Privacy Policy & Data Processing Agreement
Last updated: 30 March 2026
This Privacy Policy explains how Sunday handles personal data in connection with its branded merchandise platform, customer relationships, orders, warehousing, fulfilment and shipping services. It explains what information we process, why we use it, who receives it and how you can exercise your privacy rights.
1 Who we are and how to contact us
Sunday is the trading name of Sunday BV, registered in Belgium under enterprise number 0539.854.587, with registered office at Kwadestraat 155,6.1, 8800 Roeselare, Belgium. In this policy, “Sunday”, “we”, “us” and “our” mean Sunday BV.
For questions about personal data, this policy or your rights, email [email protected] or write to Sunday BV at the address above, marked for the attention of the privacy team.
2 Scope and our role
This policy concerns personal data about customer representatives, platform account users and people receiving merchandise, including employees and customers of organisations using Sunday. Personal data means information relating to an identified or identifiable person. Processing includes collecting, storing, using, sharing and deleting that information.
A controller decides why and how personal data is processed. A processor handles personal data on a controller’s behalf and on its documented instructions. Sunday’s role depends on the activity concerned.
When Sunday acts as a controller
Sunday acts as a controller where it determines the purposes and means of processing for its own customer relationship and platform administration, service communications and compliance obligations. The purposes and legal bases for this processing are described in section 5.
When Sunday acts as a processor
Where an organisation provides recipient data so that we can perform logistics and fulfilment services on its behalf, that organisation is the controller and Sunday acts as its processor under the applicable Data Processing Agreement. For example, your employer may arrange merchandise for you and provide your delivery details to Sunday.
The organisation determines the lawful basis for that processing, which recipients are included and the instructions we follow. Its own privacy notice explains those decisions. This policy provides information about Sunday’s handling of those data; it does not replace that organisation’s notice or the Data Processing Agreement.
If a request concerns data we process for an organisation, we notify that organisation promptly and assist it with the request. We respond on its documented instructions or where the law requires us to do so. You may contact the organisation directly or use our privacy email address for help identifying the appropriate contact.
3 Personal data we process
Depending on your relationship with Sunday and the services used, we process the following categories of personal data:
- Identity and contact details: name, email address, telephone number and shipping address.
- Merchandise information: clothing sizes and product preferences needed for the merchandise selected or ordered.
- Order and delivery information: order history, shipments and tracking information.
- Business and account information: company, job title and account information associated with the customer relationship or platform access.
- Technical and usage information: IP addresses, device data and information about use of the platform.
- Communication preferences and engagement: marketing preferences and email engagement information. Our email communications are transactional and platform emails, as explained in section 6.
We use the information relevant to the task being performed. For example, shipping requires a delivery name and address, while choosing clothing may require a size. A recipient’s clothing size is not, by itself, a request for health information.
4 How we obtain personal data
We receive personal data directly from you when you provide details through the platform, supply account information, place an order or communicate with us about the services.
We also receive personal data from the organisation arranging merchandise or using Sunday on your behalf. This can include contact details, delivery information and clothing sizes. Shipping and fulfilment partners provide information about shipments and their progress, including tracking and delivery outcomes.
Technical and platform usage data are generated when you access or use the platform. Cookies and tracking technologies may also collect information in connection with platform use and email engagement. Section 7 explains the relevant privacy considerations.
Where the organisation arranging your merchandise supplies your information, ask it for details of the source and lawful basis of that disclosure if these are not clear from its privacy notice.
5 Why we use personal data and our legal bases
The following explanations distinguish Sunday’s own controller processing from the processing it performs on behalf of a customer organisation. A contract with your employer or another organisation does not automatically mean that you personally have a contract with Sunday.
Managing the customer relationship and accounts
We use identity, business, contact and account information to administer the customer relationship, organise access to the platform and handle service enquiries. Where you personally are party to a contract with Sunday, processing necessary to perform that contract or take steps you request before entering it is based on Article 6(1)(b) GDPR.
Where you act for an organisation, we rely on our legitimate interest under Article 6(1)(f) GDPR in administering the business relationship and communicating with its authorised contacts. We must balance this interest against your interests and fundamental rights.
Arranging merchandise and delivering orders
We use recipient names, contact details, shipping addresses, clothing sizes, product preferences, order history and shipment information to select the correct merchandise, prepare and dispatch packages, track shipments and address delivery problems.
For data processed on an organisation’s behalf, we follow its documented instructions under the Data Processing Agreement. The organisation is responsible for identifying and explaining the applicable Article 6 lawful basis. Our processor agreement is not a separate lawful basis for the organisation’s processing.
