GDPR Notice

1. Purpose of this Notice

This GDPR Notice explains how “PRE-ORDER Europe” EOOD processes personal data in connection with the PRE-ORDER website, mobile application, digital pre-order platform, accounts, B2B and B2C payments, support, pilots, analytics and related services where Regulation (EU) 2016/679 (the “GDPR”) applies. It supplements the PRE-ORDER Privacy Policy and provides additional information for individuals in the EU/EEA and other processing subject to GDPR.

PRE-ORDER is an innovative digital infrastructure for fashion pre-orders connecting independent Brands and manufacturers, wholesale Buyers and retail Customers. It supports future collections, prepayments, order management, communication, analytics and, as development progresses, AI-supported demand forecasting and sustainability features. B2C payments are intended through Stripe and B2B conditional payments through a separately licensed provider, where activated. This Notice does not alter the contractual responsibilities of the independent parties.

2. Data controller and contact details

The controller for the PRE-ORDER Platform is “PRE-ORDER Europe” EOOD, UIC/EIK 208904127, with registered office at Arthur Residential Complex, Block C, Floor 3, Apartment C44, 8229 Sveti Vlas, Nessebar Municipality, Burgas District, Bulgaria (“PRE-ORDER”, “we”, “us” or “our”).

Website: https://pre-ordera.com
Privacy contact: info@b2b-agency.cc

If PRE-ORDER appoints a Data Protection Officer or another formally designated data-protection contact, the current contact details will be published in the Privacy Policy or another appropriate privacy notice. Until then, GDPR requests and privacy enquiries may be sent to the privacy contact above.

3. When PRE-ORDER is a controller and when another party may be a controller

PRE-ORDER generally acts as controller for account administration, Platform operation, security, pre-order workflow administration, service analytics, support, compliance, fraud prevention, communications and AI-supported analytics where it determines the purposes and essential means.

Independent Sellers may act as separate controllers for personal data they need to enter into and perform a Product Contract with a Buyer, including fulfilment, delivery, statutory warranty, product-safety, tax, invoice and after-sales obligations. Business Buyers may also act as controllers for personal data they upload or use for their own business purposes. Stripe and other regulated payment-chain participants may act as independent controllers or processors for particular payment functions according to their own legal role and terms.

Where PRE-ORDER processes personal data strictly on documented instructions for another controller, the parties will use an appropriate data-processing agreement where required. The legal role depends on the specific processing activity, not merely on the technical integration.

4. Individuals covered by this Notice

• retail customers and prospective retail customers using PRE-ORDER for B2C discovery and pre-orders;
• wholesale buyers, retailers and representatives of business customers using PRE-ORDER for B2B activity;
• representatives, employees and authorised users of brands, manufacturers and other Sellers;
• individuals participating in pilots, testing, surveys, interviews or product validation;
• people who contact customer support, submit complaints, request account deletion or make partnership or business enquiries;
• website visitors and app users whose technical and interaction data are generated during use of PRE-ORDER;
• administrators, authorised support personnel and other individuals whose data are processed for security, audit or operational purposes.

5. Categories of personal data

The categories actually processed depend on your role and the features you use. PRE-ORDER may process:

