Privacy Policy

Pop This Shop: Privacy & GDPR Statement

Last updated: 14 October 2026

Your privacy matters to us. This statement explains which personal data Pop This Shop collects, why, on which legal basis, with whom we share it, how long we keep it and which rights you have. It applies to everyone who uses the Pop This Shop website and services (the “Platform”): space owners (“Landlords”), brands and creators (“Tenants”), advertisers, visitors, journalists we contact and anyone who writes to us.

Words with a capital letter have the meaning given in our Terms of Service.

1. Who We Are

The controller of your personal data is JEM Projects BV, trading as “Pop This Shop”, a company under Belgian law with enterprise number (KBO/BCE) 0678.739.781, registered office at Prins Boudewijnlaan 147, 2610 Wilrijk (“Pop This Shop”, “we”, “us”).

For any question about your data or your rights, send us a message through our contact form and choose “Privacy” as the subject, or write to us at our registered office. Every message gets a ticket number and is answered by a person.

2. In Short

• We only collect what we need to run a safe marketplace: your account, your listings, your bookings, payments, invoices and the messages you send through the Platform.
• We never sell your data and we do not show third-party advertising based on your profile.
• Exact addresses and contact details are not public. They are shared with the other side step by step, only when a booking goes ahead.
• We use automated checks, including AI, to keep contact details and payments on the Platform and to spot misuse. A person always makes the decisions that matter.
• Analytics cookies are only used if you allow them.
• You can see, correct, download or have your data erased, within the limits the law allows, and you can close your account at any time.

3. Which Data We Use, Why and on Which Legal Basis

3.1 Your account

Name, e-mail address, password (stored encrypted), account type (Landlord, Tenant or advertiser), chosen avatar, language, year of birth, gender and your confirmation that you are 18 or older. We use this to create and run your account and to let you use the Platform (performance of a contract). Your year of birth lets us check that you are an adult (performance of a contract) and, together with your gender, is used for anonymous statistics about our community (legitimate interest). Year of birth and gender are never shown to other users and never used in our checks, risk levels or approval decisions. You can choose “Prefer not to say” for gender.

3.2 Company, tax and identity data

Company name, address, VAT number (checked through the EU VIES system or the relevant national register), the brand and company name of a Tenant, and, for Landlords, the information we must report under DAC7 (such as tax identification number, date and place of birth, company number and the cadastral reference of the Space). Identity checks are carried out by Stripe. We use this to issue correct invoices, to apply VAT correctly and to meet our legal obligations (performance of a contract and legal obligation).

3.3 Listings and concept listings

Texts, photos, prices, availability, size and the exact address of a Space (never shown publicly), and for Tenants the description of their concept. Location data (GPS) is removed from uploaded photos; we may keep it privately to compare it with the address of the Space. We use this to publish and review listings and to show them in search results (performance of a contract and legitimate interest in a safe, reliable marketplace).

3.4 Booking requests, viewings, bookings and rental agreements

Booking requests, the Tenant’s brand and project, viewing requests and confirmations, bookings, check-in, cancellations and their reasons, rental agreements signed online, reviews and the acceptance of our protection rules. We use this to make and carry out bookings (performance of a contract) and to handle disputes and legal claims (legitimate interest).

3.5 Payments, payouts and invoices

Payments are processed by Stripe. We receive the payment status, the type of payment method and its last digits, the payout account and a reference to the saved card of a Landlord (card authorisation), never the full card number. We create invoices, credit notes, self-billing invoices and payout statements and keep them for the period required by law. Legal basis: performance of a contract and legal obligation (accounting, VAT, anti-money laundering checks by Stripe, DAC7 reporting to the Belgian tax authorities).

3.6 Messages and attachments

Messages and files that Members exchange through the Platform, and their automatic translation. Messages and attachments are checked automatically for contact details, payment details and arrangements outside the Platform (see Section 4). Detected details are masked. Messages that are flagged can be read by our team; every time someone opens the original text, this is logged. Legal basis: performance of a contract (messaging, translation) and legitimate interest (enforcing our rules and protecting both sides against fraud and bookings outside the Platform).

3.7 Protection records and risk analysis

For each Landlord and Tenant who are in contact, we keep a protected record of their contacts on the Platform from the First Contact (see Section 10.7 of the Terms). After a cancellation, declined or expired request we may assess the risk that a booking was moved outside the Platform, using information on the Platform and publicly available information, and we may compare accounts (for example company, VAT number, e-mail domain, phone number, payment details or logo) to detect duplicate or related accounts. Legal basis: legitimate interest (fraud prevention and enforcing our Terms). A risk level never leads to a measure by itself: any claim or restriction is decided by a person.

