Privacy policy

Last updated: 28 September 2026. This policy applies to stackcouk.com and to everything we do with your personal information from that date.

This policy explains what personal information we collect when you visit stackcouk.com, place an order, contact us, or use the desktop software that drives our light strip; what we do with it; who else sees it; how long we keep it; and what you can require us to do about it.

It works alongside four other pages, which refer to the numbered sections below:

• Terms of Service – the contract between you and us
• Shipping Policy – where we ship, what it costs, how long it takes
• Return and refund policy – cancelling, returning, and faulty goods
• Contact information – who we are, how to reach us, how to complain

Our store is hosted by Shopify and our checkout is Shopify’s. That matters throughout this policy, because much of the information described below sits on Shopify’s systems rather than on any system of our own. Section 10 sets out that split.

Contents

1. Who we are, and why we have not appointed a Data Protection Officer
2. The information we collect, and where it comes from
3. Your account and your order records
4. Payment information
5. Marketing emails, order emails, and the lawful basis for each
6. The STACK screen-sync software
7. How long we keep information
8. Children, and who this website is for
9. Cookies, analytics and consent
10. Who we share information with, and where it goes
11. Security
12. Your rights, our response times, and how to complain
13. Changes to this policy

1. Who we are, and why we have not appointed a Data Protection Officer

STACK is a trading name of Harnek Padda, a sole trader established in Scotland, in the United Kingdom. For the purposes of the UK GDPR and the Data Protection Act 2018, Harnek Padda trading as STACK is the data controller for the personal information described in this policy.

Our business and correspondence address is STACK, 16 Oliver Road, Falkirk FK1 1SR, United Kingdom. Anything to do with this policy should go by email to stackcouk@gmail.com. We do not operate a telephone line, so email is the route for privacy requests as it is for everything else; section 2 of the Contact information page explains how we handle enquiries and how quickly.

We have not appointed a Data Protection Officer. Under Article 37 of the UK GDPR a controller must appoint one only where it is a public authority, or where its core activities consist of regular and systematic monitoring of individuals on a large scale, or of large-scale processing of special category or criminal offence data. STACK is a one-person business selling a single consumer product, and none of those conditions applies, so the statutory trigger is not met and we have not created the position rather than appointing someone nominally. Privacy requests are handled by Harnek Padda personally, at the email address above.

2. The information we collect, and where it comes from

We collect the following, and no more than this:

• Identity and contact details – your name, email address, delivery address and billing address, and a phone number if you choose to give one for delivery. You give us these at checkout, or when you create an account, or when you email us.
• Order and transaction records – what you bought, the variant and quantity, the price paid, any discount used, the order and dispatch history, and any return, refund, cancellation or fault report attached to it. Section 3 covers these.
• Payment information – a narrow set of details, which is not the same as your card details. Section 4 sets out exactly what reaches us and what does not.
• Marketing preferences – whether you have asked for marketing emails, and whether you have unsubscribed. Section 5 covers these.
• Correspondence – the emails you send us and our replies, including whatever you tell us in support of a return, a fault report or a complaint.
• Device and usage information – your IP address, your browser and device type, and the pages you view. This is collected automatically by the Shopify platform in order to serve and secure the site, and, where you have consented to it, by analytics. Section 9 covers this.

We do not sell personal information. We do not buy it from data brokers, and we do not ask you for information we have no use for: we do not collect your date of birth, we do not collect a phone number for marketing, and we have no reason to hold anything about your health, beliefs or finances beyond the payment details in section 4.

3. Your account and your order records

You do not need an account to buy from us. Checkout works as a guest, and an account is optional.

If you do create one, the account holds your name, your email address, your saved delivery and billing addresses, your order history with us, and your marketing preference. We do not set, see or store a password for you: our customer accounts sign you in with a one-time code sent to your email address, so there is no password on our side to lose.

The order record behind it is the same information in a different form – who bought, what, when, where it was sent, what it cost, and what happened to it afterwards. We use it to perform the contract between us: to take payment, to get the order dispatched, to answer you about it, to handle a cancellation, return or refund under the Return and refund policy, and to keep the accounting records the law requires. The lawful bases are performance of a contract (Article 6(1)(b)) and, for the accounting records, our legal obligation (Article 6(1)(c)).

How long any of this is kept, including after you close an account, is in section 7. Section 9 of the Terms of Service points to this section and to section 7 for that reason.

4. Payment information

Payment is taken in Shopify’s hosted checkout and processed by the payment providers enabled on it, which are shown to you on the payment page before you pay. When you enter card details you are entering them into that checkout, and they go to the payment provider.