Category	Examples	Main purposes
Account and identity data	Name, email, telephone number, user ID, role, authentication metadata.	Registration, authentication, account administration and support.
Business profile and verification data	Legal company name, registration number, VAT/tax ID (where applicable), registered address, country, authorised representative and role/authority, and—when required—beneficial-owner and KYB documentation.	Seller/Buyer onboarding, business verification, fraud and compliance controls.
Transactional and order data	Pre-order ID, collection/article/colour, quantity, price, accepted agreement version, relevant MOQ, payment and order status, transaction reference and timestamps.	Pre-order management, payment orchestration, fulfilment, accounting and dispute handling.
Payment-related metadata	Stripe or activated B2B provider identifiers, payment or wallet-status reference, amount, currency, confirmation of receipt, conditional-hold/release/refund event, dispute status; no ordinary need for full card data or CVV.	Payment processing, reconciliation, fraud prevention, refunds and compliance. PRE-ORDER does not ordinarily need full card numbers or CVV codes.
Delivery and fulfilment data	Recipient/contact details, delivery address, postal code, selected carrier, shipment status and tracking reference.	Shipment, delivery, returns, complaints and fulfilment support.
Behavioural and interaction data	Product/collection views, wishlist and cart actions, campaign events, paid or unpaid pre-order indicators, conversion and app/session events.	Service analytics, product improvement, demand signals and AI-supported forecasting where applicable.
Communication and support data	Order-related messages, attachments, support requests, complaint and dispute correspondence.	Communication, support, dispute resolution, safety and audit.
Technical and security data	IP/network data, device/browser/app version, session data, authentication events, error, security and administrator logs.	Security, troubleshooting, fraud prevention, service integrity and audit.
Pilot and feedback data	Survey responses, satisfaction score, NPS, interview or qualitative feedback.	Pilot validation, service improvement and project reporting.
Derived and aggregated data	Demand scores, conversion indicators, forecasting variables, aggregate ESG or performance metrics.	Analytics, AI-supported demand forecasting, validation and reporting.

6. Data PRE-ORDER does not require for demand forecasting

PRE-ORDER does not require passwords, full payment-card numbers, CVV/security codes, authentication credentials, identity documents, private payment credentials or free-text private chat content as features for demand forecasting. Special-category personal data under Article 9 GDPR are not required for ordinary PRE-ORDER demand forecasting.

If a user voluntarily places sensitive or special-category information into a free-text field or chat, PRE-ORDER will not intentionally extract it for demand-model training. Users should avoid submitting sensitive information unless it is genuinely necessary for a specific support or legal purpose.

7. Sources of personal data

PRE-ORDER may collect personal data directly from you and may also receive data from other sources where necessary for the relevant service. These sources may include:

• a company, Brand, Seller or Business Buyer that creates or manages an authorised user profile;
• the Seller or Buyer that is the counterparty to an order or pre-order;
• Stripe and other payment-chain participants providing transaction, authentication, refund, dispute or payout events;
• delivery, hosting, communications, security, analytics, customer-support and other service providers;
• pilot companies that lawfully provide operational data for testing and validation;
• your browser, device and application through technical and interaction events generated when you use PRE-ORDER;
• publicly available business information where reasonably necessary for business verification, fraud prevention or due diligence.

Where personal data is obtained from another source and the GDPR requires direct notice, PRE-ORDER will provide the required information within the applicable period unless a lawful exception applies.

8. Purposes and legal bases

PRE-ORDER processes personal data only where there is a lawful basis. The basis depends on the purpose and relationship. The following table summarises the principal processing activities; a feature-specific notice or contractual document may provide more specific information.

Processing activity	Typical legal basis	Purpose / legitimate interest where relevant
Registration, authentication and account administration	Performance of a contract or steps requested before entering a contract.	Create and maintain the requested account and provide role-based access.
Pre-order operation and order records	Performance of a contract; legitimate interests where processing supports Platform operation without being strictly necessary for a user contract.	Create and manage pre-order interactions, Collection Agreements, MOQ status and order evidence.
B2C and B2B payment coordination	Performance of a contract; legal obligation; legitimate interests.	Facilitate Stripe B2C payments and, once activated, licensed B2B conditional payments; reconcile statuses, detect fraud and support refunds.
Business verification, KYC/KYB, sanctions and fraud controls	Legal obligation where applicable; legitimate interests; contract-related necessity.	Protect users and PRE-ORDER, comply with payment/provider requirements and reduce fraud or prohibited activity.
Delivery and fulfilment support	Performance of a contract; legitimate interests.	Transmit delivery details, maintain order status and assist with fulfilment issues.
Customer support, complaints and disputes	Performance of a contract; legal obligation; legitimate interests.	Respond to requests, preserve evidence, manage complaints and defend legal claims.
Security, logging and abuse prevention	Legitimate interests; legal obligation where applicable.	Protect systems, accounts, transactions and users; investigate incidents and maintain auditability.
Service analytics and product improvement	Legitimate interests, subject to balancing; consent where required for device technologies.	Understand service performance, improve usability and measure feature adoption.
AI-supported demand forecasting and business analytics	Legitimate interests and/or contract-related processing depending on the feature; consent only where appropriate.	Separate indicative demand (views, saved items and carts) from provider-confirmed paid pre-orders; support Brand decisions with minimised personal identifiers.
Project pilots, validation and research-related activities	Consent, legitimate interests, contract or another appropriate basis depending on the activity.	Validate the PRE-ORDER system, gather feedback and measure project KPIs.
Legal, tax, accounting, regulatory and recordkeeping obligations	Compliance with legal obligations.	Maintain records and respond to lawful authorities or mandatory reporting duties.
Direct marketing and optional communications	Consent where required; otherwise legitimate interests where permitted, with opt-out rights.	Send relevant PRE-ORDER news, service updates or business communications.

