Privacy Policy

This Privacy Policy explains how PRE-ORDER Europe EOOD collects, uses, shares, protects and retains personal data when individuals and business representatives use the PRE-ORDER website, mobile application, account areas, digital pre-order services, payment workflows, messaging, support, analytics and related functionality. It also explains rights and choices under applicable data-protection law.

PRE-ORDER is a multi-sided digital platform connecting independent fashion brands and manufacturers, wholesale buyers and retail customers. The Platform may support future-collection discovery, pre-orders, prepayments, messaging, order tracking, analytics, demand forecasting and related functionality. This Policy should be read together with the Terms of Service and, where relevant, the Seller Agreement, Buyer Agreement, Cookie Policy, Payment & Prepayment Policy, AI Transparency Statement and other notices presented in the Platform.

1. Who we are

The operator of the PRE-ORDER Platform is PRE-ORDER Europe EOOD, UIC/EIK 208904127, with registered office at Arthur Residential Complex, Block C, Floor 3, Apartment C44, 8229 Sveti Vlas, Nessebar Municipality, Burgas District, Bulgaria (“PRE-ORDER”, “Operator”, “we”, “us” or “our”).
Website: https://pre-ordera.com
Privacy and legal contact: info@b2b-agency.cc

Unless a feature-specific notice states otherwise, PRE-ORDER determines the purposes and essential means of processing personal data for operation of the Platform and acts as the data controller for that processing. Independent Sellers, payment providers, logistics providers and other third parties may separately determine how they process personal data for their own legal and operational purposes.

2. Scope of this Policy

This Policy applies to personal data processed in connection with the PRE-ORDER website and applications, including public pages, registered accounts, Brand and Buyer onboarding, retail customer accounts, product and collection interactions, pre-orders, payments, messaging, support, fraud and security controls, analytics, pilot testing and AI-supported demand insights.

The Platform is intended for users aged 18 or older and may be made available in the EU/EEA, Ukraine and other countries where use is legally and technically available. Additional or local privacy notices may apply where required by the law of a particular jurisdiction or to a specific feature.

3. Who this Policy covers

Personal data may relate to:

• retail customers using PRE-ORDER for B2C discovery and pre-orders;
• wholesale buyers and representatives of retail or other business customers;
• representatives, employees and authorised users of fashion brands, manufacturers and other Sellers;
• users participating in pilot testing, surveys, interviews or product validation;
• people who contact support, submit complaints or make business or partnership enquiries;
• project administrators, authorised support personnel and other Platform users;
• website visitors and app users whose technical or interaction data are generated during use of the Services.

4. Categories of personal data we may process

The exact data depend on your role, the features you use and the transaction involved. PRE-ORDER may process the following categories:

Category	Examples	Main purposes
Account and identity data	Name, email address, telephone number, user ID, role, authentication and account-status metadata.	Registration, authentication, account management, support and security.
Business profile and verification data	Company name, trading name, company/VAT ID, country, address, website, authorised representative, beneficial-owner or verification information and documents where required.	Brand/Business Buyer onboarding, KYB/KYC, fraud prevention, legal and payment compliance.
Product and collection interaction data	Viewed products and collections, wishlist or saved items, add-to-bag events, preferred sizes or colours, timestamps and related interaction signals.	Platform functionality, personalisation, analytics and demand forecasting.
Pre-order and transaction data	Pre-order ID, Seller, product/SKU, article/colour quantities, MOQ status, payment status, transaction reference, cancellation/refund status and order status.	Order management, payment orchestration, dispute handling, analytics and recordkeeping.
Delivery and fulfilment data	Recipient name and contact details, delivery address, city, postal code, delivery service, shipment status and delivery reference.	Fulfilment, delivery coordination, support and dispute handling.
Payment-related data	Payment method type, actual deposit/hold/release status where applicable, provider transaction references, amounts, currencies and limited status metadata.	Processing and reconciling B2C payments via Stripe and enabled B2B payments via the licensed provider; fraud prevention and support.
Communication data	Order-related messages, support requests, complaint information, attachments and related correspondence.	Seller-Buyer communication, support, fraud prevention and dispute resolution.
Technical and security data	Device and app information, IP address or approximate network location, session identifiers, login/security events, app version, diagnostic and error logs.	Security, authentication, troubleshooting, service performance and abuse prevention.
Pilot, feedback and research data	Survey responses, satisfaction scores, interview feedback and usability observations.	Product validation, service improvement and project reporting.
Derived and aggregated data	Demand indicators, forecast variables, conversion indicators, Demand Score or similar analytics, aggregated sustainability or operational metrics.	Analytics, AI-supported demand forecasting, production decision support and project KPI validation.
Administrative and audit data	Administrator identity/role, access records, moderation and administrative action logs.	Security, accountability, compliance and incident investigation.

