Privacy Policy

1. DATA CONTROLLER & GENERAL INFORMATION

This Privacy Policy governs the processing of personal data collected from users of the WEARBY digital platform ("the Platform"), a curated online marketplace owned, operated, and controlled by WEARBY DIGITAL SERVICES S.L., a corporate entity legally incorporated and existing under the substantive laws of Spain. WEARBY operates globally, ensuring full compliance with the European Union's General Data Protection Regulation (GDPR) as well as applicable federal and state privacy statutes within the United States of America.

For any inquiries, exercise of data rights, or formal communication regarding your privacy, users may contact the data controller directly via email at: hello@wearby.co.

2. CATEGORIES OF PERSONAL DATA COLLECTED

WEARBY only collects personal data that is strictly necessary for the performance, security, and optimization of our digital marketplace intermediation services:

  • Data Provided Directly by the User: Full name, email address, account login credentials, complete physical billing and shipping address, contact phone numbers, and any correspondence history with our customer support and mediation teams.
  • Data Collected Automatically: IP address, device metadata (hardware model, operating system), browser type, unique session identifiers, and detailed analytical usage data showing patterns of interaction within the Platform interface.
  • Data from Integrated Third Parties: Identity verification details, fiscal information (including individual NIF/NIE), and financial onboarding data securely managed externally by our gateway processor (Stripe Connect), as well as real-time package delivery tracking status updates provided by partner logistics carriers.
  • Identity Verification Data: Where seller verification involves government-issued ID or a live photo/video check, this may constitute a special category of data under Article 9 GDPR (e.g., biometric data used to confirm identity). WEARBY obtains explicit consent for this specific processing and uses it solely to confirm the applicant's identity.

3. PURPOSES OF DATA PROCESSING

User personal data is systematically processed under strict technical standards for the following explicit purposes:

  • To manage user registration, maintain Buyer accounts, and verify public profile listings for creators ("Sellers").
  • To process secure financial transactions, manage commission cuts, and arbitrate the temporal escrow holding system.
  • To generate dynamic logistics labels and facilitate the physical delivery of unique, one-of-one items between users while ensuring sender anonymity.
  • To safeguard the Platform infrastructure against cyberattacks, fraudulent activities, account takeovers, and illicit trade.
  • To strictly satisfy tax recording requirements, corporate accounting duties, and mandatory regulatory reporting protocols (such as the EU DAC7 Directive disclosure to the Spanish Tax Agency - AEAT).

4. LEGAL BASIS FOR PROCESSING (EU GDPR)

In accordance with the General Data Protection Regulation (GDPR), WEARBY's lawful processing relies on: (i) Contractual Necessity: Required to execute the platform terms and fulfill buyer-seller purchase agreements; (ii) Legal Obligation: To remain compliant with Spanish and European tax, civil, and regulatory laws (including statutory reporting mandates); (iii) Legitimate Interests: Focused on fraud prevention, platform infrastructure enhancement, and preserving marketplace ecosystem security; and (iv) Explicit Consent: Where processing involves special category identity-verification data as described in Section 2.

5. SECURE PAYMENT PROCESSING & STRIPE CONNECT

All financial transaction execution, payment card authorization, identity verification, and seller account payout distributions are handled exclusively through integrated Stripe Connect channels. WEARBY DIGITAL SERVICES S.L. does not harvest, store, or process credit card numbers, bank accounts, or sensitive financial data. Stripe operates independently as an autonomous Data Controller and strictly maintains international PCI-DSS security compliance standards.

6. SECURE DELIVERY LOGISTICS & CREATOR ANONYMITY

To facilitate physical parcel transport, essential delivery parameters are shared with carrier partners. However, data visibility is strictly restricted to uphold security.

Creator Confidentiality and Privacy Clause: To guarantee absolute physical safety, residential privacy, and digital peace of mind for our verified public figures, athletes, and celebrities acting as Sellers, WEARBY's Secure Delivery protocol automatically masks the Seller's real legal name, private address, and personal contact details on the shipping label. It is replaced with a neutral corporate logistics transit identity. Any attempt by a Buyer to intercept, track, or uncover a creator's location via shipping data constitutes a material breach of the platform Terms, causing immediate account deletion and legal prosecution.

