PRIVACYpolicy.

Wololoom is a brand of Datatamer LLC, a limited liability company organised under the laws of the State of Delaware, United States, with its registered office at 16192 Coastal Highway, Lewes, Delaware 19958, USA ("Datatamer", "Wololoom", "we", "us", or "our"). We operate the website wololoom.com (the "Service"), an on-demand fashion platform connecting designers, local makers, and customers worldwide. This Privacy Policy explains what personal data we collect when you use the Service, why we collect it, how we use it, and the choices you have.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Datatamer LLC is the data controller of the personal data described in this policy. We offer the Service to users in both the United States and the European Economic Area (EEA), so this policy describes rights under both EU/UK and US (including California) law. If you have any questions, please contact us at [email protected].

We only collect personal data we need to operate the Service. The categories below cover everything we collect.

• —Account data — when you create an account, we store your email address, your name, a hashed password (when applicable), and your role on the platform (e.g. designer, maker, customer).
• —Authentication data — if you sign in with Google or Facebook, the provider shares your email, name, and a stable account identifier with us. We do not receive your social-network password.
• —Application data — if you apply to a contest or open call (for example, the Founding Designers Open Call), we store the information and files you submit, including portfolio links, design files, biographical information, and any text you provide.
• —Transactional email data — when we send you account or platform emails (verification, password reset, notifications), we record the fact that an email was sent and its delivery status.
• —Technical data — when you visit the Service, our infrastructure automatically logs your IP address, user-agent, the pages you request, and timestamps. These logs are used for security and to debug errors.
• —Cookies and similar technologies — we use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We also use Google Tag Manager and Google Analytics (Google Ireland Ltd.) for optional analytics, which are loaded only after you accept them in the cookie banner. See section 12 below for details.

We use your personal data only for the purposes listed below, and only when we have a lawful basis under GDPR Article 6 to do so.

• —To create and operate your account, authenticate you, and provide the Service (performance of a contract).
• —To send you transactional emails such as verification, password resets, and notifications related to your account or applications (performance of a contract).
• —To review and evaluate contest entries and open-call applications you submit (performance of a contract).
• —To keep the Service secure, prevent fraud and abuse, and debug errors (legitimate interests).
• —To comply with legal obligations, including responding to lawful requests from public authorities (legal obligation).

We do not sell your personal data. We share it only with the service providers we need to operate the platform, and only to the extent necessary for them to perform their service.

• —Identity providers — Google (Google Ireland Ltd.) and Meta (Meta Platforms Ireland Ltd.) when you choose to sign in with their services. They receive a request from us to authenticate you; they do not receive your activity on our Service.
• —Email delivery — Resend (Resend, Inc., USA) processes the transactional emails we send to you. They receive your email address, name, and the email content.
• —Hosting infrastructure — HostHatch LLC (USA) provides the dedicated server infrastructure on which our application and database run. They host the underlying machines but do not access the application data in the ordinary course of business.
• —Network and edge security — Cloudflare, Inc. (USA) provides DNS, TLS termination, and DDoS protection for wololoom.com and processes connection metadata (IP, user-agent, request path) on our behalf.
• —Legal requests — we may disclose personal data if required by a valid legal request from a competent authority, or to establish, exercise, or defend legal claims.

Datatamer LLC is based in the United States, and our service providers (notably HostHatch, Cloudflare, and Resend) are also based in the United States. This means that if you use the Service from the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data is transferred to and processed in the United States.

Where required, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or another lawful transfer mechanism under GDPR Chapter V to protect your data when it leaves the EEA or the UK. We also apply technical and organisational safeguards (encryption in transit and at rest, strict access controls) to reduce the risks associated with such transfers.

We keep your personal data only for as long as needed for the purposes described in this policy.

• —Account data is kept while your account is active. If you delete your account, we delete or anonymise your data within 30 days, except where we are legally required to keep it longer.
• —Contest applications and submitted files are kept for the duration of the contest plus 12 months for record-keeping, and then deleted.
• —Server access logs are kept for up to 90 days for security and debugging, then automatically rotated and deleted.
• —Transactional email delivery records are kept for up to 12 months by our email provider.

If you are in the EEA, the United Kingdom, or another jurisdiction with comparable data-protection law, you have the following rights regarding your personal data:

• —Access — request a copy of the personal data we hold about you.
• —Rectification — ask us to correct inaccurate or incomplete data.
• —Erasure — ask us to delete your data, subject to legal exceptions.
• —Restriction — ask us to limit how we use your data.
• —Portability — receive your data in a structured, machine-readable format.
• —Objection — object to processing based on our legitimate interests.
• —Withdraw consent — where processing is based on consent, you can withdraw that consent at any time.
• —Lodge a complaint — with your local data-protection authority in the EEA, the UK Information Commissioner's Office (ico.org.uk), or the Swiss Federal Data Protection and Information Commissioner.

To exercise any of these rights, email us at [email protected]. We will respond within one month.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the additional rights listed below regarding personal information that Datatamer LLC holds about you.

• —Right to know — request the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties with whom we share it.
• —Right to delete — request deletion of personal information we have collected from you, subject to certain exceptions.
• —Right to correct — request that we correct inaccurate personal information we maintain about you.
• —Right to opt out of sale or sharing — we do not sell your personal information and we do not share it for cross-context behavioural advertising.
• —Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes beyond what is necessary to provide the Service.
• —Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise these rights, email us at [email protected] from the address associated with your account, or contact us with sufficient detail for us to verify your identity. We will respond within 45 days. You may also designate an authorised agent to make a request on your behalf.

We use industry-standard measures to protect your data: encrypted connections (HTTPS), encrypted storage at rest, hashed passwords, role-based access controls inside the team, and logging. No system is perfectly secure, but we work to reduce risk and to respond quickly to any incident. If a personal-data breach occurs and is likely to result in a risk to your rights, we will notify you and the competent supervisory authority as required by law.

The Service is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we will notify you by email or via a prominent notice on the Service before the changes take effect.

We use a small set of cookies and similar technologies to keep the Service working and, with your consent, to understand how it is used. You can change your choice at any time by clearing the wololoom-cookie-consent cookie in your browser; the consent banner will re-appear on your next visit.

• —Strictly necessary — session cookies set by our authentication layer (Better Auth) to keep you signed in, and anti-CSRF tokens. These are always active and cannot be turned off; without them the Service does not function.
• —Preferences — wololoom-cookie-consent records your choice from the cookie banner so we do not ask you again on every page. It lasts up to 12 months.
• —Analytics (optional) — Google Tag Manager and Google Analytics 4 (Google Ireland Ltd.) are loaded only after you accept analytics in the banner. We use Google Consent Mode v2: until you accept, no analytics or advertising cookies are written. If you decline or never choose, Google receives only anonymous, cookieless signals and we cannot identify you.
• —We do not use advertising or cross-site behavioural-tracking cookies, and we do not share analytics data with third parties for advertising.

If you have any questions about this Privacy Policy or how we handle your personal data, please email us at [email protected], or write to us at: Datatamer LLC — Wololoom, Privacy, 16192 Coastal Highway, Lewes, Delaware 19958, USA.