5. How we obtain personal data

We may obtain personal data:

• directly from you when you register, create or update an account, communicate with us, place or manage a pre-order, submit verification information, participate in a pilot or complete a form;
• from a business or organisation you represent, for example where an administrator creates or manages an authorised user profile;
• from independent Sellers, Buyers or transaction counterparties where information is required to manage a pre-order, delivery, support request or dispute;
• from Stripe and other payment-chain participants through payment status, authentication, refund and transaction events;
• from delivery, communications, security, hosting, analytics or other service providers where they provide data necessary for the relevant service;
• automatically from your browser, device, app session and interactions with the Platform;
• from pilot companies or project participants where real operational data are lawfully provided for testing, validation, analytics or AI development.

6. Purposes of processing and legal bases

PRE-ORDER processes personal data only where there is an appropriate legal basis. The applicable basis depends on the purpose and the user relationship. We do not rely on consent where consent would not be freely given or where another legal basis is more appropriate.

Purpose	What this includes	Typical legal basis
Provide accounts and Platform functions	Create accounts, authenticate users, maintain profiles, enable collections, pre-orders, messaging and order tracking.	Performance of a contract or steps requested before entering into a contract.
Operate pre-orders and transactions	Record orders, order status, payment status, delivery information, refunds and transaction history.	Performance of a contract; legal obligations; legitimate interests in operating and evidencing transactions.
Business and payment verification	Verify brands, business buyers, authorised representatives, payment accounts and transaction risk.	Legal obligations; legitimate interests in fraud and transaction-risk prevention; contract where needed for business/payment onboarding.
Security and abuse prevention	Detect unauthorised access, account compromise, fraud, misuse, malicious activity or circumvention.	Legitimate interests; legal obligations where applicable.
Support and dispute handling	Answer questions, investigate complaints and assist with disputes or refunds.	Performance of a contract; legitimate interests; legal obligations.
Analytics and service improvement	Measure usage, adoption, conversion, reliability and feature performance.	Legitimate interests; consent where required for non-essential cookies or similar technologies.
AI-supported demand forecasting	Use behavioural, transactional, product and operational signals to produce demand insights and production recommendations for authorised business users.	Legitimate interests in improving demand planning and platform functionality; contract where the feature forms part of the requested service; consent if required for a specific data use.
Marketing and optional communications	Send marketing messages or measure campaign engagement where permitted.	Consent where required; legitimate interests where applicable and permitted, with the right to opt out.
Legal, accounting and compliance	Maintain records, respond to authorities, enforce terms and meet tax, accounting, grant, product-safety, sanctions or regulatory obligations.	Legal obligation; legitimate interests in establishing, exercising or defending legal claims.
Pilot validation and project reporting	Validate functionality, AI performance, usability and project KPIs, preferably using aggregated or pseudonymised data.	Legitimate interests; contract or consent depending on the activity; legal/grant obligations where applicable.

7. Account registration, authentication and profile data

When you create or use an account, we process the information needed to register, authenticate and manage that account. Depending on the user role, this may include personal contact details, role information and business profile information. We may also process authentication metadata and security events needed to protect the account and Platform.

You are responsible for keeping account information accurate and current. We may ask you to confirm or update information where needed for security, payment processing, legal compliance or continued access to transactional functions.

