GDPR Compliance

Last Updated: November 3, 2025

Claire Wears is committed to protecting the privacy and personal data of all visitors, particularly those accessing our website from the European Union, European Economic Area, and United Kingdom. This page outlines our compliance with the General Data Protection Regulation (GDPR) and your rights under this regulation.

About GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to organizations processing personal data of individuals in the EU, EEA, and UK. Although Claire Wears is based in the United States, we respect and comply with GDPR requirements for our European visitors.

Data Controller Information

For purposes of GDPR, Claire Wears acts as the data controller for personal data collected through our website.

Contact Information:
Email: [email protected]
Website: clairewears.com

What Personal Data We Process

We collect and process the following categories of personal data:

Directly Provided Data

Newsletter Subscriptions:

  • Email address
  • Name (if provided)
  • Subscription date
  • Communication preferences

Article Comments:

  • Name or username
  • Email address
  • Comment content
  • IP address (for security and spam prevention)
  • Timestamp

Contact Submissions:

  • Name
  • Email address
  • Message content
  • Any additional information voluntarily provided

Automatically Collected Data

Technical Information:

  • IP address
  • Browser type and version
  • Device information
  • Operating system
  • Referring website
  • Pages visited
  • Time spent on pages
  • Geographic location (country/city level)
  • Access date and time

Cookie Data:

  • Cookie identifiers
  • Analytics information
  • Advertising interaction data
  • Affiliate tracking information

Legal Basis for Processing

We process personal data only when we have a valid legal basis under GDPR Article 6:

Consent (Article 6(1)(a))

We rely on your explicit consent when you:

  • Subscribe to our newsletter
  • Leave comments on articles
  • Accept non-essential cookies
  • Submit contact forms

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Legitimate Interests (Article 6(1)(f))

We process certain data based on legitimate interests that do not override your rights:

Our Legitimate Interests:

  • Understanding website usage to improve fashion content and style advice
  • Maintaining website security and preventing abuse
  • Operating technical aspects of the website
  • Generating revenue through ethical affiliate partnerships with fashion retailers
  • Providing community support and responding to fashion-related inquiries
  • Building an engaged fashion community

We have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms.

Legal Obligation (Article 6(1)(c))

We process data to comply with legal requirements, including:

  • Tax record retention obligations
  • Responding to lawful government requests
  • Complying with court orders

Your Rights Under GDPR

You have comprehensive rights regarding your personal data under GDPR. We are committed to facilitating the exercise of these rights.

Right of Access (Article 15)

You have the right to:

  • Confirm whether we process your personal data
  • Obtain a copy of your personal data
  • Receive information about how we process it

How to Request: Email [email protected] with “Data Access Request” in the subject line.

Response Time: Within one month. For complex requests, we may extend this by two additional months with notification.

Format: Data will be provided in a commonly used electronic format (PDF, CSV, or JSON).

Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete data completed.

How to Request: Email [email protected] with details of the information requiring correction.

Response Time: Within one month. We will notify you of any corrections made.

Right to Erasure (Article 17)

You have the right to request deletion of your personal data when:

  • Data is no longer necessary for its original purpose
  • You withdraw consent with no other legal basis existing
  • You object to processing with no overriding legitimate grounds
  • Data has been unlawfully processed
  • Legal obligations require deletion

Exceptions: We may retain data when necessary for:

  • Legal compliance
  • Establishment, exercise, or defense of legal claims
  • Freedom of expression and information

How to Request: Email [email protected] with “Data Deletion Request” in the subject line.

Right to Restriction of Processing (Article 18)

You have the right to restrict processing when:

  • You contest data accuracy (during verification)
  • Processing is unlawful but you prefer restriction to erasure
  • We no longer need the data but you require it for legal claims
  • You have objected to processing (pending verification of grounds)

How to Request: Email [email protected] with “Restrict Processing” in the subject line and explanation.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format when:

  • Processing is based on consent or contract
  • Processing is automated

How to Request: Email [email protected] requesting portable data format.

