Privacy Policy
Effective on the date an account is created · Supersedes the version of 15 October 2024
Contents
Summary
Stalk Market collects what is needed to run an account, process a payment, and get an order to the person who bought it. Personal data is shared with a Steward, a Node, or a Courier only where it is needed to complete a specific order, and for nothing else. Personal data is never sold. This summary is provided for convenience; the Sections below govern.
1 Who this policy covers
This Privacy Policy describes how Stalk Market Distributions, LLC, a Colorado limited liability company (the “Platform”), collects, uses, shares, and retains personal data. It applies to every person who holds an account on the Platform, in any capacity.
| Account type | Governed by |
|---|---|
| Member | Member Terms of Service |
| Steward | Steward Terms of Service |
| Node | Node Terms of Service |
| Courier | Courier Terms of Service |
This policy forms part of each of those agreements. Where it conflicts with any of them on a matter of personal data, this policy controls.
1.1 Who controls the data
The Platform is the controller of personal data collected through the software. A Steward, a Node, or a Courier that receives personal data under Section 3 is a separate controller of what it receives, and is responsible for its own handling of it.
1.2 Relationship to the Earth Church
The Platform operates in partnership with Regeneration Station PMA, trading as the Earth Church, whose members may reach the Platform through that membership. The Platform is not governed by, and does not act on behalf of, that association. Personal data held by the Platform is not shared with it except as described in Section 3.
2 What is collected
2.1 Provided directly
| Data | Collected from | Why |
|---|---|---|
| Name, email, telephone | every account | account access, notices, order coordination |
| Collection or delivery address | Members | to route an order to a Node or a Courier |
| Business name, listing details | Stewards, Nodes | to display a listing |
| Service area, vehicle and license details | Couriers | to verify eligibility to deliver |
| Payment details | every account paid or charged | to take payment and to remit |
| Dietary or allergen notes | Members, optional | to pass to a Steward where asked |
2.2 Generated by use
Order and Dividend records, collection and delivery records, statements and payment history, support messages, and the version and date of each agreement accepted.
2.3 Collected automatically
IP address, browser and device type, pages visited, and actions taken. This is used to keep the software working and secure and to understand how it is used. It is not used to build a profile for advertising.
2.4 What is not collected
The Platform does not collect or store full card numbers or bank credentials. Payment is processed by a third-party processor, which holds those details under its own terms.
3 What is shared, and with whom
Personal data is shared only where it is needed to complete something the person asked for.
| Shared with | What | When |
|---|---|---|
| Steward | Member name and contact details | only to arrange a booked service, or to resolve a complaint |
| Node | Member name and order contents | when a Dividend is requested for collection |
| Courier | Member name, address, delivery notes | only for a run the Courier has accepted |
| Payment processor | name, email, payment details | to take payment or to remit |
| Earth Church Food Bank | nothing identifying a Member | donation records are aggregate only |
3.1 Limits on onward use
A Steward, Node, or Courier receiving personal data may use it only for the purpose for which it was passed. Each is prohibited by its own Terms of Service from using it for marketing, from retaining it beyond what is needed, and from disclosing it to anyone else.
3.2 No Steward-to-Member channel
The Platform does not publish Member contact details to Stewards and does not operate a Steward-to-Member messaging channel. Member communication runs through the Node.
3.3 Legal and safety disclosure
Personal data may be disclosed in response to valid legal process, to comply with law, to investigate fraud or a threat to safety, or to enforce an agreement. Disclosure is limited to what is reasonably necessary.
3.4 Business transfer
If the Platform or its assets are transferred in a merger, acquisition, or similar transaction, personal data may transfer with them, subject to this policy.
3.5 Never sold
Personal data is never sold, rented, or traded. The Platform does not display third-party advertising and does not share personal data with advertising networks.
4 How it is used
- Operating accounts, listings, orders, and Dividend records.
- Taking payment and remitting to Stewards and Nodes.
- Sending notices required by an agreement, including collection reminders.
- Providing support and resolving disputes.
- Keeping the software secure and detecting misuse.
- Meeting tax, accounting, and other legal obligations.
Personal data is not used for purposes unrelated to operating the Platform.
4.1 Marketing messages
Service messages about an account, an order, or an agreement are sent as part of operating the Platform and cannot be switched off while an account is open. Marketing messages are sent only with consent and can be withdrawn at any time.
5 Retention
| Data | Kept for |
|---|---|
| Account and contact details | while the account is open, then 12 months |
| Order, Dividend, and collection records | 7 years, for tax and accounting |
| Payment and remittance records | 7 years, for tax and accounting |
| Courier delivery records | 24 months |
| Support messages | 24 months |
| Automatically collected technical data | 13 months |
Where a longer period is required by law, or where data is needed for a live dispute, it is kept until that requirement or dispute ends.
6 Choices and rights
A person may ask the Platform to:
- Provide a copy of the personal data held about them.
- Correct anything inaccurate.
- Delete personal data, subject to the retention periods in Section 5.
- Restrict or object to a particular use.
- Withdraw consent to marketing.
- Provide their data in a portable format.
Requests are made to the address in Section 10 and answered within forty-five (45) days. There is no charge, and making a request does not affect an account.
6.1 Colorado Privacy Act
Colorado residents have the rights above under the Colorado Privacy Act, including the right to opt out of targeted advertising, the sale of personal data, and profiling. The Platform does not carry out any of those activities. A person who believes a request has been wrongly refused may appeal to the address in Section 10, and may then contact the Colorado Attorney General.
6.2 California residents
California Civil Code section 1798.83 permits a request for information about disclosure of personal data to third parties for direct marketing purposes. The Platform makes no such disclosures.
7 Cookies and tracking
The Platform uses cookies to keep a person signed in, to remember preferences, and to keep the software secure. Analytics cookies may be used to understand how the software is used, in aggregate.
Cookie preferences are managed through browser settings. Declining functional cookies may prevent signing in. Browser “Do Not Track” signals are honored where technically feasible.
8 Security
Personal data is held on access-controlled systems, encrypted in transit, and available only to those who need it to do their work. No system is completely secure, and the Platform does not warrant that a breach cannot occur.
Where a breach affecting personal data occurs, affected people are notified as required by Colorado law.
9 Children
The Platform is not directed to children. An account requires a person to be at least eighteen (18) years of age. Personal data is not knowingly collected from anyone under that age, and is deleted where it comes to light.
10 Contact
| Details | |
|---|---|
| stalk-market@yellowbarn.farm | |
| Telephone | (970) 670-8533 |
| Post | Stalk Market Distributions, LLC, 9417 North Foothills Hwy, Longmont, CO 80503 |
11 Changes to this policy
The Platform may revise this policy. Where a revision materially changes what is collected, how it is used, or with whom it is shared, at least thirty (30) days’ notice is given to the contact details on each account. Other revisions take effect on publication.
A revision is never applied retroactively to personal data already collected in a way that would broaden its use without consent.
Acceptance
This policy is accepted by creating an account on the Platform. The Platform records the version and date of acceptance, and provides a copy on request.