Fairphone

Collects what you'd expect from a hardware ecommerce company — device data, browsing behaviour, purchase history — but also feeds full IP addresses to Bloomreach for segmentation and profiling, runs retargeting, and the My Fairphone App collects device telemetry.

No data sold and no third-party data purchased — strong commitments for an ecommerce company — but device information and browsing activity are shared with advertising networks and business partners, and international transfers outside the EU/EEA occur under SCCs.

GDPR rights are available but several structural limitations undermine them in practice: deletion requests default to anonymisation rather than actual deletion; forum posts older than 60 days can never be fully deleted; contract data is retained for a minimum of seven years; and Global Privacy Control signal support is absent.

Netherlands GDPR jurisdiction with an active supervisory authority; explicit no-selling and no-purchasing commitments; material policy changes notified — but no security certifications are cited, some retention periods are vague, and the advertising infrastructure creates tension with the ethical brand promise.