Where Sunday itself is the controller and you personally contract with us for an order, processing objectively necessary to fulfil that order is based on Article 6(1)(b) GDPR. Where we administer an organisation’s orders through its representatives, the relevant legitimate interest is managing and fulfilling that business relationship.
Sending transactional and platform communications
We use contact and account information, order details and shipment information to send communications relating to the services, platform and orders. These communications are based on contractual necessity where you personally are the contracting party, or our legitimate interest in administering and communicating about the services where you represent a customer organisation. Communications sent on an organisation’s behalf follow its instructions and lawful basis.
Operating and protecting the platform
We process IP addresses, device data and platform usage information to operate the platform and protect access to personal data. Where Sunday determines this processing, its legitimate interest is maintaining a functioning and secure service. Where access to information on your device or another tracking activity requires consent, that consent is required separately; legitimate interests do not replace it.
Meeting legal duties
Where a legal duty requires Sunday to retain records or handle a privacy request, the relevant processing is based on Article 6(1)(c) GDPR. This applies only to the information and processing necessary to meet the applicable duty. Section 10 explains how this relates to retention.
Processing based on consent
Where consent is required for a specific cookie or tracking activity, the relevant activity must be explained when consent is sought. Consent must be freely given, specific, informed and capable of being withdrawn. Under Article 6(1)(a) GDPR, withdrawal does not affect processing lawfully carried out before withdrawal.
If we intend to use personal data for a new purpose, we will provide the information required by applicable law before doing so and establish a lawful basis for that use.
6 Emails and communication choices
Sunday sends transactional and platform emails connected with the services. These include communications about orders and shipments and the operation of the platform. Providing contact details for these purposes does not by itself give consent to promotional marketing.
We process communication preferences and email engagement information in connection with our communications. Any consent required for tracking must be obtained separately from the delivery of a necessary service email.
You can contact [email protected] about communication preferences or email engagement processing. Some service messages are necessary to administer an account or complete a shipment. Objecting to optional processing does not remove our obligation to send information that is legally required.
8 Who receives personal data
We share personal data where needed to perform the relevant service, following the controller’s instructions where Sunday acts as a processor. The recipient categories used for the services are:
- Shipping companies, including DHL and UPS, for dispatch, transport, tracking and delivery. Relevant information includes recipient name, address and contact details and shipment information.
- Warehousing and fulfilment partners, for storing merchandise, selecting items, preparing packages and fulfilling orders. Relevant information includes recipient and order information and clothing sizes where needed for item selection.
- Cloud hosting and infrastructure providers, for hosting and supporting the systems through which the services and personal data are managed.
Access within Sunday is limited to personnel who need the information for their duties and who are subject to confidentiality obligations. The applicable role of an external recipient depends on what it does with the data; a recipient may act as a processor or have its own controller responsibilities.
For customer data covered by the Data Processing Agreement, Sunday’s use of subprocessors is governed by that agreement’s authorisation, contractual protection and applicable change notification provisions. This policy does not give additional authorisation to appoint subprocessors.
Where a law requires disclosure, we process and disclose the relevant information as required by that law. A legally required disclosure is distinct from routine service sharing.
9 Processing locations and international deliveries
Sunday’s platform processing is based in the European Economic Area (EEA), which comprises the EU Member States, Iceland, Liechtenstein and Norway. The Data Processing Agreement specifies physical servers within the EU.
Sunday also arranges international shipments. A delivery outside the EEA can require recipient and shipment information to be made available outside the EEA for transport and delivery. EEA hosting does not by itself mean that every disclosure connected with an international shipment remains in the EEA.
Any transfer subject to the GDPR’s international transfer rules must meet those rules. The Data Processing Agreement requires adequate protection for EEA to non-EEA transfers and provides for EU-approved standard contractual clauses unless otherwise agreed. This is a contractual requirement; the mechanism applicable to a particular shipment depends on the destination, recipient and arrangements for that transfer.
Contact [email protected] for information about the destinations and recipients relevant to your data, the transfer mechanism applicable to a particular transfer and how to obtain a copy of any relevant safeguards.
10 How long we keep personal data
The retention period for personal data used to provide customer services is the duration of the customer contract. For personal data processed on a customer organisation’s behalf under the Data Processing Agreement, Sunday must delete the data and procure deletion of all copies promptly and in any event within 10 business days after cessation of the services involving that processing. The agreement also provides for proof of deletion on request.