Where PRE-ORDER relies on legitimate interests, it must consider whether the processing is necessary and whether your interests, rights or freedoms override those interests. Where consent is the basis, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

9. Contractual and required information

Some personal data are required to create an account, verify a business, enter a pre-order, process a payment, deliver an order or comply with legal obligations. Where information is mandatory, the relevant form or transaction flow will indicate this where appropriate. If required information is not provided, PRE-ORDER or the relevant Seller/Payment Provider may be unable to provide the requested feature or complete the transaction.

10. B2C and B2B payments and data protection

For B2C pre-orders, Stripe is the selected payment provider. The agreed B2B model envisages a separate licensed payment partner for receipt, conditional holding, release, payout and refund of funds, subject to contract, country coverage and actual activation. Mangopay or Lemonway may be evaluated; naming a candidate does not mean that it is already connected. Each active provider may process identity, business-verification, beneficial-ownership, payment-account, device, transaction and risk data under its own lawful role and notices.

PRE-ORDER does not ordinarily need full card numbers or CVV codes. It may receive payment references, provider-confirmed payment or wallet-status indicators, amounts, currencies, timestamps, refund/dispute status, release events and limited metadata necessary to operate the Platform and reconcile orders. An app-displayed balance is not PRE-ORDER custody of funds.

PRE-ORDER is not a bank, payment institution or escrow agent. Any B2B safeguarded or conditionally held funds remain subject to the selected licensed provider’s legal and contractual terms, and must not be described as an active feature until implemented and disclosed. B2C Stripe payments are not described as escrow.

11. Sellers, Buyers, delivery partners and other recipients

Personal data may be disclosed only where needed for a defined purpose and subject to the relevant legal and contractual safeguards. Recipients may include:

• the independent Seller or Buyer that is the counterparty to a Product Contract;
• Stripe and other regulated payment-chain participants;
• delivery and logistics providers selected for fulfilment;
• hosting, cloud, database, cybersecurity, communications, email, push-notification, analytics, support and other technology providers;
• professional advisers, auditors, insurers and consultants where necessary and subject to confidentiality;
• competent authorities, courts, regulators or law-enforcement bodies where disclosure is legally required or necessary to protect legal rights;
• a successor or transaction counterparty in a lawful merger, financing, reorganisation or transfer of all or part of the PRE-ORDER business, subject to appropriate safeguards.

PRE-ORDER does not sell personal data to advertisers. Where optional advertising or campaign technologies are later deployed, their use will be governed by the Cookie Policy and applicable consent requirements.

12. International transfers

PRE-ORDER is based in Bulgaria but operates for EU/EEA users, users in Ukraine and users in other countries where the service is legally available. Some service providers or transaction counterparties may process data outside the EEA.

Where the GDPR restricts a transfer of personal data outside the EEA, PRE-ORDER will use a lawful transfer mechanism where required, such as an adequacy decision, Standard Contractual Clauses, another legally recognised safeguard, or a specific GDPR derogation where appropriate. Additional technical, contractual or organisational measures will be considered where necessary in light of the destination, data and transfer risk.