8. Brand, Seller and Business Buyer verification

Verified business functionality may require company information, registration details, VAT/tax information, authorised representative details, beneficial-owner information, bank or payout account information and supporting documents. Verification may be performed by PRE-ORDER, Stripe or another authorised verification provider, depending on the feature and payment flow.

Verification information is used to reduce fraud and transaction risk, support B2C or B2B payment onboarding, meet sanctions, anti-money-laundering, tax and other applicable requirements, and establish a user’s authority to act for a business. Access to relevant transaction functions may be restricted until checks are completed.

9. Pre-orders, payments and independent payment providers

For B2C PRE-ORDER has selected Stripe to facilitate payment functions. The proposed B2B structure uses a separately contracted licensed payment provider for conditional handling of deposits and payouts where the service is available and approved. Mangopay and Lemonway are being evaluated; neither is described here as an active provider. Each actual provider handles its own payment and verification data under its contractual, regulatory and privacy roles.

PRE-ORDER does not ordinarily obtain full card numbers or CVV/security codes. It may receive provider references, paid or conditionally held amounts, currency, payment and payout status, KYC/KYB result, transaction timestamps, refund and dispute events and limited metadata necessary to manage orders, verify paid demand, reconcile transactions, resolve problems and meet legal duties. A Platform wallet display does not itself prove legal escrow or that PRE-ORDER holds the funds.

Payment authorisation, actual B2B deposit, conditional holding, release to a Seller, B2C charge, staged balance or refund does not change these privacy obligations. Data shared with an active provider must be limited to what that provider lawfully needs for the particular flow. The Provider may act as an independent controller, processor or another regulated participant according to the facts and applicable terms.

10. Independent pre-order counterparties and transaction data

PRE-ORDER connects independent Sellers and Buyers through a digital pre-order workflow; the Product Contract remains between those parties. Sellers may require relevant Buyer data for quotations, the accepted Collection Agreement, SKU and colour quantities, official tax Invoices, delivery, product conformity, cancellation, refunds and after-sales duties. A saved basket or expression of interest must be distinguished from an accepted, financially confirmed B2B order.

Independent Sellers and other transaction counterparties may have their own legal obligations and privacy notices. PRE-ORDER does not control processing that an independent Seller carries out for its own purposes outside the Platform merely because information was first transmitted through PRE-ORDER.

11. Messaging, support and complaint data

PRE-ORDER may store and process order-related messages, support correspondence and attachments so that users can communicate, receive assistance and maintain a record connected with a transaction. Communications may also be reviewed or accessed where reasonably necessary to investigate fraud, security incidents, prohibited conduct, complaints or disputes, enforce Platform rules, or comply with law.

Private free-text chat content is not intended to be used as an AI demand-forecasting feature or for AI model training. Users should not send payment-card credentials, passwords or unnecessary sensitive personal data through Platform messages.

12. Website, app and technical data

When you use PRE-ORDER, technical data may be generated automatically. This can include device/browser information, operating system or app version, IP address, session identifiers, timestamps, crash and error logs, authentication events and security-related activity. We use this information to operate the Services, diagnose problems, improve reliability, secure accounts and detect misuse.

We may derive approximate country or region from technical information where needed for language, service availability, fraud controls or legal compliance. PRE-ORDER does not need precise device location for its core pre-order functionality unless a specific feature clearly requests it.

13. Cookies, analytics and similar technologies

The website and app may use cookies, SDKs, local storage or similar technologies for essential operation, authentication, preferences, security, analytics and, where enabled, marketing or measurement. Non-essential technologies will be used only in accordance with applicable consent requirements.

Because the exact analytics, advertising and measurement services may change as the website and application are configured, the current categories, purposes, providers and available controls will be described in the Cookie Policy and consent interface where required. This Privacy Policy does not assume that a particular optional analytics or advertising provider is active unless it is actually enabled.

14. AI-supported analytics and demand forecasting

PRE-ORDER may use AI and statistical methods for product, collection and order-based demand insights. Saved baskets and unpaid interest are distinct from provider-confirmed B2B deposits and paid units and must not be presented as equivalent. AI output supports the Brand’s human production decision; it does not automatically release payment-provider funds. Relevant forecasts may show model version, main input factors, uncertainty and human review.