We never receive or store your full card number, and we never receive your card’s security code. They are not passed to us at any stage. Section 4 of the Terms of Service says the same thing, and this section is the detail behind it.

What does reach the order record we can see is:

• your name, billing address and delivery address, and your email address;
• the amount, the currency, and what you bought;
• the type of payment method used and, where the provider supplies it, the card brand and the last four digits;
• the provider’s own reference for the transaction, and its outcome – authorised, declined, refunded, or charged back.

That is payment information, and we do process it: to take payment, to match a payment to an order, to issue a refund to the original payment method, and to deal with a chargeback or a payment reversal under section 11 of the Terms of Service. Section 8 of the Return and refund policy explains why a refund can only go back to the method you paid with: it is the payment provider, not us, that holds the link to your card, so we can only ask it to reverse the payment it took.

The payment providers handle your card details as controllers in their own right, under their own privacy notices. We are not in a position to describe or audit their security arrangements, and we make no claim about them here. Nor do we claim any payment-industry certification of our own, because we do not handle card numbers at all.

If you pay by a method that passes us a different set of details – a wallet that supplies a token and a delivery address, for instance – then we hold only what that method actually gives us, which is generally less than the list above.

5. Marketing emails, order emails, and the lawful basis for each

These are two different things, and they have different legal bases.

Emails about your order. Once you have placed an order we send you emails about it: the order confirmation, the dispatch confirmation and tracking, a refund or cancellation notice, and anything we need to ask you in order to get the order to you. These are sent to perform the contract between us (Article 6(1)(b)). They are not marketing, and unsubscribing from marketing does not stop them, because they are part of what you bought rather than an attempt to sell you something. Section 10 of the Terms of Service says the same.

Marketing emails. We send these in two situations only:

• You asked for them. You opted in at checkout or signed up to our list. The lawful basis is your consent, under Article 6(1)(a) and regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003.
• You bought from us. We may email you about the same or a similar product, because you gave us your address in the course of a sale and were given the chance to refuse at that point and in every message since. This is the soft opt-in at regulation 22(3) of those Regulations, and the lawful basis is our legitimate interest in marketing our own product to our own customers (Article 6(1)(f)).

Either way, every marketing email carries an unsubscribe link, unsubscribing takes effect promptly and permanently, and you can also simply email us and ask to be removed. Withdrawing consent stops future emails; it does not make the earlier ones unlawful. We do not send marketing text messages and we do not pass your address to anyone else for their marketing.

6. The STACK screen-sync software

Our product is driven by a Windows desktop application published by Skydimo, a brand of Shenzhen Light Universe Technology Co., Ltd., which also manufactures the light strip. What follows comes from written answers Skydimo gave us in September 2026, in response to questions we put to them specifically so that we could describe the software accurately here.

What the software reads, and where. The application runs on your own Windows PC. It reads the colours at the edges of what your display is showing, and drives the light strip over USB so that the light matches. That reading happens locally, on your machine, as part of producing the light. There is no camera watching your screen and no box of ours sitting in your video signal path; the product page says the same, and under section 3 of the Terms of Service the product page forms part of the specification you buy.

Your screen content never leaves your machine. Neither we nor Skydimo receive an image, a recording or a copy of what is on your display. Skydimo has confirmed in writing that even a crash report excludes screen content. The colour values are read and used locally to drive the strip, and that is all that happens to them.

What the software does in normal use. It makes one outbound connection: a version check, to see whether a newer release of the software exists. There is no licence check and no activation step, and you do not need a Skydimo account to run it.

Diagnostics and usage reporting are off unless you turn them on. Skydimo has confirmed that diagnostic and analytics reporting is optional, is not enabled by default, and is not required for the product to work. Information is sent only where you actively enable it or manually submit a report. If you leave it alone, none of the following is sent. If you do enable it, what goes to Skydimo is:

• your operating system version, OS language and system architecture;
• the Skydimo software version and the controller firmware version;
• the device hardware identifier, meaning the serial number of the light strip controller;
• how many times a function has been used, and when;
• your IP address, used to place you in a rough city or region and not to track you;
• where you submit a crash report, the fault call stack and error message – not screen content.

All network features can be switched off. Skydimo has confirmed that every network-related option in the software, including the version check, can be disabled by you. The lighting itself does not depend on any of them.

