Last updated: June 23, 2026
Introduction
Stack ehf., doing business as FastTrack ("FastTrack", "we", "us", or "our"), is committed to protecting personal information and your right to privacy.
Controller: Stack ehf., Laugavegur 178, 105 Reykjavík, Iceland. Reg. 641019-1270.
Contact: support@fast-track.io
This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:
- Visit our website at www.fast-track.io (the "Website");
- Contact us for sales, marketing, or support; or
- Interact with us in other related ways described here.
Scope — who this policy covers
| Relationship | Stack's role | Governing documents |
|---|---|---|
| Website visitors and marketing contacts | Controller | This Privacy Policy |
| Business customers' use of the FastTrack Platform | Processor (on customer's instructions) | Data Processing Agreement (DPA) and Platform Services Agreement |
| End customers of our business customers (e.g. shoppers) | Processor (on retailer's instructions) | DPA between Stack and the retailer; retailer's privacy notice to shoppers |
Where we process personal data on behalf of a business customer, that customer is the controller and is responsible for providing privacy notices to its end users (e.g. shoppers). We process such data only per the customer's instructions under our DPA.
We do not sell personal information collected from Website visitors.
1. What information do we collect?
Personal information you provide
We collect personal information you voluntarily provide when you:
- Register on the Website or request information about our products;
- Contact us (email, forms, support);
- Subscribe to marketing communications; or
- Apply for employment or partnership.
This may include:
- Identity and contact data: name, email address, phone number, company name, job title;
- Account credentials: username and password (stored hashed);
- Communications: messages you send us, support tickets;
- Marketing preferences: opt-in/opt-out choices.
We do not intentionally collect payment card numbers through the Website for Platform subscriptions (billing is handled by Stack Partners under separate agreements).
Information collected automatically
When you visit the Website, we automatically collect certain technical information:
- Log and usage data: IP address, browser type, device information, operating system, referring URLs, pages viewed, timestamps, feature usage;
- Location data: approximate location derived from IP address (not precise GPS unless you grant permission in a mobile context).
This information is used primarily for security, operation, analytics, and improving the Website.
Information we do not collect via the Website
We do not currently offer social media login on the Website, targeted advertising, prize draws, or user-to-user communications through the Website. If we introduce these features, we will update this policy.
2. How do we use your information?
We process personal information only where we have a lawful basis under GDPR Article 6 (or equivalent):
| Purpose | Legal basis | Details |
|---|---|---|
| Provide and operate the Website; create and manage accounts | Contract (Art. 6(1)(b)) | Necessary to provide services you request |
| Respond to inquiries and provide support | Contract / Legitimate interests (Art. 6(1)(f)) | Responding to your requests; improving service |
| Send service-related communications (terms updates, security notices) | Contract / Legal obligation | Administration of your account |
| Send marketing communications | Consent (Art. 6(1)(a)) | Where required; you may opt out at any time |
| Security, fraud prevention, and abuse detection | Legitimate interests (Art. 6(1)(f)) | Protecting our systems and users |
| Enforce our Terms of Use and comply with law | Legal obligation / Legitimate interests | Compliance and dispute resolution |
| Analytics and improvement of the Website | Legitimate interests (Art. 6(1)(f)) | Aggregated usage analysis; minimal impact on privacy |
| Process employment/partnership applications | Contract / Consent / Legitimate interests | As applicable to recruitment |
FastTrack Platform processing (processor role)
When a business customer uses the FastTrack Platform, we process personal data (e.g. employee accounts, transaction data, shopper data) as a processor on the customer's instructions. Purposes, categories of data, and retention are defined in the DPA and the customer's Order. See Data Processing Agreement.
We do not use Platform customer data to "sell" personal information. Use of aggregated and anonymized data to improve the Platform is governed by the Platform Services Agreement and DPA.
3. Who do we share information with?
We share personal information only as described below:
| Recipient | Purpose | Legal basis |
|---|---|---|
| Service providers (sub-processors) | Hosting, infrastructure, email delivery, support tools, analytics | Contract; DPA where applicable |
| Stack Partners | If you are referred or onboarded through a partner | Contract / Legitimate interests |
| Professional advisers | Legal, accounting, audit | Legitimate interests / Legal obligation |
| Authorities | When required by law or to protect rights and safety | Legal obligation |
| Successors | Merger, acquisition, or asset sale | Legitimate interests; notice where required |
We require service providers to protect personal information under contract. A current list of key sub-processors is in Section 5 below and in DPA Annex III.
We do not sell personal information to third parties.
4. International transfers
Primary hosting: Our Website and Platform infrastructure are hosted in the European Union (AWS eu-west-1, Ireland).
Where personal information is transferred to countries outside the EEA/UK without an adequacy decision, we implement appropriate safeguards, including:
- Standard Contractual Clauses (EU Commission Decision 2021/914, Module Two for controller-to-processor transfers); and
- Supplementary measures as described in our Data Processing Agreement.
Copies of applicable SCCs may be requested at support@fast-track.io.
Some sub-processors (e.g. payment providers) may process data in other jurisdictions. Transfers are governed by our DPA and sub-processor agreements.
