How SBS collects, uses, and protects your information
SBS is a Dublin-based resale business selling pre-owned and new streetwear, trainers, accessories, and tech. We operate at thesbsofficial.com and via our iPhone and Android apps.
Fred Bademosi trading as SBSOFFICIAL is the data controller for the personal data described in this notice. Privacy contact: [email protected]. General business contact: [email protected] or 089 996 2211.
When you create an account or place an order we collect:
When you use our iPhone or Android app we may collect:
On iPhone, we may also collect APNs and, where you use calling, PushKit device tokens, plus a Keychain-backed app-install identifier that may survive reinstall, to provide notifications and calling; bind checkout and inventory-hold recovery; help you discover a recent guest order after sign-in; prevent abuse or fraud; and enforce device-level security controls including device bans.
On Android, we may also collect a Firebase Cloud Messaging registration token and an app-install identifier to deliver notifications and identify this installation. Android asks for location access only when you choose to share a one-shot chat location, and microphone access only when you start recording a voice note; it does not use background location for ordinary shopping.
Active SBS customers are automatically enrolled in the monthly Top Bosses board. We process qualifying SBS Shop activity and record any Leave or Rejoin choice, the disclosure version, an opaque operation identifier and the time of the change. If monthly prizes are active, we also record the closed-month rank, frozen qualifying activity, fixed Credit award and Credit-ledger reference needed to settle or retry that award safely. You may choose a public board name, which is stored separately from your account profile, sign-in and order details with an availability key, revision and any moderation state. Other signed-in customers receive only that public board name or an SBS-generated name and rank. We do not publish your real name, exact spend, contact details or account identifier through Top Bosses. You can leave, reset a chosen name or report a visible board name from Account → Top Bosses at any time.
When you use Marketplace we collect and process:
Approved advert details, including the seller-declared private status, asking price, broad area and photos, can be shown to other Marketplace members and on the limited public advert fallback. We do not publish your email address, phone number, exact address, internal account identifier, moderation evidence, or private messages on that fallback.
We normally receive this information from you. We can also receive account identity information from Clerk, payment status and limited payment-reference information from Stripe, delivery information from a carrier, and Marketplace reports or messages from other members. When you voluntarily message SBS through WhatsApp, Meta supplies the support information described below.
On our website, Cloudflare Web Analytics gives us aggregate traffic information. If you choose Accept on our cookie banner, our own measurement tool creates a persistent site identifier and records pages visited, control taps, coarse visible-time buckets, and limited product, basket and checkout activity. It also records bounded source, medium and campaign tags from links to compare consenting visits from Meta, Snapchat and Google campaigns. These tags last for up to 30 minutes within a browser tab. This event record does not retain advertising click IDs, typed text, contact details or full URLs, and a browser event is not treated as a confirmed sale. When you are signed in, the server can associate ordinary activity with your authenticated account; time-spent events use pseudonymous counts without an account identifier. The same optional choice enables the Meta Pixel for advertising measurement and, when enabled for a future drop, may allow a later server-confirmed website card-purchase event. We do not load our own measurement tool or the Meta Pixel if you reject that choice.
If your iPhone Ad measurement choice and Apple tracking permission allow it, the app may share the limited activity and confirmed-payment information described below. The new AppsFlyer partner choice names AppsFlyer, Meta, Google, Snapchat and TikTok. Older Meta-only choices apply only to Meta.
We do not sell your personal data to third parties.
Marketplace uses automated rules to check listing and message text for contact details or exact addresses, prohibited or unsafe goods, counterfeits, scams, harassment, sexual content and spam. A message can be stopped before it is sent; a listing can be stopped or put into review. When the listing AI review setting is enabled, a Cloudflare-hosted AI safety classifier also assesses listing text before a clear listing result can be published automatically. An authorised SBS operator makes account-restriction decisions and handles listing appeals through the in-app Appeal option when it is shown.
Marketplace may also order available adverts using recent Marketplace-only views, saves and offers, together with item attributes such as category, brand, size and price band. It does not use private messages, contact details, payment data or an account-level score for this ranking. These systems do not set prices, decide access to a payment service, or make a decision with legal or similarly significant effect without human involvement.
