Privacy Policy

1. Who is responsible for your data

SponsorMyStuff is a project of JBW Unipessoal LDA (previously trading as Jackie Brown Works or JBW), VAT/NIF PT516963929, at Av D Lourenço N 103, 3 Esquerdo, 4705-444 Celeirós, Braga, Portugal. JBW Unipessoal LDA is the data controller for the personal data described here. Full operator details are on the Imprint page.

Contact for any privacy matter, including the requests in §9: catalina@jackiebrown.works.

2. What we collect

When you contribute as a sponsor:

• Your email address. Stored against the contribution, used for receipts and campaign notifications. It does not identify or authenticate you and need not match one used before.
• Company name, website, description and logo. These are published on the site and printed on the bottle - that is the thing you are paying for.
• Whether you ticked "seeking funding or an exit". If you tick it, this is shown publicly as a label next to your name in the sponsor directory.
• Contribution amounts, timestamps and Stripe payment identifiers, used to work out totals and ranking.
• A record that you accepted the Terms, with the time you did so.
• Your notification preference, and when we last emailed you about being outbid, so we cannot email you repeatedly.
• A private management link token, which is how you return to your own contribution without an account.
• Your IP address, recorded when you submit the contribution form, solely to rate-limit abuse. See §6 for how long.

We also count clicks through to sponsor websites. That count is a running total only - no IP address, identifier or profile is stored against a click.

3. Why we process it, and our legal basis

• Running the campaign and publishing your sponsorship - performance of a contract (GDPR Art. 6(1)(b)). This is what you are buying, so it cannot be opted out of while your sponsorship stands.
• Sending receipts and management links - performance of a contract.
• Telling you when you have been outbid - our legitimate interest in a functioning auction (Art. 6(1)(f)). You can switch it off at any time, from your management page or the one-click unsubscribe in every such email.
• Rate-limiting the contribution form by IP - our legitimate interest in preventing abuse (Art. 6(1)(f)).
• Keeping payment and tax records - a legal obligation under Portuguese accounting and tax law (Art. 6(1)(c)).

4. What is public

Your company name, logo, website, description, contribution total, rank, click count and - if you ticked it - your seeking-funding label are all shown publicly on this site and shared with anyone who scans the QR code on the bottle. Your email address, IP address and management link are never published.

5. Who else processes it

• Stripe - payment processing and tax calculation. Card details go directly to Stripe on Stripe's own hosted page; we never see or store them.
• Resend - sending the transactional emails described above. Resend receives your email address and the message content.
• Hetzner - hosting and database. Hetzner is a German company and the data is stored within the European Union.

We do not sell personal data, and we do not share it for advertising. Hosting stays in the EU. Stripe and Resend may process data outside the European Economic Area; where they do, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

6. How long we keep it

• Sponsor and contribution records - for the campaign, and afterwards for as long as Portuguese tax and accounting law requires records of the underlying payment to be kept.
• Rate-limiting records containing IP addresses - these are only meaningful for sixty seconds, and are deleted once they are no longer needed for that purpose.
• Click counts - kept as running totals for the life of the campaign. They contain no personal data.

7. No accounts, no profiling

There are no accounts or passwords. A sponsor is identified solely by its normalised website address. We do not profile you, and no decision affecting you is made by automated means - your rank is simple arithmetic on amounts you chose to contribute.

8. Cookies

This site sets no cookies for visitors, and uses no analytics, advertising or tracking scripts. One strictly-necessary cookie (sms_admin_session) is set only when the site owner signs in to the private admin area; it is never set for sponsors or visitors. Stripe's checkout page, hosted on Stripe's own domain, may set its own cookies under Stripe's privacy policy - that is between you and Stripe.

9. Your rights

Under the GDPR you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Where we rely on legitimate interest you may object at any time, and for the outbid emails you can simply unsubscribe. Ask by emailing catalina@jackiebrown.works; we will respond within one month.

Deleting a sponsorship removes it from the site and the directory. We may still have to keep the underlying payment record where tax law requires it.

If you think we have handled your data wrongly, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or to the authority where you live.

10. Children

This is a sponsorship service for companies and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, email us and we will delete it.

11. Changes

If we change what we collect or why, we will update this page and the date at the top of it.