Privacy Policy

1 · Who is responsible

2 · What happens when you visit this site

This site is hosted by Netlify (Netlify Inc., 512 2nd Street, San Francisco, CA 94107, USA). When you open a page, your browser sends data that Netlify stores in server log files: IP address, date and time, the page requested, referrer, browser and operating system. This is necessary to deliver the site and to keep it secure.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in operating a functioning, secure website.

Transfer outside the EU: Netlify processes data in the United States. The transfer is based on Standard Contractual Clauses and the EU–US Data Privacy Framework. A data processing agreement is in place. Confirm the signed DPA with Netlify is on file

Retention: How long does Netlify keep the logs on your plan? Please confirm

3 · Fonts

The typeface used on this site, Hanken Grotesk, is hosted on our own server. Your browser does not contact Google or any other third party to load it, and no IP address leaves this site for that purpose.

We did this deliberately. Loading fonts from Google servers transmits the visitor’s IP address to Google, which a German court held to infringe the GDPR (LG München I, 20 January 2022, 3 O 17493/20). Self-hosting removes the problem instead of asking you to consent to it.

4 · Cookies, Meta Pixel and TikTok Pixel

We use the Meta Pixel and the Meta Conversions API of Meta Platforms Ireland Ltd., Merrie Square, Dublin 2, Ireland, to measure the effect of our ads on Facebook and Instagram and to show them to people who may be interested. Both run when you open this site. You can opt out at any time (see below).

What is processed: the pages you view, whether you look at the product, click “Buy now” or send the reseller form, your IP address, browser information, the cookies _fbp and _fbc (an identifier for your browser and, if you came from an ad, the ad click). If you buy, we send Meta the order value and your email address, phone number, name, city, postcode and country from the Stripe checkout — hashed (SHA-256), not in plain text. The same happens with the email address from the reseller form. Meta compares the hashes with its user accounts to attribute the conversion.

How: part of this data goes from your browser directly to Meta (Pixel), part goes from our server on Netlify to Meta (Conversions API). Both carry the same event ID, so each action is counted once.

Legal basis: Legal basis without prior consent must be determined by your lawyer (Art. 6 (1) GDPR, § 25 TDDDG). We and Meta are joint controllers for the collection and transfer (Art. 26 GDPR); Meta’s Controller Addendum applies. For further processing Meta is solely responsible: Meta Privacy Policy.

Transfer outside the EU: Meta may process data in the USA. Meta Platforms Inc. is certified under the EU–US Data Privacy Framework.

Storage: if you opt out, that choice is stored in your browser’s local storage. _fbp and _fbc last up to 90 days. To support purchase attribution, our server keeps a random checkout reference with your _fbp/_fbc, IP address and browser information for up to 7 days.

TikTok Pixel: we also use the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, for the same purpose. It runs when you open this site and records the same actions (page views, viewing the product, “Buy now”, the reseller form, email links and completed purchases with order value), together with your IP address, browser information and the cookies _ttp and, if you came from a TikTok ad, ttclid (up to 13 months). No customer email address or name is sent to TikTok. TikTok may process data outside the EU, including in China, Singapore, Malaysia and the USA. More: TikTok Privacy Policy. Joint controllership with TikTok (TikTok Business Products Data Joint Controller Addendum) and legal basis to be confirmed by your lawyer

Opt out: click “Opt out of tracking” at the bottom of every page. Neither pixel then loads in this browser, and purchases you make afterwards are not sent to Meta or TikTok. You can also object to processing under Art. 21 GDPR by writing to us.

New section — have it reviewed together with the rest of this draft.

5 · When you write to us

If you email us — for example to pre-order, or as a press or reseller enquiry — we process the data you send us in order to answer you. Legal basis: Art. 6 (1) (b) GDPR for pre-contractual communication, otherwise Art. 6 (1) (f) GDPR.

Retention: as long as needed to handle your enquiry, then in line with statutory retention periods (commercial and tax law: up to 10 years).

6 · The reseller form

The form on the reseller section is processed by Netlify Forms. The fields you fill in — name, email, business, area of interest and your message — are transmitted to Netlify and forwarded to us. Legal basis: Art. 6 (1) (b) GDPR, as you are asking about a business relationship.

The form includes a hidden anti-spam field. It is not used to profile you.

7 · Video and images

The product film and all images are served from our own domain. No YouTube, Vimeo or comparable third party is involved, so no data goes to a video platform.

8 · Your rights

• Access to the data we hold about you (Art. 15 GDPR)
• Correction of inaccurate data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of any consent you have given, at any time, with effect for the future

To exercise any of these, write to night@onethird.co.

9 · Right to complain

You may lodge a complaint with a data protection authority. The one responsible for us is: Competent state data protection authority for your registered office

10 · Changes

We will update this policy when the site or our processing changes. The date at the top shows the current version.