We process your data under the following lawful bases (GDPR Art. 6):
Where we need information to create an account, process a Shop order, deliver an item, take payment, or provide a feature you request, not providing it can mean we cannot provide that account, order or feature. Optional marketing, analytics and location choices are not required to shop.
The public SBS drop-list is currently an email sign-up. We add an email address to that list only after the confirmation step. SMS marketing uses a separate SMS preference. Creating an account, giving us a phone number, accepting website cookies, or choosing email marketing does not by itself subscribe you to SMS. Order, delivery, security, and account messages are separate from marketing. You can opt out of marketing at any time by using the unsubscribe option in a message or emailing [email protected].
If you choose Accept on our website cookie banner, our own measurement tool records the website activity described above for SBS, and the Meta Pixel sends browser and device information plus PageView, product-view, add-to-basket, and checkout-start (InitiateCheckout) events to Meta Platforms Ireland Limited. A browser checkout-start event includes product IDs, item count, and currency, but not a client-calculated purchase value. We use this to improve the site and measure SBS advertising.
The SBS first-party campaign report groups consenting website activity by the limited source, medium and campaign tags in an incoming link. It can show tagged page, product, basket and checkout activity for Meta, Snapchat and Google links. Those tags can be changed by whoever creates a link, so they are directional measures and do not prove which ad a customer saw or which campaign caused an order. This report is not an upload of customer contacts or events to Snapchat or Google.
When reliable website measurement is available, a small retry buffer may keep consenting activity in this browser tab for up to five minutes to recover from a connection failure or page reload. It contains bounded screen and control labels and product or campaign dimensions, not form values, messages, passwords, contact details or full URLs. Changing account or withdrawing the cookie choice retires the affected retry data. Random event identifiers prevent the same submitted activity from being counted twice; the server protects these with keyed pseudonyms and removes their linkability within the existing retention window.
iPhone app ad measurement (legacy Meta-only choice): The SBS iPhone app has its own optional Ad measurement choice. Apple’s tracking permission prompt appears after the app guide. Choosing Allow establishes your initial optional SBS Ad measurement choice, which you can change in Account. Website cookies, SBS email marketing and SMS do not turn it on. If you turn it on and allow Apple tracking, SBS may, when this feature is enabled, send Meta Platforms Ireland Limited app/return visits, verified new registrations, browsing/filter actions, story/share taps, product and saved-item interactions, basket/checkout activity, action completion/drop-off and confirmed contact from the app. A confirmed contact records only a successful contact with SBS, at most once per signed-in account per day, without message content, conversation identifiers, attachments or location. Meta’s SDK also receives app/device identifiers, including the advertising identifier when permitted, and network information such as IP address to attribute these consented events. Product events use product IDs, product details, item count and currency — not your contact details, message content, free-text searches, raw order identifiers, card details or client-calculated money values. A requested order or card authorisation is never a Purchase. Optional native Purchase events use a server-confirmed paid amount after credit, currency, catalogue product IDs and an opaque event key, only for new orders after purchase measurement is enabled. Earlier iOS opt-ins keep purchase sharing off until you affirmatively enable confirmed purchase totals in Account. Turning the iPhone choice off stops new app-event logging and does not affect shopping or checkout.
Android app ad measurement: Android has an optional Ad measurement control in Account and the existing profile flow, off until you choose it. This choice does not subscribe you to email or SMS. When enabled and permitted by SBS’s live switch, Meta may receive app/return visits, verified new registrations, catalogue views and saves, basket and checkout actions, category/filter/search-use counts, sorting, story/share taps, offer/price-request actions, successful contact and confirmed paid purchases. Search-use events include counts, not typed text. Contact events include no message content and are capped per account per day. Paid-purchase events use the server-confirmed amount collected after credit, currency, product IDs/counts and an opaque event key; orders created before you enabled this choice are excluded. Meta’s SDK may use the Android advertising identifier where your device makes it available and app/device metadata plus network information such as IP address needed for attribution. SBS does not provide your contact details, message content, attachments, precise location, raw order references or card details to Meta through this feature. Turning the choice off stops new app-event logging without affecting shopping, orders or support. Activity already sent may finish processing.
