Version 2026-10-05
Controller. Unworn i.o., pending registration, Chamber of Commerce pending registration, which operates the platform under the name Unworn. Unworn i.o. is a company in formation. Its founders act as its representatives and the company ratifies this policy on incorporation.
Privacy contact. [email protected]
Language. This policy exists in Dutch, English, German, French, Spanish and Italian. All versions say the same thing.
1. Who we are
1.1 Unworn is a platform for businesses in fashion. A brand uses it to analyse its own stock data and to decide what to do with stock that does not sell. Screened professional buyers bid on offers a brand places. We provide the software, the analysis and the market. We never own or hold goods and never hold money: the sale is concluded between seller and buyer, and payment goes to a licensed payment institution or directly to the seller.
1.2 This policy explains which personal data we process as controller, why, who receives it, how long we keep it and what your rights are. It covers the portals, the marketing site, the waiting list and our support mail. It does not cover the data a brand connects for its own analysis, which we process as the brand's processor (section 3), nor what the payment institution does for its own account under its own privacy policy.
1.3 The platform is for businesses only. The people whose data we process work for those businesses or visit our site.
2. Whose data and which data
2.1 Users
When you register, or the owner of your organisation invites you, we process your first and last name, work mail address, phone number, password (stored as a hash, never in clear text), locale, the version of the terms and of this policy you accepted and when, and the IP address and time of each log in. Your phone number exists so that the other party or we can reach you in a dispute.
2.2 Organisation contacts
For every organisation we hold its legal name, address, country, Chamber of Commerce number, VAT number and the names and contact details of the people who represent it. For a seller also the IBAN on its invoicing mandate. For a sole trader these details are personal data too.
2.3 Buyer screening
A buyer applies before it is admitted. We process the company details, the VAT number and the answer from the European VIES register, the result of a check of the company and its beneficial owners against the EU, UN, UK and US sanctions lists, the evidence of the channels the buyer sells through, and the brief the buyer wrote in its own words. A person on our team reads the application and sets the outcome. That outcome, an internal classification that decides which offers a buyer may see, and the reason recorded are kept with the application. The classification is never disclosed (section 8.5).
2.4 Transactions and settlement
When a seller accepts a bid we process what settlement and delivery need: the purchase order, the sales invoice we draw up on the seller's behalf, our fee invoices, the payment status the payment institution reports to us, the release instruction, packing list, loading photos, receiving report, the destination report where the offer requires it, and every message and attachment in a dispute thread. After acceptance seller and buyer receive each other's contact details (section 5). We never receive card or bank details of a buyer: a buyer pays the payment institution, or the seller directly, never us.
2.5 Decision records and logs
For every recommendation the engine makes to a brand we write a decision record and a narrative in sentences. They name the organisation, the stock, the outcome and who confirmed it, never a buyer. The audit log records every state change on the platform and every manual decision an internal user takes, with the reason that person typed, including every time someone on our team views a reserve. Both are append only: no row can be altered once written. For a call to a language model we keep a hash of the input and the proposal returned, never the input itself. Error monitoring receives your user id and organisation id as opaque identifiers, never your name or mail address (section 5.1).
2.6 Waiting list and site visitors
If you join the waiting list we keep the mail address you gave and the details you added to it. If you visit the marketing site we process your IP address, browser type and the pages you request, to deliver the pages and keep the site secure. Cookies are covered in section 9.
2.7 Support
If you write to [email protected] we keep your message, your address and our reply.
3. Data we process for a brand as processor
A brand connects or uploads its own data for the analysis it runs on that data: orders, stock, prices and product data from Shopify, an ERP, a warehouse system or a CSV or XLSX file. Customers in that data reach us only as pseudonymous identifiers, never as names or addresses. For this data the brand is the controller and we are its processor. The data processing agreement (document 04) governs it: what we may do with it, which sub processors touch it, how a brand's customer exercises rights through the brand, and what happens when the connection ends. A customer of a brand asks the brand; we help the brand answer.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Running your account and the platform, mail about the platform | Users, organisation contacts | Performance of the contract with your organisation |
| Screening buyers, sanctions and VAT checks | Buyer screening | Legal obligation (sanctions and VAT rules) and our legitimate interest in a market that admits only screened buyers |
| Settlement, delivery, receiving reports, disputes | Transactions and settlement | Performance of the contract; the payment institution is an independent controller for the payment and its own customer checks |
| Decision records, audit log, invoices | Decision records and logs, transactions | Legal obligation (the EU documentation duty for unsold textiles, fiscal retention) and our legitimate interest in evidence for disputes |
| Proposals by a language model | Section 5.2 | Performance of the contract; a person confirms every proposal |
| Error monitoring | Opaque identifiers, technical error data | Legitimate interest in a platform that works |
| Marketing mail to prospects and the waiting list | Waiting list, prospects | Consent, or for existing customers the opt out rule for similar services, always with an unsubscribe link |
| Analytics and advertising on the marketing site and the portals | Cookies, section 9 | Consent through the cookie banner |
| Delivering and securing the marketing site | Site visitors | Legitimate interest in a site that works and is secure |
| Answering support requests | Support | Performance of the contract, or our legitimate interest in answering you |
| Answering an authority | What the authority may lawfully request | Legal obligation |
Where we rely on a legitimate interest you can object (section 8.4). Where we rely on consent you can withdraw it at any time.