7. REGULATORY REPORTING & TAX DISCLOSURES (DAC7 DIRECTIVE)

Pursuant to European Union Directive 2021/514 ("DAC7") and its corresponding transposition into Spanish tax legislation, WEARBY DIGITAL SERVICES S.L. is under a binding statutory obligation to collect, cross-verify, and report detailed fiscal and transactional records of eligible EU-based Sellers to Spain's tax authorities (Agencia Estatal de Administración Tributaria - AEAT). This mandatory disclosure is automatically triggered for any Seller who completes thirty (30) or more sales transactions, or exceeds two thousand Euros (€2,000) in total gross sales proceeds within a single calendar year on the Platform.

The shared personal data includes verified legal names, physical addresses, fiscal identification numbers (NIF/NIE), total financial considerations received per quarter, and financial account identifiers linked via Stripe Connect. Data subjects explicitly acknowledge that this processing is a non-negotiable statutory obligation.

8. DATA SHARING & INTERNATIONAL DATA TRANSFERS

WEARBY does not sell, trade, lease, or rent user personal data to third-party advertising firms for marketing purposes under any circumstances. Personal information is strictly shared only with critical operational vendors acting as Data Processors (cloud hosting infrastructure, integrated secure gateways, and licensed logistics carriers). Should any processing require data transit outside the European Economic Area (EEA), Standard Contractual Clauses (SCCs) approved by the European Commission are legally deployed to ensure an equivalent level of protection.

9. DATA RETENTION POLICY

Personal information is retained only as long as necessary to fulfill the operational, transactional, and regulatory purposes detailed in this policy. As a general guideline:

  • Account and transaction data: retained for as long as the account is active, and for up to six (6) years following account closure, to comply with Spanish commercial and tax record-keeping obligations.
  • Fiscal and DAC7 reporting data: retained for the statutory period required under Spanish tax law, generally up to ten (10) years.
  • Identity verification data: retained only for as long as needed to complete and periodically re-confirm seller verification, and deleted thereafter unless a longer period is legally required.
  • Customer support and dispute correspondence: retained for up to six (6) years to allow for the resolution of potential legal claims.

Upon account deletion or completion of operational needs, data will be structurally blocked and securely archived for the duration of the applicable statutory limitation periods to resolve potential legal claims or auditing actions.

10. USER RIGHTS UNDER THE EUROPEAN UNION (GDPR)

Users residing within the European Union possess full statutory data rights, which include: the right to access personal records, rectify inaccuracies, request deletion (right to be forgotten), restrict specific processing, object to automated profiling, and request structured data portability. These rights can be exercised completely free of charge by emailing a formal identity-verified request to the Data Controller at: hello@wearby.co.

11. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

Without prejudice to any other administrative or judicial remedy, users have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of their habitual residence, place of work, or place of the alleged infringement. In Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es. Users in other EU Member States may instead contact their local data protection authority.

12. DATA BREACH NOTIFICATION

WEARBY maintains internal procedures to detect, investigate, and respond to personal data breaches. In the event of a breach that is likely to result in a risk to the rights and freedoms of individuals, WEARBY will notify the AEPD without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of it, in accordance with Article 33 GDPR. Where a breach is likely to result in a high risk to affected users, WEARBY will also notify those users directly and without undue delay, in accordance with Article 34 GDPR.

13. INFORMATION SECURITY MEASURES

WEARBY implements robust technical, organizational, and logical security frameworks (including full end-to-end HTTPS encryption, tokenization, and data-at-rest encryption protocols) to thoroughly shield private information against accidental loss, unauthorized destruction, data leaks, or unlawful modification.

14. UNITED STATES PRIVACY RIGHTS

Pursuant to state-level consumer privacy laws across the US (including the CCPA/CPRA in California, among others), American users are entitled to request access, correction, and deletion of their personal data, alongside detailed disclosure on categories collected. WEARBY officially confirms that it does not sell, trade, or monetize personal consumer information to third-party brokers or data harvesters.

15. COOKIE & TRACKING ARCHITECTURE

The Platform uses essential technical and analytical cookies to preserve active user login states, secure checkout timer countdown sequences, and review aggregated platform navigation performance. Full details of each cookie category, its provider, and its duration are set out in our separate Cookie Policy. Users can manage, block, or delete cookies at any time via our in-platform preference center or their native web browser control console.

16. POLICY MODIFICATIONS

WEARBY reserves the absolute right to modify this Privacy Policy at any time to adapt to new regulatory amendments, changing judicial jurisprudence, or platform updates. Continued interaction with the Platform following the publication of revised terms constitutes full legal acceptance of the updated privacy practices.