New AppsFlyer partner choice on iPhone: When available, Account offers a separate choice naming AppsFlyer, Meta, Google, Snapchat and TikTok. Older Meta-only choices and previously granted Apple permission do not turn this new choice on. A newly worded Apple prompt naming these recipients can establish your first choice for the same signed-in account; you can change it in Account. The feature works only after you make that choice and allow Apple tracking, and while SBS has enabled it. Website cookies, email, SMS and notification preferences do not enable it.
AppsFlyer may receive app/device and advertising identifiers, app/OS information, network information such as IP address, pseudonymous account and event identifiers, and limited app activity. This includes app sessions, verified registration/login, product views and saves, basket and checkout actions, bounded screen/filter/story/share/offer actions, confirmed contact and notification-permission status. SBS does not send contact details, message content, attachments, precise location, typed searches, raw order references or card details through this measurement path. New eligible orders can produce server-confirmed paid amounts after SBS credit, currency, product IDs/counts and settled refund amounts. An order request or card authorisation is not revenue. AppsFlyer can forward configured measurement events to the named advertising partners; this may include consented organic activity as well as ad-attributed activity. The choice permits measurement and does not by itself establish consent to personalised advertising.
Choosing this partner path replaces the legacy Meta SDK event source for the same choice, to avoid reporting the same activity twice. Turning it off stops new app-event logging and future unsent server events. Activity already transmitted may finish processing. Refusal does not affect shopping, payment or support. Public campaign links can open Shop or a public product without enabling tracking. Apple may separately provide anonymous SKAdNetwork/AdAttributionKit install counts without device or account identifiers.
Server-confirmed website purchases: when this optional measurement is enabled for the next drop, and you have allowed marketing measurement on this website, SBS may send Meta a Purchase event only after a website card payment has actually been captured. It may include the captured purchase value and product IDs, plus the browser, device, and network identifiers needed to match that server event to browser activity — for example, a browser identifier or campaign-click identifier, IP address, and user agent. A card authorisation alone is not reported as a purchase.
That server event does not include your email address, phone number, delivery address, card details, or account details. We do not use it to upload a Customer List. We keep the raw matching context only until the eligible event is sent, skipped, or you withdraw this website marketing choice.
Rejecting or withdrawing that cookie choice does not affect browsing, checkout, or an order. Turning it off stops browser measurement immediately and stops future unsent server-confirmed website purchase events; it cannot recall an event Meta has already received. You can change the choice at any time using the Cookie settings button on the website; you can also contact us for help.
Customer List audiences: SBS does not currently upload customer email addresses or phone numbers to Meta to create Customer List audiences, and it does not upload delivery addresses for that purpose. A website-cookie choice or a normal SBS marketing opt-in does not authorise that use. If we introduce it, we will first ask for a separate, optional choice that names Meta Customer Lists, explains hash matching and the advertising purpose, records the choice, and provides an easy way to withdraw or object before any contact detail is uploaded.
When you place an order through the app or website, we receive your details and confirm the order with you. You can pay by card, Apple Pay or Google Pay where supported at checkout, or by cash or bank transfer arranged directly with us at delivery or collection in Dublin.
Card payments are processed by Stripe, not by SBS. Your full card number never reaches our servers — it goes directly to Stripe, who are the payment processor for this service. We store only what we need to recognise the payment: the last four digits, the card brand, and Stripe's own reference for the transaction.
For standard Shop orders, card and supported wallet payments are authorised at checkout and only captured once we confirm the item is available. If we cannot fulfil your order, the authorisation is released and you are not charged. Where a reservation deposit is offered, its amount and payment timing are shown separately in checkout.
Stripe processes this data as our processor under their own privacy terms: stripe.com/privacy.
If you allow notifications on our iOS app, we use Apple Push Notification service (APNs) to send Shop order updates and relevant Marketplace message, moderation, restriction, and appeal updates. Your APNs device token is stored securely and used only for delivering notifications from SBS. You can withdraw consent at any time in your iPhone Settings → Notifications → SBS.