5. Recipients and sub processors
5.1 The list
This list is complete. We add nobody without updating it; for processor data the data processing agreement gives the brand notice and a right to object.
| Legal name | Country | Role | What it receives | Transfer basis |
|---|---|---|---|---|
| Online Payment Platform B.V. | Delft, Netherlands | Payment institution licensed by De Nederlandsche Bank; independent controller | The buyer's payment, the order reference and amount, what it needs to verify seller and buyer; it reports the payment status to us | EU |
| Hetzner Online GmbH | Germany, and Finland where used | Hosting; processor | Everything the platform stores | EU |
| Anthropic PBC | United States, inference pinned to the EU region | Language model calls; processor | Exactly what section 5.2 describes; no training on our data | Standard contractual clauses and the EU US Data Privacy Framework |
| Mailgun Technologies Inc., part of Sinch | United States, EU endpoint | Transactional mail; processor | Recipient address, subject and content of the mails the platform sends | EU endpoint; standard contractual clauses for any access from outside the EU |
| Functional Software Inc., trading as Sentry | United States, EU ingest | Error monitoring; processor | Technical error data with user id and organisation id as opaque identifiers; no name, mail address, request body or cookie; kept 90 days | EU ingest; standard contractual clauses for any access from outside the EU |
| Shopify International Ltd | Ireland | Source of a connection a brand authorises; independent controller of the store | We read what the brand authorises. Shopify sends us three compliance webhooks: a request for the data we hold about a shopper, a request to erase a shopper, a notice that a store removed the app (section 8.3) | EU |
| The seller's warehouse: Monta B.V. or another the seller names | Where the warehouse is | The seller's contractor | The release instruction and the buyer's collection details: carrier, collection window, a contact | The seller's own arrangement |
| The buyer's carrier | Named by the buyer | The buyer's contractor | The collection address, a contact at the warehouse, the packing list | The buyer's own arrangement |
| The counterparty of a transaction | Anywhere buyers are admitted | Independent controller | After acceptance: legal name, address, VAT number, the contact person's name, mail address and phone number, and for the seller the IBAN on the sales invoice | Inside the EU none; outside the EU section 6 |
| Google Ireland Limited | Ireland | Google Tag Manager and Google Analytics: processor. Google Ads: independent controller for measuring and attributing advertising | What section 9.2 lists, with your consent | EU; for access from the United States the EU US Data Privacy Framework and standard contractual clauses |
| Microsoft Ireland Operations Limited | Ireland | Microsoft Clarity, session recordings and heatmaps: independent controller | What section 9.2 lists, with your consent; the content of the portals is masked | EU; for access from the United States the EU US Data Privacy Framework and standard contractual clauses |
| Meta Platforms Ireland Limited | Ireland | Meta Pixel: joint controller with us for collecting and passing on the data, independent controller after that | What section 9.2 lists, with your consent | EU; for access from the United States the EU US Data Privacy Framework and standard contractual clauses |
| Authorities | Netherlands or EU | Independent controller | What the law obliges | Legal obligation |
| The brand's accountant or auditor | Chosen by the brand | The brand's adviser | The export of the brand's records, on its instruction | The brand's instruction |
5.2 What reaches the language model
A language model proposes; a person confirms. It never produces a number that enters a recommendation and never advises a buyer. It receives only:
- For mapping the columns of a file a brand uploads: the column headers, the type we inferred per column and at most ten sample values per column. Revenue and customer columns are never in the sample. The brand's name is stripped before the call.
- For extracting a buyer profile: the brief the buyer wrote in its own words, nothing else.