You may request information about the applicable transfer safeguard for your personal data, subject to confidentiality and security limitations.

13. Retention

PRE-ORDER keeps personal data only for as long as reasonably necessary for the purpose for which it was collected, and for any additional period required to satisfy legal, accounting, tax, payment, security, dispute, grant or regulatory obligations.

Retention is determined by the type of data and context. For example, account data may be retained while the account is active and for a limited period after closure; order and payment records may be retained for contractual, accounting, tax, refund, chargeback or legal-claim periods; security logs may be retained for a proportionate period to investigate incidents; and project/pilot records may be retained for applicable project and audit obligations.

When continued identification is no longer necessary, personal data will be deleted, securely destroyed or irreversibly anonymised unless continued retention is legally required or justified.

14. Security and data-protection by design

PRE-ORDER is intended to follow data-protection-by-design and data-protection-by-default principles. Measures are selected according to the nature, scope, context and risk of the processing and may include role-based access, access logging, authentication controls, encryption in transit and at rest where appropriate, pseudonymisation, separation of direct identifiers from analytical data, backups, incident procedures and provider due diligence.

Administrative actions should be logged and access should be limited according to role and operational need. No security measure can eliminate all risk, but PRE-ORDER will maintain controls proportionate to the relevant data and service risk.

15. AI-supported analytics, profiling and human oversight

PRE-ORDER may use machine-learning and statistical methods to forecast demand, identify demand patterns, calculate demand-related indicators and provide production-volume recommendations to authorised Brand users. The intended purpose is business decision support, not autonomous production decision-making.

Relevant forecasting and recommendation processes may use product, collection, SKU, historical or current sales, pre-order, conversion, inventory, production and other operational signals. Where personal data are included in analytics, PRE-ORDER will minimise direct identifiers and use pseudonymised or aggregated data where feasible.

PRE-ORDER is not intended to make solely automated decisions that produce legal effects or similarly significant effects concerning individual users. Brand users remain responsible for final production decisions and can accept, modify or reject recommendations. Security or fraud tools may automatically identify risk signals or prioritise review, but any legally significant solely automated decision must comply with the safeguards required by applicable law.

Where applicable, authorised users may be provided with information about relevant input-factor groups, model version, confidence or uncertainty, constraints, the recommendation produced and the human decision taken after review. PRE-ORDER does not claim that a neural-network model can provide a perfect causal explanation of every internal mathematical operation.

16. Data Protection Impact Assessments

Before starting a processing activity likely to result in a high risk to individuals, PRE-ORDER will assess whether a Data Protection Impact Assessment under Article 35 GDPR is required. Relevant factors may include behavioural analytics, profiling, systematic monitoring, combination of datasets, AI-based processing, scale, categories of data subjects and sensitivity of the data. Where a DPIA is required, it will be completed before the relevant high-risk processing begins.

17. Personal data breaches

PRE-ORDER maintains procedures to identify, assess and respond to personal-data breaches. Where a breach is likely to result in a risk to individuals, PRE-ORDER will notify the competent supervisory authority within the period required by the GDPR. Where the breach is likely to result in a high risk to affected individuals, PRE-ORDER will also communicate the breach to those individuals unless a lawful exception applies.

Users and business partners should promptly report suspected compromise of PRE-ORDER accounts, credentials or Platform data to info@b2b-agency.cc.

18. Your GDPR rights

Subject to the conditions and limitations in the GDPR, you may have the following rights:

• Right to information — to receive clear information about how your personal data are processed.
• Right of access — to obtain confirmation whether personal data are processed and receive a copy and related information.
• Right to rectification — to correct inaccurate data and complete incomplete data.
• Right to erasure — to request deletion where the legal conditions are met.
• Right to restriction — to request that processing be restricted in specified circumstances.
• Right to data portability — to receive certain data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.
• Right to object — to object to processing based on legitimate interests on grounds relating to your particular situation, and to object at any time to direct marketing.
• Right to withdraw consent — where processing is based on consent, without affecting processing lawfully carried out before withdrawal.
• Rights concerning solely automated decision-making — where Article 22 GDPR applies, to the safeguards provided by law, including human involvement where required.
• Right to lodge a complaint — to complain to a competent data-protection supervisory authority.