Format: We will provide data as CSV, JSON, or other appropriate machine-readable format.

Right to Object (Article 21)

You have the right to object to:

  • Processing based on legitimate interests
  • Direct marketing (including profiling)
  • Processing for research or statistical purposes

How to Object:

  • Marketing: Click unsubscribe in any email
  • Other processing: Email [email protected] with your objection

We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making (Article 22)

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects. Third-party advertising services may use profiling for ad targeting, which you can control through your privacy settings.

Data Protection Measures

Technical Security

  • Encryption: All data transmission uses SSL/TLS encryption (HTTPS)
  • Secure Hosting: Website hosted on secure servers with regular updates
  • Access Controls: Personal data accessible only to authorized personnel
  • Password Protection: Strong authentication for administrative access
  • Regular Updates: Software maintained with current security patches

Organizational Security

  • Data Protection Policies: Internal guidelines for data handling
  • Staff Training: Team awareness of data protection obligations
  • Data Minimization: Collection limited to necessary information
  • Privacy by Design: Privacy integrated into development processes
  • Incident Response: Procedures for breach detection and response

Third-Party Security

Our third-party processors:

  • Comply with GDPR requirements
  • Implement appropriate technical and organizational measures
  • Process data only on our documented instructions
  • Maintain data confidentiality
  • Assist with fulfilling data subject rights
  • Notify us of any data breaches

Third-Party Data Processors

We work with GDPR-compliant third-party services:

Google Analytics

Purpose: Website traffic analysis and understanding visitor behavior related to fashion content.

Data Processing: Anonymized IP addresses, page visits, session data, device information.

GDPR Compliance: Google provides Data Processing Amendment and complies with GDPR requirements.

Your Control: Install Google Analytics Opt-out Add-on.

Google AdSense

Purpose: Display advertising to support website operations.

Data Processing: Cookie data, browsing behavior, ad interactions.

GDPR Compliance: Google complies with GDPR and provides user consent mechanisms.

Your Control: Manage preferences at Google Ad Settings.

Affiliate Networks

Networks: Awin, FlexOffers, Commission Junction, ShareASale, Webgains

Purpose: Track referrals for commission on fashion products and retailers we recommend.

Data Processing: Cookie-based tracking; no personally identifiable information shared through our site.

GDPR Compliance: Networks comply with GDPR requirements.

Your Control: Block third-party cookies in browser settings.

Email Service Provider

Purpose: Newsletter management and distribution of fashion content updates.

Data Processing: Email addresses, names, subscription data, engagement metrics.

GDPR Compliance: Provider maintains GDPR-compliant practices.

Your Control: Unsubscribe link in every email.

Web Hosting

Purpose: Website hosting and availability.

Data Processing: Server logs including IP addresses and access times.

GDPR Compliance: Hosting provider complies with data protection standards.

Data Retention

We retain personal data only as long as necessary:

Data Type Retention Period Purpose
Newsletter subscriptions Until unsubscription Deliver fashion content
Comments Indefinitely unless deleted Community discussion; article content
Contact submissions 12-24 months Response and record-keeping
Analytics data 26 months Usage analysis
Cookie data 12-24 months typically Varies by cookie type
Financial records 7 years US tax law compliance
Server logs 90 days Security and troubleshooting

After retention periods expire, data is:

  • Permanently deleted from active systems
  • Anonymized to prevent identification
  • Securely archived if legally required

International Data Transfers

As a US-based website, we transfer data from the EU/EEA/UK to the United States. We ensure GDPR compliance through:

Adequacy Mechanisms

We rely on:

  • EU-US Data Privacy Framework (for certified organizations)
  • Standard Contractual Clauses approved by EU authorities
  • Appropriate safeguards for data protection

Service Provider Compliance

Our third-party processors:

  • Implement appropriate safeguards for international transfers
  • Comply with GDPR requirements for data processing
  • Provide Data Processing Agreements aligned with GDPR

Specific Transfer Safeguards

Google Services: Google complies with GDPR and provides appropriate transfer mechanisms.

