Privacy &
your data

Who is responsible

The controller of your personal data, in the sense of Article 4(7) of Regulation (EU) 2016/679 (GDPR), is:

NAME

WEARNOTHING

EMAIL

hello@wearnothing.co

WEARNOTHING is not a registered business yet, and nothing is for sale until it is. The business ID and registered address will be added here before the first sale.

We are not required to appoint a Data Protection Officer and have not appointed one. Write to the address above and you reach the person who runs this.

What we collect and why

EMAIL ADDRESS

So we can tell you when something goes on sale.

SIZE AND COLOUR

The ones you picked on the page. When the shirt goes up, your email links straight to it with them already selected. Picking them reserves nothing and commits you to nothing.

WHERE YOU CAME FROM

Only if you arrived through a tagged link — a QR code on a poster, say, or a link in a partner’s post. We keep the tag, such as praha, so we know which of them actually worked. It is recorded only if you sign up.

SIGNUP DATE AND IP ADDRESS

Stored once, with your signup, as evidence of your consent, which the GDPR requires us to be able to show. The IP address is not used to locate you or for anything else.

That is the whole list for the waitlist. We do not ask for your name, age or country, because none of that is needed to send you an email.

If you buy

NAME, EMAIL, PHONE

So the parcel reaches you, and so you and the carrier can reach each other about it.

ADDRESS OR PICKUP POINT

Where the parcel goes: your address, or the Zásilkovna point you chose.

THE ORDER

What you bought, size, colour, quantity, price, date, and the tag of the link you came from, if it had one.

PAYMENT

You pay on Stripe’s own page. Your card number goes to Stripe and never reaches us. We see that you paid and how much.

Legal basis

The waitlist: your consent, under Article 6(1)(a) GDPR, given by ticking the box and then clicking the link in the confirmation email. You can withdraw it at any time. Withdrawing does not make what happened before unlawful, but it stops everything after.

Buying: we need your order details to deliver what you paid for — that is performing our contract with you, Article 6(1)(b) GDPR. We keep the records of the sale because tax law makes us, Article 6(1)(c).

Visiting the site: like every web host, Netlify processes your IP address to deliver the page and keep the site secure. That is our legitimate interest in running a working website, under Article 6(1)(f) GDPR. We do not use those logs to identify or follow anyone.

Who else sees it

• Brevo — Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France — keeps the list and sends the emails, as our processor under Article 28 GDPR. Where Brevo uses sub-processors outside the EU, the transfer runs under the safeguards in its data processing agreement.
• Netlify — Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA — hosts this website and passes the form on to Brevo. Netlify is certified under the EU–U.S. Data Privacy Framework and also uses the European Commission’s Standard Contractual Clauses.

If you buy, also:

• Stripe — Stripe Payments Europe, Limited, Ireland — takes the payment. For fraud prevention and financial regulation Stripe is responsible for that data itself, under its own privacy policy.
• Zásilkovna — Zásilkovna s.r.o. (Packeta), IČO 28408306, Prague — delivers parcels in the Czech Republic and Slovakia and gets your name, phone, email and address or pickup point. Parcels to other countries go with the carrier named in your shipping email, which gets the same details.

Nobody else. Your details are never sold, rented, swapped or given to an advertising network.

How long we keep it

Until you unsubscribe, or until 24 months after the last email we sent you about something going on sale — whichever comes first. Then the record is deleted from Brevo, including the consent log. If you never click the confirmation link, you are not added to the list and nothing else is sent to you. If the brand stops existing, the list is deleted, not sold.

Orders are kept for as long as Czech tax law requires us to keep records of a sale, and then deleted.

Cookies and tracking

There are none. No cookies, no analytics, no Meta Pixel, no Google Tag Manager, no local or session storage. The page loads nothing from any other company — even the typeface is served from this site. That is why you were not asked to accept anything.

One exception, and only if you ask for it: when you click to choose a Zásilkovna pickup point, the map is loaded from Packeta’s servers, which then see your IP address. Paying happens on Stripe’s own page, which has its own cookies and privacy policy.

If that ever changes — if we run ads, for example — this page is updated first, and a consent banner appears that blocks those scripts until you say yes.

Your rights

Under Articles 15 to 22 GDPR you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct it if it is wrong;
• delete it (Article 17 — "the right to be forgotten");
• restrict what we do with it;
• hand it over in a machine-readable file (Article 20);
• stop processing it altogether;
• withdraw your consent, which the unsubscribe link in every email from the list does in one click.

Write to hello@wearnothing.co and you get an answer within 30 days. There is no charge.

We do not carry out automated decision-making or profiling under Article 22.

If we get it wrong

You can complain to the Czech supervisory authority:

AUTHORITY

Úřad pro ochranu osobních údajů

ADDRESS

Pplk. Sochora 27, 170 00 Praha 7, Czech Republic

WEB

uoou.gov.cz

If you live in another EU country you may complain to your own national authority instead.

Changes

If this policy changes in a way that affects what we do with your data, everyone on the list gets an email about it before it takes effect. Not a "we've updated our terms" email that says nothing — an actual description of what changed.