5. Sub-processors
Key sub-processors we use to operate the Website and Platform include:
| Sub-processor | Service | Location / region |
|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting and storage | EU (Ireland) — eu-west-1 |
| Payment service providers (Adyen, Stripe, Teya, Rapyd, Verifone, Vipps, Blikk, Swish, and others integrated per Customer Order) | Payment processing | Primarily EU; global where required by provider or transaction |
We maintain an up-to-date sub-processor list as part of our DPA and in this Section 5. Business customers may object to new sub-processors as set out in the DPA.
6. How long do we keep information?
We retain personal information only as long as necessary for the purposes in this policy, unless a longer period is required by law.
| Data type | Retention |
|---|---|
| Website account data | While your account is active, plus 30 days after deletion request (unless legal hold) |
| Marketing contacts | Until you opt out or 3 years of inactivity |
| Support communications | Up to 3 years after resolution |
| Log/analytics data | Up to 12 months |
| Platform data (processor role) | Per DPA and Platform Services Agreement — export window and deletion timelines in Section 13 of the Agreement |
When retention ends, we delete or anonymize data. Backup copies may be retained in isolated backups for up to 90 days before automatic deletion.
7. How do we protect your information?
We implement appropriate technical and organizational measures, including:
- Encryption in transit (TLS) and at rest for stored data;
- Access controls and authentication;
- Regular backups and monitoring;
- Staff confidentiality obligations and security training.
No method of transmission or storage is 100% secure. You use the Website at your own risk and should access it in a secure environment.
Personal data breaches: Where we act as processor, we notify the business customer without undue delay and within 72 hours of becoming aware of a breach affecting their data, per our DPA.
8. Your privacy rights (EEA, UK, Iceland)
If you are in the EEA, UK, or Iceland, you have the following rights (subject to conditions and exceptions):
- Access — request a copy of your personal information;
- Rectification — correct inaccurate data;
- Erasure — request deletion ("right to be forgotten");
- Restriction — limit how we use your data;
- Portability — receive your data in a structured, machine-readable format;
- Object — object to processing based on legitimate interests or for direct marketing;
- Withdraw consent — where processing is based on consent (does not affect prior lawful processing).
To exercise rights, contact support@fast-track.io. We respond within one month (extendable by two months for complex requests).
Complaints: You may lodge a complaint with a supervisory authority. Our lead supervisory authority for Iceland-based processing is:
Persónuvernd (Icelandic Data Protection Authority)
www.personuvernd.is
EEA residents may also contact their local authority: https://edpb.europa.eu/about-edpb/about-edpb/members_en
9. Account management
You may review or update account information by logging into your account settings or contacting us.
To terminate your Website account, contact support@fast-track.io. We will deactivate or delete your account from active systems, subject to retention for fraud prevention, legal compliance, and backups as described above.
Marketing opt-out: Use the unsubscribe link in marketing emails or contact us. You may still receive service-related messages.
10. Do Not Track
Some browsers offer "Do Not Track" (DNT) signals. There is no uniform standard for responding to DNT. We do not currently respond to DNT signals. If a standard is adopted that we must follow, we will update this policy.
11. California residents (CCPA)
If you are a California resident, you have specific rights regarding personal information under the California Consumer Privacy Act (CCPA), as amended.
We do not sell personal information belonging to Website visitors, users, or consumers.
Categories collected (past 12 months)
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, email, IP address, account name | YES |
| B. California Customer Records | Name, contact information, employment information | YES |
| C. Protected classifications | Gender, date of birth | NO |
| D. Commercial information | Transaction history, payment information | NO (via Website) |
| E. Biometric information | Fingerprints, voiceprints | NO |
| F. Internet or network activity | Browsing history, interactions with Website | NO |
| G. Geolocation data | Device location | NO (precise); approximate from IP only |
| H. Sensory information | Audio, video, images | NO |
| I. Professional/employment information | Business contact details, job title | YES (if you provide) |
| J. Education information | Student records | NO |
| K. Inferences | Profiles from collected data | NO |
We may collect other information when you contact us for support, surveys, or service delivery.
Your CCPA rights
- Know — what we collect and how we use/share it;
- Delete — request deletion (subject to exceptions);
- Opt-out of sale — we do not sell personal information;
- Non-discrimination — we will not discriminate for exercising rights.
To exercise rights, email support@fast-track.io. We verify identity before responding. Authorized agents must provide proof of authorization.
Shine the Light: California residents may request information about disclosures for direct marketing once per year — contact us using the details below.
12. Updates to this policy
We may update this Privacy Policy to reflect legal, technical, or business changes. The "Last updated" date will change when we post a new version. Material changes may be notified by email or a prominent notice on the Website.
Please review this policy periodically.
13. Contact us
For privacy questions, rights requests, or complaints:
Stack ehf.
Privacy / Data Protection
Laugavegur 178
Reykjavík 105
Iceland
Email: support@fast-track.io (Data Protection Officer)
14. Review, update, or delete your data
Depending on applicable law, you may request access, correction, or deletion of personal information we hold about you as a Website user.
Contact support@fast-track.io.
If you are a business customer using the FastTrack Platform, you may also use your in-dashboard support desk at [your-tenant].fast-track.io/support.
If you are an end customer of a retailer using FastTrack (e.g. a shopper), contact that retailer directly — we process your data on their behalf as a processor.