- For an offer draft and for a decision narrative: the aggregated fields of one record for one brand, never individual sales rows.
No brand's data is ever in the same call as another brand's. We store a hash of the input and the proposal that came back, never the input itself.
6. International transfers
6.1 Everything we process stays in the EU, with two exceptions.
6.2 Calls to the language model go to Anthropic PBC in the United States, with inference pinned to the EU region, under the European Commission's standard contractual clauses and Anthropic's certification under the EU US Data Privacy Framework.
6.3 Buyers are admitted from outside the EU. When a seller accepts a bid from such a buyer, the seller's contact details reach that buyer and the buyer's reach the seller, because delivery cannot happen otherwise. The transfer is necessary for the performance of the contract between seller and buyer and rests on article 49(1)(b) and (c) GDPR. It is limited to what section 5.1 lists for the counterparty. A seller decides per offer which countries may bid.
6.4 Mailgun and Sentry process on their EU endpoints; their standard contractual clauses cover any access from the United States.
7. Retention
We keep personal data no longer than the purpose needs and as long as the law requires.
| Data | Kept for | Why |
|---|---|---|
| User account: name, mail address, phone number, password hash, locale, login events, accepted versions | The life of the account plus 12 months | Questions about a closed account; proof of acceptance |
| Organisation contacts | The life of the organisation plus 12 months, except where they appear on an invoice or purchase order | Same |
| Buyer screening: application, VIES answer, sanctions check, channel evidence, brief, outcome, reason, internal classification | The life of the organisation plus 5 years | Evidence of the screening |
| Transaction documents: purchase orders, invoices, credit notes, release instructions, packing lists, receiving reports, dispute threads, destination reports | 7 years from the invoice date | Dutch fiscal retention, AWR article 52 |
| Decision records, narratives, audit log, log of manual decisions, hashes of language model calls | 5 years from creation, configurable per country; never deleted inside the period, not even when the organisation cancels | The EU documentation duty for unsold textiles; evidence |
| Raw payloads from a connected system (processor data, section 3) | 180 days | Reprocessing an import |
| Error monitoring at Sentry | 90 days | Debugging |
| Waiting list | Until launch plus 6 months, or until you unsubscribe | Telling you the platform is live |
| Support correspondence | The life of the account plus 12 months; without an account, 12 months after the last message | Seeing later what was agreed |
| Web server logs of the marketing site | Only as long as needed to keep the site secure | Security |
| Analytics and advertising cookies | Per the cookie table in section 9 | With your consent |
When a period ends the data is deleted or stripped of everything that identifies a person, whichever the record allows without weakening its value as evidence.
8. Your rights
8.1 What you can ask
You can ask for access, a copy in a common format, correction, erasure, restriction, and you can object to processing that rests on our legitimate interest. Write to [email protected]; we may ask you to confirm from the mail address on your account. We answer within one month, as the GDPR requires; a complex request may take longer, and we tell you if it does.
8.2 What erasure reaches
Erasure reaches your user account: name, mail address, phone number, locale, login events and the link between you and the actions you took. We delete that data at the end of the period in section 7, or earlier on request where nothing in section 8.3 stands in the way.
8.3 What erasure cannot reach, and why
Some records are kept for the retention period whatever happens to the account, because the law requires them or because they are the evidence of a trade between two other parties:
- decision records, narratives and the audit log, for 5 years from creation;
- purchase orders, invoices, credit notes, receiving reports and dispute threads, for 7 years;
- buyer screening data, for the life of the organisation plus 5 years.
The audit log is append only by design: nobody can change or remove a row, and that is what makes it evidence. Where a record keeps its meaning without your name, we strip the name. Where it needs the name, for example who accepted a bid or filed a dispute, the name stays for the period and goes with the record.
A shopper of a brand that connected Shopify asks that brand. Shopify forwards the request and we null the pseudonymous identifier in the order lines and the stored payloads; nothing else about that shopper exists here.
8.4 Objection and withdrawal
Where we process on a legitimate interest you can object and we stop, unless a compelling ground outweighs your interest, for example a dispute already opened. Where we process on consent, for cookies or marketing mail, you withdraw it through the cookie banner or the unsubscribe link and we stop.
8.5 A question about an internal classification
If you ask whether we hold a classification of your organisation, we tell you that an internal classification exists, that a person sets it, and that its purpose is to decide which offers your organisation may see and under which conditions. We do not disclose its value: it is confidential to the platform, and disclosing it would let a party infer what other parties see.
