Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal data is retained for as long as needed to provide services or fulfill collection purposes, with extensions permitted for legal obligations and dispute resolution, and that aggregate data may be retained indefinitely for research and service development.
This analysis describes what StockX's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision does not specify fixed retention periods for any data category, relying instead on purpose-based criteria and a list of factors. The authorization to retain aggregate information beyond stated retention periods for research and development purposes, without a defined timeline, creates an open-ended data retention authorization.
Interpretive note: The absence of specific retention periods for defined data categories creates ambiguity regarding actual deletion timelines, which may vary from the policy's stated purpose-based criteria depending on internal operational practices.
The updated policy authorizes StockX to share and sell personal information to a broader range of recipients than previously disclosed. Specifically, the policy now explicitly permits sharing or selling personal data, including identifiers, transaction data, and browsing behavior, to Live Sellers on the Live Shopping Platform, Sellers on the Listings Marketplace, and third-party data brokers. The prior version limited disclosures to 'sharing' with 'StockX Verified Sellers' without explicit reference to data sales or data brokers. Under the revised terms, data sale and sharing is now standard practice for analytics, advertising, and marketplace partners. The policy does not describe a consumer opt-out mechanism for this data sharing or selling.
View change record →The agreement states that personal data retention is governed by purpose-based criteria rather than fixed periods, and that aggregate data may be retained beyond the standard retention period for research and service improvement. Under these terms, users cannot determine a specific deletion timeline for their personal data from the policy text alone.
Cross-platform context
See how other platforms handle Data Retention Policy and similar clauses.
Compare across platforms →Monitoring
StockX has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We will retain your Personal Information for as long as we need it to provide you with access to our Services or to fulfill the purposes for which it was collected, as described in this Privacy Policy, unless a longer retention period is required by law or necessary to resolve disputes and enforce our agreements. Where we process Personal Information for marketing purposes, we process the data until you ask us to stop and for a short period after this request (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing so that we can respect your request in the future. We may retain aggregate information beyond the retention period for research purposes and to help us develop and improve our Services.Excerpt from StockX's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR's storage limitation principle, which requires that personal data not be kept longer than necessary for the specified purpose, and CCPA's data minimization expectations. The UK GDPR imposes equivalent storage limitation obligations. Enforcement authorities include EU national supervisory authorities, the UK ICO, and the California Privacy Protection Agency. 2) GOVERNANCE EXPOSURE: Medium. The absence of specific retention periods for defined data categories, combined with the open-ended aggregate data retention authorization, may create tension with GDPR's storage limitation principle, which generally requires documented retention schedules. Compliance teams should assess whether internal retention schedules exist and whether they are reflected in the policy. 3) JURISDICTION FLAGS: EEA and UK users are subject to GDPR and UK GDPR storage limitation requirements that may require more specific retention period disclosures than this policy provides. California users may evaluate aggregate data retention practices against CCPA's data minimization framework. 4) CONTRACT AND VENDOR IMPLICATIONS: Service providers receiving personal data from StockX should be contractually required to apply retention schedules consistent with StockX's internal policies, even where those schedules are not fully disclosed in the public-facing privacy policy. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain a documented internal retention schedule for each data category and evaluate whether the policy's purpose-based retention language is sufficient disclosure under GDPR Article 13 and 14 transparency requirements. The aggregate data retention authorization should be assessed to confirm that retained aggregate data cannot be re-identified.
This provision does not specify fixed retention periods for any data category, relying instead on purpose-based criteria and a list of factors. The authorization to retain aggregate information beyond stated retention periods for research and development purposes, without a defined timeline, creates an open-ended data retention authorization.
The agreement states that personal data retention is governed by purpose-based criteria rather than fixed periods, and that aggregate data may be retained beyond the standard retention period for research and service improvement. Under these terms, users cannot determine a specific deletion timeline for their personal data from the policy text alone.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by StockX.