3.8 Advertising, featured listings and banners

Company and billing data of advertisers, the banners and featured listings they book, payments, invoices and performance figures. Paid banners are checked before they are shown (see Section 4). Legal basis: performance of a contract and legitimate interest (a safe Platform).

To count how often a banner is seen and to make reports for advertisers, we record anonymous statistics about views: the position, the approximate country and city (looked up from the IP address in a database on our own server; we do not keep the IP address for this), the language, the type of device, operating system and browser, and the last searched location. Advertisers only receive percentages and totals, never data about individual visitors. Legal basis: legitimate interest.

3.9 Press releases, newsroom, success stories and social media

The answers, texts, photos and brand details a Tenant provides for a press release, the draft texts and their translations, and the publication in our newsroom (without the Tenant’s contact details). With the Tenant’s consent, we also use photos and texts for success stories and social media posts, and tag the brand’s social media accounts. Social media accounts given for this purpose are private and are not shown on the Tenant’s listing. Legal basis: performance of a contract (press release) and consent (social media; you can withdraw it at any time). We may look at public posts of the accounts given to us to check that bookings are made through the Platform (legitimate interest).

3.10 Journalists and other media contacts

To send press releases, we keep the name, role, media outlet, professional e-mail address, country or region and the public web page where the address was found, and how often and when we contacted the person. We only use professional contact details that are publicly available. Legal basis: legitimate interest (business-to-business press relations). Every press e-mail contains an unsubscribe link; after an unsubscribe or a bounce we never write to that address again. When we first contact a journalist, we refer to this statement.

3.11 E-mails we send and e-mail measurement

We keep a copy of the e-mails the Platform sends (recipient, subject, content and date) as proof and for support. In some e-mails we may measure whether the e-mail was opened and which links were clicked, using a small image and redirected links. We use this only to improve our communication, for example to know which journalists are interested in our press releases. You can prevent it by blocking images in your e-mail program. Legal basis: legitimate interest.

3.12 Contact form

Name, e-mail address, subject, message and the ticket number we give it. We send you a confirmation with the ticket number. To stop spam we use an invisible field and a short sum; no external captcha service is used. Legal basis: legitimate interest and steps at your request before a contract.

3.13 Security and logs

Login attempts, IP addresses, two-step verification codes sent by e-mail, firewall and error logs, and logs of actions by our team (for example an approval despite open findings). Legal basis: legitimate interest (security of the Platform and accountability).

3.14 Newsletter

If you subscribe to our newsletter, we use your e-mail address and preferences to send it. Legal basis: consent, which you can withdraw at any time with the link in every newsletter.

4. Automated Checks and AI

To keep the Platform safe and fair, we use automated checks, including AI models provided by OpenAI:

• Listings and concept listings: texts and up to 10 photos are checked for contact details, the exact address, identifying details, payments outside the Platform, discrimination, misleading or unlawful content and photo quality.
• Messages and attachments: checked for contact details, payment details and the intention to move a booking or payment outside the Platform.
• Banners: the image, the text, and the title and description of the page behind the link are checked, and the text is translated into English for our team.
• Documents such as the permission to list a Space, and the risk analysis described in Section 3.7.
• Translations of messages, listings and e-mails, and help with writing press releases and social media posts.

The result is a risk level (low, medium or high). Content with a low risk level may be approved automatically, and our team checks a random sample afterwards. Content with a medium or high level is always reviewed by a person. We never refuse a listing, restrict an account or claim an amount on the basis of an automated decision alone; these decisions are always taken by a person, and you can always ask for an explanation and contest a decision. Only the information needed for the check is sent; we do not send your name, e-mail address or user ID with messages. We keep a technical log of each AI request (time, purpose, model and result status), without the texts themselves.

5. Who We Share Data With

With other Members. Your public profile (with your initials or chosen name and avatar), your listings and your reviews are visible on the Platform. Contact details are shared step by step: from a booking request, the names of both sides and the Tenant’s brand and project; after payment, or 24 hours before a confirmed viewing, the exact address and contact details. A Landlord and a Tenant who exchange data for a booking are each responsible for how they use it.

With service providers that process data on our behalf and only on our instructions:

• HostGator (hosting of the Platform and e-mail);
• Stripe (payments, payouts and identity checks; Stripe is also an independent controller for its own legal obligations);
• OpenAI (automated checks, translations and writing help, see Section 4);
• Google (Analytics and Tag Manager, only if you accept analytics cookies);
• Wordfence (security and firewall);
• WPsigner (online signing of rental agreements);
• Metricool (planning of social media posts) and the social networks on which we post (Meta, LinkedIn, TikTok);
• our newsletter tool;
• our backup service and our accountant.