8.6 Complaints
If you are not satisfied with how we handle your data or your request, you can complain to the Autoriteit Persoonsgegevens (section 13).
9. Cookies
9.1 Functional cookies, no consent needed
The platform and the marketing site set cookies that are needed to work. They contain no tracking and are set without consent, as the Telecommunicatiewet allows for cookies needed for a service you asked for.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session | Keeps you logged in | The browser session |
| Form token | Protects forms against forgery | The browser session |
| Locale | Remembers your language | The browser session; held in the session cookie |
| Cookie choice | Remembers what you chose in the banner, and under which version of this policy | 12 months |
9.2 Analytics and advertising cookies, only with consent
The marketing site and the portals use analytics and advertising cookies, loaded through Google Tag Manager. They are set only after you opt in through the cookie banner, and you withdraw that choice at any time through "Cookie settings" at the foot of the marketing site and in the account menu of the portals; withdrawing deletes the cookies below. Before you choose, none is set. When this policy changes, we ask again. No provider is added without a row here.
With your consent the providers receive: the page you open: on the public pages its address without search terms or other parameters apart from campaign codes such as utm_source, inside the portals only the kind of page, never its address or title; the screen and route; your language and market; when you are signed in, your user number and organisation number as meaningless codes, your organisation type and your role; and that an action happened, such as a registration, a connected source, an offer placed or a bid, with at most a count. They never receive your name, mail address, phone number, company name, prices, bids, stock or products, hashed or otherwise. A page whose address carries a secret, such as a password reset link, sends nothing. Session recordings mask the content of the portals; Microsoft Clarity does see the address of the page as your browser shows it, and on such addresses Meta and the Google Ads tags send nothing.
| Provider | Purpose | Cookies | Lifetime |
|---|---|---|---|
| Google Ireland Limited, Google Analytics | Measuring how the marketing site and the portals are used | _ga, _ga_<id> |
2 years |
| Google Ireland Limited, Google Ads | Measuring and attributing advertising | _gcl_au |
90 days |
| Microsoft Ireland Operations Limited, Microsoft Clarity | Session recordings and heatmaps, to see where the site gets in your way | _clck; _clsk; on clarity.ms CLID and MUID |
1 year; 1 day; 1 year |
| Meta Platforms Ireland Limited, Meta Pixel | Measuring and attributing advertising on Facebook and Instagram | _fbp, _fbc; on facebook.com fr |
90 days |
Google Tag Manager itself sets no cookie.
10. Automated decisions
10.1 We take no decision about you by automated means alone that has a legal effect on you or affects you in a similar way.
10.2 A person on our team reads every buyer application and sets its outcome and the internal classification. A brand confirms, changes or discards every recommendation the engine makes: the engine calculates and explains, the brand decides. A language model proposes column mappings, buyer profiles, offer drafts and narratives; a person confirms every proposal before it is used. The model never decides and never advises a buyer on a bid.
10.3 The platform applies rules automatically once a person has set them: which offers an organisation sees follows from the seller's conditions and the classification a person assigned, and a bid outside a seller's limits is refused. That executes a decision a person took.
11. Security
11.1 Every connection to the platform is encrypted. Passwords are stored as hashes. Credentials for a connected system are stored encrypted and never written to a log.
11.2 A user sees only its own organisation. Our internal console is reachable only by our own team with a separate login, and every manual decision there is logged with a reason.
11.3 The audit log, the decision records and the narratives cannot be altered or deleted by the application, not even by an administrator; the database refuses it. Logs and error reports never contain raw data rows, sample values, tokens, passwords, reserves or the contents of a request. Hosting is in the EU with backups.
11.4 If a breach of security leads to a risk for you, we inform the Autoriteit Persoonsgegevens within 72 hours of discovering it, as the GDPR requires, and we inform you without undue delay where the risk to you is high. A brand whose processor data is affected is informed under the data processing agreement.
12. Changes
12.1 We change this policy when the platform, a sub processor or the law changes. The version date at the top says which version you are reading. A change that affects you in substance is announced by mail to users before it takes effect. Earlier versions are available on request.
13. Contact and complaints
13.1 Questions, requests and complaints about personal data go to [email protected], or by post to Unworn i.o., pending registration. We are not obliged to appoint a data protection officer and have not; the privacy contact handles every request.
13.2 You have the right to lodge a complaint with the supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl. If you are in another EU country you may also complain to the authority there.
A question about this document?
Describe which data or account your request concerns. Do not send passwords or a copy of your identity document with your first message.
[email protected]