Who holds it, where, and for how long. For anything the software sends, the data controller is Shenzhen Light Universe Technology Co., Ltd. (Skydimo), not us. Skydimo states that its servers are deployed in mainland China, Singapore and the European Union, and that data is routed automatically according to the user’s region. It keeps telemetry in identifiable form for 12 months and then anonymises and aggregates it; logs attached to a support ticket may be kept for up to 36 months. That processing is governed by Skydimo’s privacy policy at skydimo.com rather than by this one, and its contact addresses are support@skydimo.com and privacy@skydimo.com.

The limit of what we can tell you. The above is what Skydimo has told us in writing. We have not independently tested the application’s network traffic, so we are passing on their account rather than verifying it ourselves, and we say so plainly rather than presenting it as our own finding. If you want the detail confirmed at source, Skydimo’s addresses are above and we are happy to put a further question to them on your behalf.

What STACK receives and stores from the software: nothing. We operate no server, no account system and no online service that the application reports to. We receive no screen content, no colour data, no device identifiers and no usage statistics from it, and we hold none of it. Nothing in the order record described in sections 3 and 4 comes from the application.

7. How long we keep information

We do not keep personal information for longer than we need it.

Order and transaction records. We keep these while the order is live, and afterwards for as long as we may still need them: to deal with a return, a refund, a fault report or a chargeback; to answer or defend a claim for as long as one could still be brought, the limitation periods for which differ between Scotland and the rest of the United Kingdom and are set out in the Return and refund policy; and to keep the business and tax records we are required to keep. In practice those requirements, not our preference, are what determine the period: we keep the order record for six years from the date of the order, and then delete it. Six years is the longest limitation period that can apply to a claim about a purchase anywhere in the UK, and it comfortably covers how long we have to keep business records for tax.

Account records. Kept while the account is open. If you close it, or ask us to delete it, we delete the account record. We do not delete the underlying order records at the same time, for the reasons just given: they stop being attached to a live account, but they remain part of our order and accounting history until the periods above have run out.

Emails you send us. Kept while the matter is open and for a period afterwards proportionate to what it was about. A routine question goes sooner than a complaint or a fault report, which we may need again if the same issue recurs.

Marketing list. Kept until you unsubscribe or ask to be removed. We then keep a minimal record that you unsubscribed, so that we do not email you again by mistake.

Information collected through cookies. The lifetime is set by whoever sets the cookie; section 9 explains the categories.

8. Children, and who this website is for

This website, this store and this product are aimed at adults. Section 2 of the Terms of Service requires the buyer and account holder to be 18 or over, and explains why we set it there.

No part of the Services is directed at children. We do not design or write the site for children, we do not advertise to children, and nothing we sell is intended to appeal to children rather than to adults. We do not knowingly collect personal information from anyone under 18, and we do not ask anybody’s age. By placing an order you confirm that you are 18 or over, as section 2 of the Terms of Service requires.

If you are a parent or guardian and you believe a child has given us personal information, email us at stackcouk@gmail.com and we will delete it. You do not need to write at length: tell us the email address or the order number and we will find it.

9. Cookies, analytics and consent

Some cookies are strictly necessary. They keep your basket, sign you in, run the checkout and keep the site secure, and the service does not work without them. UK law does not require your consent for those, and we set them on that basis.

Everything else is not strictly necessary. That means analytics, which tell us how the site is used, and any advertising or marketing cookies. Under the Privacy and Electronic Communications (EC Directive) Regulations 2003 those require your consent before they are set, and we do not set them unless you give it. Our store is configured so that consent is required for visitors in the United Kingdom, and analytics and advertising are treated as separate choices rather than bundled together.

Refusing non-essential cookies does not cost you access to anything you came for: you can browse, buy, and get support without them. You can change or withdraw your choice at any time using the cookie controls on the site, or by emailing us. Withdrawing consent stops further processing from that point; it does not undo processing that was lawful while the consent stood.

Shopify also sets cookies in order to run the store and the checkout and to protect against fraud, as described in its own consumer privacy policy linked in section 10.

10. Who we share information with, and where it goes

We disclose personal information only where it is needed to get your order to you, to run the store, or because the law requires it:

