Privacy Policy

1. Data Controller Identity

This Privacy Policy is issued on behalf of Squad Outfitters ("we", "us", or "our"). We are the data controller responsible for your personal data collected through this website and our services.

2. Third-Party Disclosure & Sub-processors

To provide our services efficiently and securely, we share necessary data with trusted third-party sub-processors:

• Stripe: Used for payment processing and fraud prevention. They process your payment details securely.
• Brevo: Used for sending transactional emails, order updates, and invoicing.

3. Legal Basis for Processing (GDPR)

We process your personal data under the following lawful bases:

• Contractual Necessity: Processing is required to fulfill your order and provide our custom patch services.
• Legitimate Interest: Ensuring the security of our platform, preventing fraud, and improving our services.
• Consent: Where required (e.g., for non-essential cookies or marketing communications).

4. Consumer Rights (CCPA/CPRA 2026 & GDPR)

You have the following rights regarding your personal information:

• Right to Know/Access: You have the right to request access to the personal data we hold about you, including data processed beyond the standard 12-month lookback period.
• Right to Delete: You can request the deletion of your personal data, subject to legal and contractual exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal data.
• Do Not Sell or Share My Personal Information: We do not sell your personal data. You have the right to opt-out of the sharing of personal data for cross-context behavioral advertising. We automatically honor Global Privacy Control (GPC) signals transmitted by your browser.
• Limit the Use of My Sensitive Personal Information: If applicable (e.g., precise geolocation or financial data), you have the right to limit our use of this data to what is strictly necessary to perform our services.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes we collected it for, including to satisfy any legal, accounting, tax, or reporting requirements. For example, invoices and related transaction data are kept for a minimum of 7 years to comply with tax obligations.