Relevant AI outputs may be accompanied by or linked to information such as the forecast or recommendation, model version, main input-factor groups, confidence or uncertainty information, business constraints and the human decision taken after review. Where a model or available data cannot support a sufficiently reliable recommendation or explanation, the output may be flagged for human review, replaced with a more interpretable approach where appropriate, or not used for the relevant decision.

Where feasible, analytical and AI datasets are pseudonymised, aggregated or separated from direct identifiers. Access is limited according to role and operational need.

15. Data not intended for AI training or demand-model features

The following information is not required for PRE-ORDER demand forecasting and is not intended to be used as AI model features:

• passwords;
• full payment-card numbers;
• CVV or card security codes;
• authentication credentials;
• identity documents;
• private payment credentials;
• free-text private chat content.

Special-category personal data within the meaning of Article 9 GDPR are not required for PRE-ORDER demand forecasting. If such information is incidentally entered into a free-text field or chat, it is not intended to be extracted for AI model training or demand forecasting.

16. Automated decision-making and human oversight

PRE-ORDER AI functions are designed to support business decision-making, not to make legally binding or similarly significant decisions about individuals without appropriate human involvement. Production recommendations remain subject to human review and may be accepted, modified or rejected by authorised Brand users.

Fraud, security or verification tools may use automated signals to identify risk and prioritise review. Where applicable law grants rights in relation to solely automated decisions producing legal or similarly significant effects, PRE-ORDER will provide the safeguards required by that law, which may include human review and the ability to contest a decision.

17. Who may receive personal data

We may disclose personal data only where necessary and proportionate for the relevant purpose, including to:

• independent Sellers, Buyers and transaction counterparties where needed to form or perform a Product Contract;
• Stripe and its relevant entities for B2C, and, only where actually connected, the independent licensed B2B payment provider for transaction processing, verification, conditional fund handling, disputes, reversals or refunds;
• hosting, cloud, database, security, communications, email, push-notification, analytics, customer-support and other technology providers acting under appropriate contractual arrangements;
• technology development and maintenance providers supporting PRE-ORDER, including project or affiliated technical teams where they are authorised to process data for the relevant purpose;
• delivery, logistics or fulfilment providers selected for an order where necessary to perform delivery;
• professional advisers, auditors, insurers, financial institutions and legal counsel where reasonably necessary;
• competent courts, regulators, law-enforcement bodies, tax authorities, sanctions authorities or other public bodies where disclosure is legally required or necessary to protect rights and safety;
• project, grant or research stakeholders where required for lawful reporting or validation, normally using aggregated or appropriately minimised information.

We do not sell personal data to advertisers. If PRE-ORDER introduces advertising or sponsored placement, any sharing or use of personal data for targeted advertising will be handled in accordance with applicable law and disclosed in the relevant notice or consent interface.

18. International data transfers

PRE-ORDER may serve users in multiple countries and may use service providers or authorised personnel located in different jurisdictions. EU/EEA-based infrastructure is preferred where appropriate for project and service data. However, some providers or support operations may involve processing or remote access outside the EEA.

Before personal data subject to the GDPR are transferred or made accessible outside the EEA, PRE-ORDER will assess the transfer and implement an appropriate lawful mechanism and safeguards where required. Depending on the circumstances, these may include an adequacy decision, standard contractual clauses, supplementary safeguards or another mechanism recognised by applicable data-protection law.

19. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, contractual, accounting, security, dispute, grant or regulatory requirements. Retention therefore varies by data type and user relationship.

In particular:

• account and profile data are generally retained while the account is active and for a reasonable period afterwards where needed for security, dispute handling or legal obligations;
• transaction, payment-status, invoice, order and refund records may be retained for the periods required by tax, accounting, contractual, consumer-protection and payment-dispute rules;
• verification and compliance records may be retained for periods required by payment providers or applicable KYC/KYB, sanctions, fraud-prevention or legal obligations;
• support, complaint and dispute records may be retained while a matter is active and afterwards for a reasonable period needed to establish, exercise or defend legal claims;
• security and technical logs are retained according to operational and security needs and are deleted, aggregated or anonymised when no longer required;
• pilot and analytics datasets are minimised and, where feasible, pseudonymised or aggregated; project records may also be retained for applicable grant and audit obligations.