• Shopify. Shopify hosts the store, runs the checkout and customer accounts, holds the order records and sends the order emails. It processes that information on our behalf, and in certain respects – its own platform analytics, fraud prevention and product improvement – it acts as a controller in its own right. You can read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal to exercise rights against Shopify directly.
• Payment providers. As described in section 4.
• Skydimo (Shenzhen Light Universe Technology Co., Ltd.), the manufacturer and software publisher. The desktop application checks for a newer version, and, if you switch diagnostic reporting on, sends the information listed in section 6 to Skydimo directly from your own machine. We are not in the middle of either and we receive no copy. Skydimo is not involved in dispatching your order and does not receive your delivery details from us.
• Zendrop, the fulfilment service we use, and the carriers who deliver. As section 4 of the Shipping Policy states openly, we do not hold stock. Orders are passed to Zendrop, which arranges dispatch from a supplier outside the United Kingdom directly to your address. Zendrop and the carriers in the chain receive your delivery name, delivery address and the contents of the parcel, together with your email address or phone number where a carrier needs it to arrange delivery or send tracking. They receive it in order to get the goods to you, and they receive nothing else – no payment details, and no account or marketing information.
• Google, which provides our email. Our customer email address is a Google account, so the messages you send us and our replies are stored on Google’s systems and handled under Google’s own terms and privacy policy. We use it to correspond with you about your order or your enquiry, and for nothing else.
• Where the law requires it. To HMRC and other authorities where we are obliged to disclose, and to our advisers or insurers where we need advice on a claim or a dispute.

We do not sell personal information, and we do not pass it to anyone for their own marketing purposes.

Transfers outside the United Kingdom. Some of this involves your information leaving the UK. Shopify and Google transfer information internationally under their own safeguards, which are set out in their privacy policies and data processing terms. Your delivery details go to Zendrop, and to the supplier and carriers who get the parcel to you, all of whom are outside the UK. That transfer is necessary in order to perform the contract you have made with us, which is the basis the UK GDPR permits at Article 49(1)(b). We have not signed a separate international transfer agreement with them, and we would rather say so than imply one exists. Separately, and only if you enable it as section 6 explains, the desktop application sends diagnostic information from your own machine to Skydimo, whose servers are in mainland China, Singapore and the European Union; that transfer runs between you and Skydimo under Skydimo’s policy rather than being something we carry out. If you want to know more about where a particular part of the chain sits, ask us and we will tell you what we know.

11. Security

The store, the checkout and customer accounts run on Shopify’s infrastructure. The security of that infrastructure is Shopify’s responsibility and not something we are in a position to audit or vouch for, so we make no claim about it here beyond the fact that it is the platform we have chosen. On our own side the picture is simple: we reach the store through the Shopify admin, and customer correspondence goes through the email address in section 1.

No system is perfectly secure, and email in particular is not a secure channel. Please do not email us card numbers, and do not send us sensitive information we have not asked for. We do not need it, and we would rather not hold it.

12. Your rights, our response times, and how to complain

Under the UK GDPR you have the following rights over your personal information. They are not all absolute, and some apply only in particular circumstances, but we will tell you plainly which applies and why.

• Access. A copy of the personal information we hold about you, and an explanation of what we do with it.
• Rectification. Correction of anything inaccurate, and completion of anything incomplete.
• Erasure. Deletion, where we no longer have a good reason to hold it. Section 7 explains where a tax or limitation period means we cannot yet delete an order record.
• Restriction. That we hold information but stop using it, while a dispute about its accuracy or our basis for holding it is resolved.
• Objection. To processing we base on legitimate interests, including our own marketing. An objection to direct marketing is absolute: we stop.
• Portability. A copy of the information you gave us, in a structured, commonly used, machine-readable form, or transmitted to someone else where that is technically feasible.
• Withdrawal of consent. Where we rely on consent, including for marketing emails and non-essential cookies, at any time and without giving a reason.

To exercise any of them, email stackcouk@gmail.com. You do not need to use any particular form of words or quote any legislation. If we cannot tell from the request who you are, we will ask for the minimum needed to match you to an order or an account – usually the order number and the email address you used – and nothing more.

Response times. We respond within one month of receiving the request. If a request is complex or you have made several, we may extend that by up to two further months, and where we do we will tell you within the first month and explain why. We do not charge for this. We may charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive, and we will say so and explain why rather than simply ignoring it.

Complaints. If you are unhappy with how we have handled your personal information or your request, tell us first, using the complaints procedure in section 4 of the Contact information page. You do not have to: complaining to us is not a precondition of anything.

You have the right to complain to the Information Commissioner’s Office, which is the UK’s data protection regulator, at any point and whether or not you have raised it with us. Its website is ico.org.uk, which has an online reporting route, and its postal address is Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You also have the right to a judicial remedy, and nothing in this policy affects that.

13. Changes to this policy

We update this policy when what we do changes, or when we have verified something we previously could not – the account in section 6 of what the desktop software transmits was rewritten on that basis. When we update it we change the date at the top, and where the change materially affects you we tell you rather than relying on you to notice.

If anything in this policy is unclear, or you want to know more about a particular part of it before you buy, email stackcouk@gmail.com and ask.