Who we are
NDANGERED is a clothing brand based in the UK. We decide why and how the personal data described here is used, which makes us its controller under UK data protection law.
Our legal name and geographic address, and any company or VAT number, are on our contact page. For anything about your personal data, email privacy@ndangered.com.
What we collect and why
If you join the mailing list
Our signup forms ask only for your email address. Your browser sends it directly to Kit (kit.com), the service that runs our list, along with your IP address. You're added at once. We don't send a confirmation email.
Each form also has a hidden field that catches spam bots. You never see it, and it records nothing about you.
We use your address only to email you about NDANGERED drops and pre-orders. Every signup form says so, with a link to this policy. Our lawful basis is your consent, which you give by joining. Every email has an unsubscribe link, and using it takes you off the list straight away. You can also email privacy@ndangered.com and we'll remove you.
Unsubscribing doesn't stop emails about an order you've placed. You'll still get Stripe's receipt and any message from us about your order.
If you place an order
Checkout is a payment page run by Stripe on buy.stripe.com, where you pay by card, Apple Pay or Google Pay. Stripe passes us the details you enter there, including your name, email address and delivery address, with what you bought and what you paid. We never see or store your full card number. Stripe emails you the receipt.
We use these details to send you your order. We also use them to email you about it, for example if we can't ship within the estimated dispatch window, and to deal with a cancellation, return, size swap or refund. The lawful basis is our contract with you. We can't take an order without these details.
After an order is complete, we keep its records because UK tax and accounting law requires us to. We may also use them to prevent fraud or to deal with a legal claim, which is in our legitimate interests.
Stripe also uses payment data for its own purposes, such as fraud checks and its own legal duties. Stripe is responsible for that use, under the Stripe privacy policy. If you pay with Apple Pay or Google Pay, Apple or Google also handles the payment under its own privacy policy.
If you email us
We get your email address, your name if you include it, and whatever you write or attach. We use it to reply and to deal with what you've asked. If you're writing about an order, the lawful basis is our contract with you. Otherwise it's our legitimate interest in answering the messages people send us. Our email, including what you send us, is hosted on Google Workspace.
When you visit the site
Cloudflare hosts the site. To deliver pages to you and protect the site from attacks, it processes technical data about each visit, such as your IP address and the pages you ask for. The lawful basis is our legitimate interest in running a website that works and is secure.
To show you prices for your region, your browser asks Cloudflare which country your connection is coming from, with a request to ndangered.com/cdn-cgi/trace. Cloudflare's reply includes your IP address and country, and it goes only to your browser. We don't log or store it. If that doesn't work, the site reads your device's time zone instead. The top bar then asks you to confirm the region or pick another. Nothing is saved unless you do. The lawful basis is our legitimate interest in showing you the right prices and checkout for where you are.
The site has no analytics, advertising, tracking or social media pixels.
When you use the map
Opening the map makes your browser load content directly from the services below. Each one receives your IP address and the standard details your browser sends with any request, like its type and version.
- iNaturalist, for species photos (api.inaturalist.org and its image servers)
- Esri, for satellite imagery (arcgisonline.com)
- jsDelivr and unpkg, which host the open-source code that draws the map
- MapLibre's demo tile server, for the lettering on the map
We don't receive this data, and these services handle it under their own privacy policies. We rely on our legitimate interests here, because the map can't work without them. No other page on the site loads anything from these services.
The sighting points on the map are historical public records from GBIF, not live locations. We keep a copy on our own site, so viewing them sends nothing to GBIF.
Who we share it with
- Kit (ConvertKit LLC, United States), which runs the mailing list
- Stripe, which runs checkout and takes payments
- Cloudflare, Inc., which hosts the site
- Google, which hosts our email through Google Workspace
- the map's services listed above, which your browser contacts directly when you open the map
- delivery carriers, who get your name and delivery address so they can deliver your parcel. Which carriers we use: Coming soon
Kit, Cloudflare and Google handle personal data for us under their data processing terms. Stripe processes payments for us and is responsible for its own use of payment data, as explained above. Carriers use your details under their own privacy policies.
We may also have to disclose personal data when the law requires it, for example to HMRC or under a court order. We don't sell personal data.
Transfers outside the UK
Kit, Stripe, Cloudflare and Google may process your data in the United States or other countries outside the UK. Each transfer relies on one of two safeguards that UK law recognises. The first is UK regulations that approve transfers to a particular country. For the United States, these cover companies certified under the UK Extension to the EU-US Data Privacy Framework. The second is contract terms approved for UK transfers (the UK International Data Transfer Agreement or Addendum), which these providers include in their data processing terms. Email us for details of the safeguard a particular provider uses.
Some of the map's services are also outside the UK. Your browser contacts them directly, and their own policies apply.
How long we keep it
- Mailing list
- Until you unsubscribe. After that we keep your address only as a record that it has unsubscribed, so we don't email it again. Ask us and we'll delete that too.
- Orders
- Six years from the end of the financial year in which you ordered. That covers the period UK tax rules require us to keep records for, and the six-year time limit for most contract claims.
- Emails you send us
- As long as we need them to deal with your message. Emails about an order are kept with that order's records.
- Technical data
- Cloudflare keeps it under its own retention rules, set out in the Cloudflare privacy policy.
- Browser storage
- On your device until you clear it.
Cookies and browser storage
The site sets no cookies of its own. It keeps four small settings in your browser. One remembers the region you confirmed or picked, so prices show in your currency. Two remember that you've joined the list and that you've seen the map's hint, so the site doesn't keep asking. The last keeps the top bar closed for the rest of your visit once you've closed it. They stay on your device and aren't sent to us. Our cookies page names each one and explains how to clear them.
Stripe's checkout page is covered by Stripe's own cookie policy.
Your rights
You have the right to:
- get a copy of the personal data we hold about you
- have inaccurate data corrected
- have your data deleted
- ask us to limit how we use it
- receive the data you gave us in a format you can reuse, or have it sent to another organisation
- withdraw your consent at any time, where we rely on it. This doesn't affect what we did with your data before you withdrew it.
You can object at any time to our use of your data for marketing, and we'll stop. You can also object where we rely on legitimate interests. We'll then stop, unless we have compelling grounds to continue that outweigh your interests, or we need the data for a legal claim.
Some of these rights have limits. For example, we can't delete order records that tax law says we must keep. We don't make any decision about you based only on automated processing.
To use any of your rights, email privacy@ndangered.com. We may ask you to confirm who you are first. We'll reply within one month. If we need to check your identity, the month starts once we have what we need. A complex request, or several at once, can take up to two months longer, and we'll tell you if it will. It's free, unless a request is clearly unfounded or excessive. If it is, we can charge a reasonable fee or refuse it.
Complaints
If you're unhappy with how we've handled your personal data, email us. We'll acknowledge your complaint within 30 days and tell you the outcome as soon as we can.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Children
The site and the mailing list aren't aimed at children. We don't knowingly collect personal data from anyone under 13. If you think a child under 13 has given us their details, email us and we'll delete them.
Other websites
The Donate buttons on the map go to independent conservation organisations' own donation pages. We don't take, handle or pass on donations, and we aren't affiliated with those organisations. Their own privacy policies apply when you donate. The same goes for other sites we link to, including GBIF and Wikimedia Commons.
Changes to this policy
When we change this policy, we'll publish the new version here and update the date at the top. Before we use personal data we already hold for a new purpose, we'll tell the people it affects.