Affiliate Networks: Process minimal personal data with appropriate safeguards in place.

Email Services: Use GDPR-compliant providers with appropriate data protection measures.

Cookies and Consent

Cookie Categories

Strictly Necessary

  • Essential for website functionality
  • Cannot be disabled
  • Legal basis: Legitimate interests

Performance/Analytics

  • Track website usage and performance
  • Require consent
  • Can be opted out

Functionality

  • Remember preferences and settings
  • Require consent
  • Can be disabled

Targeting/Advertising

  • Display relevant advertisements
  • Require consent
  • Can be managed via ad settings

Managing Cookies

Options for cookie control:

  • Browser settings and preferences
  • Our cookie consent mechanism
  • Third-party opt-out tools (Google Analytics, ad preferences)
  • Privacy-focused browser extensions

Data Breach Procedures

In the event of a personal data breach:

Assessment

  • Immediate assessment of breach scope and impact
  • Determination of risk to rights and freedoms
  • Documentation of facts and effects

Notification to Supervisory Authority

  • Notification within 72 hours if risk exists
  • Details of breach nature and likely consequences
  • Measures taken or proposed

Notification to Data Subjects

  • Direct notification if high risk exists
  • Clear information about breach nature
  • Advice on protective measures
  • Contact information for further questions

Remediation

  • Immediate measures to contain breach
  • Investigation of root cause
  • Implementation of preventive measures
  • Review and update of security procedures

Children’s Privacy

We do not knowingly collect data from children under 13 (or 16 in certain EU countries).

If you are a parent/guardian who believes your child has provided personal data:

  • Contact us immediately at [email protected]
  • We will verify and promptly delete such information
  • We will take steps to prevent future unauthorized collection

Supervisory Authority and Complaints

If you believe we have not complied with GDPR:

Your Right: Lodge a complaint with a supervisory authority in your country.

EU/EEA Data Protection Authorities: https://edpb.europa.eu/about-edpb/board/members_en

UK Information Commissioner’s Office (ICO):
Website: https://ico.org.uk/
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We Encourage Direct Contact: Please contact us first at [email protected] so we can address your concerns promptly.

Exercising Your Rights

To exercise any GDPR rights:

Email: [email protected]
Subject Line: Include “GDPR Request” for priority handling
Required Information:

  • Full name
  • Email address
  • Specific request details
  • Information to help locate your data

Identity Verification: We may request additional verification to protect your data from unauthorized access.

Response Time: Within one month, with possible two-month extension for complex requests.

No Fee: Rights are exercised free of charge unless requests are manifestly unfounded or excessive.

Updates to This Statement

We review and update this GDPR Compliance page regularly.

Change Notification:

  • Updated “Last Updated” date
  • Prominent website announcements for material changes
  • Email notification to subscribers for significant changes
  • Continued use implies acceptance of updates

Record Keeping

In accordance with GDPR Article 30, we maintain internal records of:

  • Processing activities and purposes
  • Data categories and retention periods
  • Data subject categories
  • Recipients of personal data
  • International transfers and safeguards
  • Security measures implemented

These records are available to supervisory authorities upon request.

Contact Information

For GDPR-related questions, requests, or concerns:

Email: [email protected]
Subject: Include “GDPR” for prompt handling
Response Time: Within 5 business days for initial response; full response within one month

We are committed to addressing your privacy concerns promptly and professionally.

Summary

Claire Wears is committed to:

  • Full GDPR compliance for EU/EEA/UK visitors
  • Transparent data processing practices
  • Protecting your privacy rights
  • Maintaining appropriate security measures
  • Facilitating exercise of data subject rights
  • Accountability and demonstrable compliance

For questions or to exercise your rights, contact [email protected]. We respect your privacy and handle personal data responsibly in accordance with GDPR requirements.