply with data breach notification requirements
18.3 Grievance Officer:
Our designated Grievance Officer for India is available at:
- Name: [Grievance Officer Name - To Be Appointed]
- Email: dpo@stampier.co
Grievances will be acknowledged within 24 hours and resolved within 30 days.
Children's Privacy
19.1 Age Requirements:
Our Services are intended for businesses and adults. We do not knowingly collect personal information from children under the following ages:
| Jurisdiction | Minimum Age |
|---|---|
| United States (COPPA) | 13 years |
| European Union (GDPR) | 16 years (or lower if member state allows) |
| United Kingdom (UK GDPR) | 13 years |
| Canada, Australia, New Zealand | 18 years (parental consent may apply) |
| India (DPDPA 2023) | 18 years (verifiable parental consent required below) |
19.2 Accidental Collection:
If we become aware that we have collected personal information from a child without appropriate consent, we will delete it immediately. If you believe we have collected information from a child, please contact us at privacy@stampier.co.
19.3 Parental Rights:
Parents/guardians have the right to review, delete, or refuse further collection of their child's personal information. Contact us for assistance.
Data Breach Notification
21.1 Breach Response:
In the event of a personal data breach, we will:
- Assess the severity and impact of the breach
- Contain and remediate the breach immediately
- Investigate the root cause
- Notify affected individuals and authorities as required by law
- Implement measures to prevent future breaches
21.2 Notification Timelines:
| Jurisdiction | Notification to Authority | Notification to Individuals |
|---|---|---|
| EU / UK (GDPR) | Within 72 hours | Without undue delay (if high risk) |
| California (CCPA) | As required by law | Without unreasonable delay |
| Canada (PIPEDA) | As soon as feasible | If real risk of significant harm |
| Australia | As soon as practicable | If likely serious harm |
| New Zealand | As soon as practicable | If causing serious harm |
| India (IT Act 2000) | As soon as possible | As soon as possible |
21.3 EU/UK 72-Hour Breach Response Procedure (GDPR Article 33):
Critical Timeline: For EU/UK data subjects, we must notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach (unless the breach is unlikely to result in a risk to rights and freedoms).
Our Breach Response Process:
- Detection (Hour 0): Security systems detect potential breach; incident response team activated
- Assessment (Hours 0-4): Determine scope, affected data categories, number of data subjects, severity level
- Containment (Hours 4-8): Stop the breach, secure affected systems, preserve evidence
- Controller Notification (Hour 24): For B2B customers: Notify business customers (Data Controllers) within 24 hours
- Authority Notification (Hour 72): Report to EU supervisory authority (via lead supervisory authority mechanism) and UK ICO if required
- Data Subject Notification: If high risk to individuals, notify affected data subjects "without undue delay"
- Documentation: Maintain detailed breach records including facts, effects, and remedial actions taken
21.4 Supervisory Authorities:
- Lead Supervisory Authority (EU): Data Protection Ombudsman of Finland (primary data location)
- UK Authority: Information Commissioner's Office (ICO)
- Reporting Method: Online breach notification forms and direct email to authorities
- Documentation: All breaches documented in our breach register (GDPR Article 33(5))
21.5 Business Customer Responsibilities:
Important for Business Customers: If you are a Data Controller using Stampier as a Data Processor, you must notify your supervisory authority within 72 hours. We will provide you with all necessary information within 24 hours to meet this deadline. See our Data Processing Agreement for full details.
21.6 What We Will Tell You:
Breach notifications will include:
- Nature of the breach and categories of data affected
- Approximate number of data subjects and personal data records affected
- Name and contact details of our Data Protection Officer
- Likely consequences of the breach
- Measures taken or proposed to address the breach and mitigate harm
- Recommended steps you should take to protect yourself
- Contact information for further inquiries (security@stampier.co)
21.7 Emergency Contact:
To report a security incident or data breach:
- Email: security@stampier.co (monitored 24/7)
- DPO: dpo@stampier.co
- Subject Line: Use "SECURITY INCIDENT" or "DATA BREACH" for priority handling
Changes to This Privacy Notice
22.1 We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or services.
22.2 How We Notify You:
- We will update the "Last Updated" date at the top of this Notice
- For material changes, we will provide prominent notice on our website
- We may also email you about significant changes
- Continued use of Services after changes constitutes acceptance
22.3 Review Regularly:
We encourage you to review this Privacy Notice periodically to stay informed about how we protect your information.
Contact Us About Privacy
General Privacy Inquiries
Email: privacy@stampier.co
Support: support@stampier.co
Response Time: Within 30 days (EU/UK/Canada), 45 days (US states)