At the end of the applicable retention period, personal data are deleted, securely destroyed or irreversibly anonymised unless continued retention is legally required.

20. Security measures

PRE-ORDER applies data-protection-by-design and data-protection-by-default principles and uses technical and organisational measures appropriate to the nature of the data and the risks involved. Measures may include:

• encryption of communications in transit;
• encryption at rest for appropriate categories of data;
• role-based access control and least-privilege permissions;
• privileged-access controls for administrators;
• secure credential and authentication management;
• audit logging and monitoring of security-relevant events;
• backup and restoration procedures;
• vulnerability management and secure API authentication;
• separation of production, test and pilot environments where appropriate;
• access restrictions and data minimisation for analytical and AI datasets.

No technical system can guarantee absolute security. Users must also protect their credentials, use authorised devices and promptly report suspected unauthorised access or suspicious activity.

21. Your data-protection rights

Depending on the law that applies to you, and subject to legal conditions and exceptions, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of personal data where the legal conditions are met;
• request restriction of processing;
• object to processing based on legitimate interests, including certain profiling;
• receive certain data in a structured, commonly used and machine-readable format and request portability where applicable;
• withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal;
• object to direct marketing at any time;
• request safeguards relating to qualifying solely automated decisions where applicable;
• lodge a complaint with a competent data-protection supervisory authority.

To exercise a privacy right, contact info@b2b-agency.cc. We may need to verify your identity and request information reasonably necessary to locate relevant records. We will respond within the time required by applicable law. Some rights may be limited where an exemption applies or where retention is required by law or necessary for legal claims.

22. Account deletion

Where the Platform provides an account-deletion function, you may use it to request closure of your account. You may also contact us using the privacy contact above. Account deletion does not necessarily require immediate deletion of every record connected with the account. We may retain information that must be kept for transaction evidence, legal obligations, accounting, fraud prevention, payment disputes, safety, security or the establishment, exercise or defence of legal claims.

Data that are no longer required will be deleted or anonymised in accordance with the retention principles in this Policy.

23. Marketing communications

If PRE-ORDER sends marketing communications, users will receive them only where permitted by applicable law. Marketing emails will include an unsubscribe method or another appropriate way to opt out. Service, security, payment and order messages are transactional and may still be sent where necessary to provide the Services or meet legal obligations.

24. Children

PRE-ORDER is not directed to children. Users must be at least 18 years old to create an account and enter into the Platform agreements. If we learn that personal data of a child have been collected in circumstances where processing is not lawful or necessary, we will take appropriate steps to delete or otherwise address the data.

25. Data breaches and incidents

PRE-ORDER maintains procedures for investigating security incidents and personal-data breaches. Where a breach is likely to create a risk requiring notification under applicable law, PRE-ORDER will notify the competent supervisory authority and, where legally required, affected individuals within the applicable time limits. We may also cooperate with payment providers, hosting providers, Sellers, Buyers or other parties where necessary to contain and investigate an incident.

26. Changes to this Privacy Policy

We may update this Privacy Policy when the Platform, legal requirements, service providers or data practices change. Material changes will be communicated through the website, application, account interface, email or another appropriate channel where required. The policy displayed on the Platform is the current publication version.

27. Contact and complaints

For privacy questions, rights requests or complaints, contact:
PRE-ORDER Europe EOOD
UIC/EIK 208904127
Arthur Residential Complex, Block C, Floor 3, Apartment C44
8229 Sveti Vlas, Nessebar Municipality, Burgas District, Bulgaria
Website: https://pre-ordera.com
Email: info@b2b-agency.cc

You may also have the right to complain to a competent data-protection supervisory authority, including the authority in the EU/EEA country of your habitual residence, place of work or the place of an alleged infringement where the GDPR provides that right.