If you allow notifications on Android, we use Firebase Cloud Messaging (FCM) to deliver SBS order, chat, Sell and Shop alerts. FCM receives the registration token and the notification title, text and routing details needed to deliver and open the alert. You can turn notifications off in your Android device settings.
When you contact us through the in-app support chat or by email, we keep those records to help resolve issues. Chat history is visible to you in your account. If you choose to message SBS through WhatsApp, Meta may deliver your new message, WhatsApp messaging identifier, profile name and message time to our separate support inbox. An authenticated SBS operator may reply through that same WhatsApp conversation while Meta permits a customer-service reply, and Meta may return sent, delivered, read or failure status information. We use that information only to handle the conversation. We do not import existing WhatsApp history, turn WhatsApp contacts into an advertising audience, or link a WhatsApp contact to an SBS account merely because a phone number appears to match.
WhatsApp support is an optional, future-message-only channel: SBS receives only messages sent after the channel was connected, together with replies SBS sends from the support inbox. We encrypt inbound and outbound message text and the WhatsApp contact identifier at rest. We retain each message, profile name, message time, the authenticated SBS operator responsible for a reply, and limited delivery-status metadata in the separate support inbox for no more than 30 days from SBS’s local receipt or send request. We do not retain Meta’s raw message identifier in the readable support record. A shorter emergency period can delete records earlier; SBS does not extend a record beyond this 30-day maximum. If the channel is paused, SBS does not intentionally collect messages delivered while it is paused. Once expired, records are no longer available to SBS support and are deleted by an authenticated nightly cleanup process, which may run up to 24 hours after expiry. If you want a support conversation deleted sooner, email [email protected]. We will verify the request before removing the conversation. After expiry or an earlier deletion, a non-readable keyed technical replay record may remain for up to 30 days solely to stop a delayed provider retry from restoring the message; it contains no message content, profile name, or raw WhatsApp identifier and cannot be used for support. If SBS completes a verified early-erasure request, we keep a content-free active privacy-erasure accountability record to evidence that action: the opaque internal thread ID, action time, authenticated staff operator and audit metadata, and a one-way pseudonym of the privacy-case reference. It does not contain message content, a WhatsApp phone or profile identifier, or the raw privacy-case reference. Deletion removes records from SBS’s active support inbox. Cloudflare D1 recovery history can retain encrypted database copies for up to 30 days on a paid plan or 7 days on a free plan; access is restricted to restore operators, and SBS reapplies retention and verified deletion requests before support access resumes after a restore. This inbox has no dispute or legal-hold retention exception in its current setup.
We share your data only where necessary to run our service:
We never sell your data. Nothing reaches Meta from this website for advertising measurement unless you accept cookies on the banner shown when you first visit. Messaging SBS through WhatsApp is separate from website cookies and is covered in the Customer Support section above. Our legal basis for website advertising measurement is your consent. Refusing changes nothing about browsing or buying: the pixel plays no part in taking, paying for, or delivering an order.
Some providers (including Cloudflare, Resend, Meta, AppsFlyer, Google, Snapchat and TikTok) may process data outside the EEA. Where a transfer occurs, we rely on the safeguards required by applicable data-protection law, such as the European Commission’s Standard Contractual Clauses where appropriate.
Account deletion makes your Marketplace adverts and advert media unavailable, closes Marketplace messaging, and removes or anonymises account-linked personal data. Content-free safety or audit records that are still needed for the purposes above may remain, and provider recovery copies may remain subject to the provider’s restricted recovery controls. We do not use those records to keep an advert or member conversation available.
Our services are for individuals aged 16 and over (the digital age of consent in Ireland). We do not knowingly collect data from anyone under 16. If you believe we have, please contact us at [email protected].
As an Irish/EEA resident you have the right to:
To exercise any right, email [email protected]. You may object to processing based on legitimate interests, including Marketplace recommendation ranking, and we will assess that request. We will respond within one calendar month.
If you have a concern about how we handle your data, please contact us first at [email protected]. You also have the right to lodge a complaint with Ireland's data protection authority:
Data Protection Commission (DPC)
dataprotection.ie
Terms & Conditions — service usage rules, buying & selling, returns
Returns & Refunds — full returns and refund process