How we handle data

Privacy Policy

Last updated: August 2026 · Draft for legal review

1 · Who is responsible

ControllerCompany name
Street and number
Postcode and city
Emailnight@onethird.co
Data protection officerNot appointed. We are below the threshold of Art. 37 GDPR / § 38 BDSG, which requires an officer only where at least 20 people are regularly engaged in processing personal data.

2 · What happens when you visit this site

This site is hosted by Netlify (Netlify Inc., 512 2nd Street, San Francisco, CA 94107, USA). When you open a page, your browser sends data that Netlify stores in server log files: IP address, date and time, the page requested, referrer, browser and operating system. This is necessary to deliver the site and to keep it secure.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in operating a functioning, secure website.

Transfer outside the EU: Netlify processes data in the United States. The transfer is based on Standard Contractual Clauses and the EU–US Data Privacy Framework. A data processing agreement is in place. Confirm the signed DPA with Netlify is on file

Retention: How long does Netlify keep the logs on your plan? Please confirm

3 · Fonts

The typeface used on this site, Hanken Grotesk, is hosted on our own server. Your browser does not contact Google or any other third party to load it, and no IP address leaves this site for that purpose.

We did this deliberately. Loading fonts from Google servers transmits the visitor’s IP address to Google, which a German court held to infringe the GDPR (LG München I, 20 January 2022, 3 O 17493/20). Self-hosting removes the problem instead of asking you to consent to it.

4 · Cookies and analytics

This site sets no cookies and uses no analytics, tracking or advertising tools. There is nothing to consent to, which is why you see no cookie banner.

If a shop, newsletter or analytics is added later, this section must be rewritten before launch

5 · When you write to us

If you email us — for example to pre-order, or as a press or reseller enquiry — we process the data you send us in order to answer you. Legal basis: Art. 6 (1) (b) GDPR for pre-contractual communication, otherwise Art. 6 (1) (f) GDPR.

Retention: as long as needed to handle your enquiry, then in line with statutory retention periods (commercial and tax law: up to 10 years).

6 · The reseller form

The form on the reseller section is processed by Netlify Forms. The fields you fill in — name, email, business, area of interest and your message — are transmitted to Netlify and forwarded to us. Legal basis: Art. 6 (1) (b) GDPR, as you are asking about a business relationship.

The form includes a hidden anti-spam field. It is not used to profile you.

7 · Video and images

The product film and all images are served from our own domain. No YouTube, Vimeo or comparable third party is involved, so no data goes to a video platform.

8 · Your rights

To exercise any of these, write to night@onethird.co.

9 · Right to complain

You may lodge a complaint with a data protection authority. The one responsible for us is: Competent state data protection authority for your registered office

10 · Changes

We will update this policy when the site or our processing changes. The date at the top shows the current version.

Draft, not legal advice. This text was written as a working draft for a lawyer to review. Every red field marks information only the company can supply. Nothing on this page should go live before that review.