With authorities when the law requires it, for example the Belgian tax authorities (DAC7 and VAT), or to establish, exercise or defend legal claims.

We do not sell personal data.

6. Transfers Outside the European Economic Area

Some of our service providers (such as HostGator, OpenAI, Google, Stripe and Wordfence) are based in, or may process data in, the United States. Where data is transferred outside the European Economic Area, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information about these safeguards.

7. Cookies

We use cookies and similar technologies. When you first visit, you choose which ones you accept: “Only necessary”, “Cookie preferences” or “Accept all”. You can change your choice at any time via “Cookie settings” at the bottom of every page. We keep a record of your choice.

• Necessary (always on): login and session, shopping cart and checkout, payments (Stripe), security, your cookie choice, the last location you searched for (pts_sloc, used to show relevant banners), the account type you chose when signing up (pts_signup_as) and a notice after closing an account (pts_closed_notice).
• Analytics (only with your consent): Google Analytics and Google Tag Manager, to understand how the Platform is used. Without your consent these tags do not set cookies (Google Consent Mode, denied by default).
• Marketing: currently not used.

8. How Long We Keep Your Data

We keep data only as long as we need it:

• Account data: while your account is open. After closing, we keep what is needed for the periods below and then delete or anonymise it.
• Invoices, credit notes, self-billing invoices and accounting records: 10 years (legal obligation).
• DAC7 data of Landlords: 10 years (legal obligation).
• Bookings, messages, rental agreements, check-in, protection records and related evidence: 5 years after the last booking or contact, to handle disputes and legal claims.
• Listings and reviews: removed from the Platform when you close your account; kept internally for 5 years as evidence in case of a dispute, then deleted.
• Profile photo or logo, social media accounts, year of birth, gender, consents and marketing preferences: deleted or anonymised when you close your account.
• Copies of e-mails, AI check results and technical logs: 2 years.
• Media contacts: until they unsubscribe or an e-mail bounces, otherwise 3 years after the last contact.
• Contact form messages: as long as needed to answer the question, and at most 2 years.
• Backups: up to 90 days.

If a legal claim or investigation is ongoing, we may keep the relevant data until it is closed.

9. Closing Your Account

You can close your account at any time in your account settings, when there are no running bookings or amounts due. You can no longer log in, and your listings, profile and reviews are removed from the Platform straight away. Data we no longer need is deleted or anonymised at once; the rest is kept for the periods in Section 8. For a short time after closing, you can reopen your account with the link in the confirmation e-mail.

10. Your Rights

Under the GDPR you have the right to:

• access your data and receive a copy;
• correct inaccurate data (you can change most data yourself in your account);
• have your data erased, unless we must or may keep it (for example invoices, or evidence for a dispute); in that case we tell you what we keep, why and for how long;
• restrict the processing of your data;
• receive the data you gave us in a structured, commonly used format (data portability);
• object to processing based on our legitimate interest, including e-mail measurement and the analysis described in Section 3.7;
• withdraw your consent at any time, without affecting earlier processing;
• not be subject to a decision based solely on automated processing that significantly affects you, and to obtain human review of a decision, express your view and contest it.

Send your request through our contact form with the subject “Privacy”. We answer within one month. We may ask you to confirm your identity first. Exercising your rights is free.

If you believe we do not handle your data correctly, please tell us first so we can solve it. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be) or the authority in your own country.

11. Security

We protect your data with technical and organisational measures, including encrypted connections, encrypted passwords, two-step verification by e-mail, a firewall, restricted access for our team based on their tasks, logging of sensitive actions, invoices and contracts stored in folders that cannot be reached from the web, and regular backups. No system is completely secure; if a data breach is likely to put you at high risk, we will inform you.

12. Age

The Platform is only for people aged 18 or older. We do not knowingly collect data of minors. If you believe a minor has created an account, please let us know and we will close it.

13. Changes to This Statement

We may update this statement when our services or the law change. The date at the top shows the latest version. If a change is important, we let you know by e-mail or on the Platform.

This statement is available in English. In case of inconsistency, the English version prevails.

14. Contact

JEM Projects BV, trading as “Pop This Shop”, enterprise number (KBO/BCE) 0678.739.781, registered office at Prins Boudewijnlaan 147, 2610 Wilrijk.

Questions about your privacy? Send us a message through our contact form. A real person will answer.