19. How to exercise your rights

You may submit a privacy or GDPR request to info@b2b-agency.cc. Please describe the right you wish to exercise and provide enough information to identify the relevant account or interaction. Do not send full payment-card details or passwords.

PRE-ORDER may request reasonable information to verify identity before acting on a request, particularly where disclosure or deletion could affect an account, transaction or another person. Verification information will be limited to what is proportionate to the risk.

PRE-ORDER will respond without undue delay and generally within one month of receiving a valid request. Where permitted by the GDPR, the period may be extended for complex or numerous requests, in which case the requester will be informed of the extension and reasons. Requests are normally free of charge, although the GDPR permits a reasonable fee or refusal for manifestly unfounded or excessive requests in limited circumstances.

20. Erasure, account deletion and retained transaction records

Closing or deleting a PRE-ORDER account does not always require immediate deletion of every record. PRE-ORDER may retain limited data where necessary for open orders, refunds, chargebacks, fraud prevention, tax/accounting records, legal claims, regulatory obligations, security, product-safety matters, grant/audit requirements or proof of prior transactions.

Where retained data are no longer needed for active use, access will be limited according to the retention purpose. Data that can lawfully be deleted or anonymised will be handled accordingly after the applicable retention period.

21. Direct marketing and communications

Service communications necessary for an account, order, payment, security event or legal notice are not marketing and may be sent where necessary to provide the service or comply with law.

Optional marketing communications will use the legal basis required by applicable law. Where consent is required, PRE-ORDER will obtain it before sending the communication. You can unsubscribe from optional marketing using the link or settings provided, or by contacting us. An opt-out may be retained on a suppression list so that the preference can be respected.

22. Cookies and similar technologies

The PRE-ORDER website and application may use cookies, SDKs, local storage, device identifiers and similar technologies for essential operation, security, preferences, analytics and, if enabled, optional campaign measurement or advertising. The detailed categories, consent approach and current provider information are described in the PRE-ORDER Cookie Policy and applicable Cookie Settings interface.

23. Children

PRE-ORDER is intended for adults and business users and is not directed to children. Users must generally be at least 18 years old to create an account or enter a transaction. If PRE-ORDER becomes aware that it has collected personal data from a child contrary to the applicable rules, it will take reasonable steps to delete or otherwise lawfully handle the data.

24. Complaints and supervisory authorities

If you believe that PRE-ORDER has processed personal data unlawfully, you are encouraged to contact us first so that we can review the issue. This does not limit your right to lodge a complaint with a competent data-protection supervisory authority, including the authority in the EU/EEA Member State of your habitual residence, place of work or the place of the alleged infringement, where applicable.

25. Changes to this Notice

PRE-ORDER may update this GDPR Notice to reflect changes in the Platform, processing activities, service providers, law or regulatory guidance. Material changes will be communicated through the website, application, account or another appropriate channel where required. The current published notice will state its effective date.

26. Relationship with other PRE-ORDER documents

This GDPR Notice should be read together with the PRE-ORDER Privacy Policy, Cookie Policy, Terms of Service, Platform Terms, Buyer Agreement, Seller Agreement, Payment & Prepayment Policy, Escrow & Payment Disclosure and feature-specific privacy notices. Mandatory data-protection law prevails in case of a conflict.

27. Contact

PRE-ORDER Europe EOOD
UIC/EIK 208904127
Arthur Residential Complex, Block C, Floor 3, Apartment C44, 8229 Sveti Vlas, Nessebar Municipality, Burgas District, Bulgaria
Website: https://pre-ordera.com
Privacy contact: info@b2b-agency.cc