PRIVACY POLICY
Nærwear ApS · naerwear.com · Last updated [[DATE]]
In short. To sell you a watch we need your name, address, email and phone number, and we keep them for as long as Danish bookkeeping law requires. Everything else — analytics, advertising measurement — happens only if you say yes on the cookie banner, and you can change your mind at any time under Cookie settings in the footer. Card details never reach us; Stripe handles payment. We do not sell your data. The rest of this page says the same thing in the detail the law asks for.
1. Who is responsible
Nærwear ApS
Degnevangen 32, 2750 Ballerup, Denmark
CVR 43901885
support@naerwear.com
We are the data controller for the processing described here. Questions and requests go to that address.
2. What we process, why, and on what basis
When you buy something
Name, delivery and billing address, email, phone number, what you bought, amount paid, payment method (type only, never the card number). Why: To deliver your order, send confirmations and tracking, handle returns and complaints, and keep the accounts the law requires. Legal basis: Contract (GDPR art. 6(1)(b)); bookkeeping is a legal obligation (art. 6(1)(c), the Danish Bookkeeping Act). Kept: Five years from the end of the financial year of the purchase, as the Bookkeeping Act requires. Complaint-related correspondence for as long as a claim could be made.
The page you started checkout from and, if you arrived through an ad, the campaign parameters in the link (`utm_…`). Why: To know which of our ads led to orders. This is stored on the order, not on you as a person. Legal basis: Legitimate interest (art. 6(1)(f)): running a small shop on a small budget requires knowing which advertising works. Kept: With the order.
Your phone number is asked for because carriers require a contact number on international parcels. We do not call you and do not use it for marketing.
When you visit the site — without consent
Every page view sends one anonymous count to our own server: the page path, the country the request came from, whether the device is a phone or a desktop, and any campaign parameters in the link. No cookie is set, no identifier is created, and the IP address is not stored. We cannot connect two page views to each other, or any of them to you. We use this to count visitors honestly regardless of who accepts cookies. Legal basis: legitimate interest (art. 6(1)(f)); it is the least intrusive way to count.
When you visit the site — with your consent
Nothing in this section runs until you accept it on the cookie banner. You can withdraw at any time under Cookie settings in the footer; withdrawal stops the processing going forward.
Statistics → Google Analytics 4** (Google Ireland Ltd, Dublin) — Understand how people move through the site, where they arrive from and where they stop.
Statistics → Microsoft Clarity** (Microsoft Ireland Operations Ltd, Dublin) — See how pages are used — where people click, how far they scroll, and anonymised recordings of sessions, with text typed into fields masked.
Marketing → Meta Pixel and Conversions API** (Meta Platforms Ireland Ltd, Dublin) — Measure whether our ads on Facebook and Instagram lead to visits and purchases, and show ads to people who visited.
Marketing → TikTok Pixel and Events API** (TikTok Technology Ltd, Dublin) — The same, for ads on TikTok.
Legal basis: your consent (art. 6(1)(a), and section 3 of the Danish Cookie Order). The cookies each tool sets are listed in the cookie policy.
What ”Conversions API” and ”Events API” mean. With your marketing consent, when you complete a purchase our server tells Meta and TikTok that a purchase happened, so the ad that led to it can be measured. To let them match it to the ad click, we send your email address, phone number, name and address hashed — turned into a fingerprint they can compare against their own records but cannot read back — together with the click identifier from the ad and your browser’s advertising cookie. Without marketing consent, none of this is sent.
For the data collected through their pixels on our site, we and Meta, and we and TikTok respectively, are joint controllers for the collection and transmission; each platform is solely responsible for what it does with the data afterwards, under its own privacy policy.
When you write to us
We keep the correspondence for as long as needed to handle the matter and, for complaints, for as long as a claim could arise. Legal basis: contract or legitimate interest in answering you.
3. Who else sees your data
We use companies to run the shop. They process your data on our instructions and under data processing agreements, and may not use it for their own purposes:
Stripe Payments Europe Ltd (Dublin) — payment. Stripe is also an independent controller for its own legal obligations, such as fraud prevention; see stripe.com/privacy. Card details go directly to Stripe.
Shipmondo ApS (Odense, Denmark) — order handling and shipping labels; your name, address, phone and email go to the carrier (PostNord and others) so the parcel can be delivered.
Cloudflare, Inc. — runs the checkout server and the anonymous page counter.
Framer B.V. (Amsterdam) — hosts the website.
Google, Microsoft, Meta, TikTok — only with your consent, as in section 2.
[[OPTIONAL — DECIDE: Anthropic — we use AI tools to operate the shop and read our sales data; where those tools touch personal data, Anthropic processes it on our behalf under its data processing addendum, and we pass on only what is needed.]]
We hand data to public authorities only when the law requires it.
4. Transfers outside the EU
Stripe, Cloudflare, Google, Microsoft, Meta and TikTok are or belong to groups with operations outside the EU, including the United States. Where data leaves the EU, it does so under the EU–US Data Privacy Framework for certified companies and the European Commission’s standard contractual clauses otherwise, with additional safeguards where required. Copies of the relevant clauses are available on request.
5. Your rights
You can ask us at any time to:
see the data we hold about you (access),
correct it (rectification),
delete it, where we are not legally required to keep it (erasure) — bookkeeping records must stay for five years,
limit what we do with it (restriction),
receive the data you gave us in a machine-readable format (portability),
object to processing based on legitimate interest, including any use for marketing, and
withdraw consent — under Cookie settings for cookies, or by writing to us for anything else. Withdrawing does not affect what was done while the consent stood.
Write to support@naerwear.com. We answer within a month.
If you think we have handled your data wrongly, you can complain to the Danish Data Protection Agency:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
dt@datatilsynet.dk · datatilsynet.dk
6. Security
The site and checkout run over HTTPS. Payment data is handled by Stripe, which is certified to the highest PCI standard. Access to order data is limited to the people who need it to fulfil orders. Passwords, tokens and keys for the services we use are stored in the services’ own secret stores, never in the website.
7. Children
The shop is not directed at children under 18, and we do not knowingly collect data from them.
8. Changes
We update this page when our processing changes, and the date at the top moves with it. Substantial changes are announced on the site.