Legal recordkeeping obligations may require Sunday to retain particular records after the customer contract ends. Any such retention is limited to the records that the applicable law requires and the period imposed by that law. This does not create a general right to keep all platform or recipient data after termination.
You can contact [email protected] for information about the retention requirement applicable to your data. Where Sunday is acting as a processor, the customer organisation can also explain its own retention arrangements and instructions.
11 How we protect personal data
We apply technical and organisational measures appropriate to the nature of the processing and the risks to individuals. The Data Processing Agreement describes confidentiality obligations, staff awareness training, access limited according to role and need, password access, login monitoring and policies addressing backups, deletion, workstation security and changes to systems.
The agreement also requires Sunday to assess the risks arising from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data. Security measures reduce risk but cannot guarantee that an incident will never occur.
If a personal data breach affects data we process on a customer organisation’s behalf, we notify that organisation without undue delay and assist it with investigation and response in accordance with the Data Processing Agreement. Where Sunday acts as controller, we notify the competent supervisory authority and affected individuals when applicable law requires this.
12 Automated decisions and profiling
Sunday does not make decisions about individuals based solely on automated processing that produce legal effects or similarly significantly affect them. Routine automated operations, such as transmitting shipment information, do not in themselves constitute such decisions.
13 Your data protection rights
Subject to the conditions and exceptions in the GDPR, you have the following rights:
- Access: ask whether your personal data is processed and obtain a copy and information about that processing.
- Correction: have inaccurate information corrected and incomplete information completed.
- Erasure: request deletion when the legal conditions are met, for example when the data is no longer needed for its purpose. A legal duty to retain particular data can limit this right.
- Restriction: request limits on use of your data in the circumstances set out in the GDPR, including while accuracy is being checked.
- Portability: receive personal data you provided in a structured, commonly used, machine-readable format where processing is automated and based on consent or a contract with you. Where technically feasible, you may ask for direct transmission to another controller.
- Objection: object on grounds relating to your particular situation where processing is based on legitimate interests. The controller must stop unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims. You may object to direct marketing at any time, including profiling related to that marketing, and such processing must then stop.
- Withdrawal of consent: withdraw a consent at any time without affecting the lawfulness of processing before withdrawal.
- Protection concerning automated decisions: benefit from the safeguards in the GDPR concerning solely automated decisions with legal or similarly significant effects. Sunday’s current position is described in section 12.
How to exercise your rights
Email [email protected] with a description of your request and enough information to identify the relevant account, order or relationship. We may request additional information where reasonably necessary to confirm your identity. Please do not send identification documents unless requested and necessary.
For processing for which Sunday is controller, we respond without undue delay and normally within one month of receiving the request. Where necessary because of complexity or the number of requests, this may be extended by two further months; we explain any extension and its reasons within the first month.
Requests are normally free. Where a request is manifestly unfounded or excessive, the GDPR permits a reasonable fee or refusal. If we cannot act on a request, we explain the reasons and available complaint and judicial remedies as required by law.
Where your request concerns data processed on an organisation’s behalf, the organisation is responsible for deciding the response. We promptly pass the request to it and provide assistance under the Data Processing Agreement. This does not remove its applicable response deadlines.
14 Complaints
You may lodge a complaint with a supervisory authority, in particular in the EEA country where you habitually reside, work or believe an infringement occurred. You may also seek a judicial remedy under applicable law.
Sunday is established in Belgium. Information about the Belgian Data Protection Authority and its complaint procedure is available at https://www.dataprotectionauthority.be/citizen. You can contact Sunday’s privacy team first if you wish, but doing so is not a condition of your right to complain to an authority.
15 Providing data and information about children
If you or the organisation arranging merchandise do not provide the information needed for an account, item selection or delivery, we may be unable to provide the relevant feature or fulfil the shipment. For example, we cannot deliver a package without an adequate delivery address or select the requested clothing size without size information.
The Data Processing Agreement includes children among potential merchandise recipients for clothing-size processing. Where an organisation supplies such information, Sunday handles it on that organisation’s instructions. The organisation is responsible for ensuring a lawful basis and providing appropriate information to the people concerned and, where applicable, their parents or guardians. Contact our privacy team if you have a concern about a child’s data.
16 Changes to this policy
We may update this policy to reflect changes in our services, processing or legal obligations. The current version will be made available with the services. Where the law requires additional information or notification about a change, we will provide it. Where consent is needed for a new activity, publishing a revised policy or continuing to use the services does not replace that consent.