Zavari Website Privacy Notice

Version: 13 October 2026

1. Who is responsible

Derick Bank, operating under the name Zavari, is the controller for the personal data covered by this notice. Contact privacy@zavari.com for privacy questions and requests. Our correspondence address is MyOffice Den Bosch, Bruistensingel 400, 5232 AG 's-Hertogenbosch, the Netherlands. General enquiries: info@zavari.com.

2. Scope

This notice covers Zavari's public website, early-access waitlist, optional website style questions, product updates, retailer enquiries, feedback submitted through this website and website analytics. Applications are covered by the separate Recruitment Privacy Notice. The styling app, signed-in partner portal and any later purchase or payment functions are outside this notice; we provide separate information before collecting data for those functions.

3. Data and purposes

Waitlist and testing invitations

We collect your email, chosen language, registration and confirmation time and request status. You may add your first name after registering. Temporary secure links let you confirm and manage your registration.

We use this information to handle the registration you requested, send necessary messages about it and potentially invite you to test. Our basis is our legitimate interest in administering this requested waitlist and a limited test group. This is not permission for general advertising. You can leave or object at any time. Registration does not guarantee selection or access. People make the selection decisions.

Optional style profile

You may answer optional questions about clothing categories, styles, occasions, budget, country or city, clothing and shoe sizes and preferred brands. You may skip this step. We retain those answers to plan the test assortment only with your separate consent. They do not determine selection.

Before transferring or using this profile in the styling app, we explain that processing and obtain a new choice where necessary. Consent for website questions is not general permission for future AI, photo, voice or sizing features.

Optional messages

Product and launch emails require separate consent. Direct WhatsApp product and beta updates have their own initially unchecked choice. We retain a WhatsApp number for these updates only if you select it. That choice does not add you to a group. Before inviting you to a group where others can see your number, we explain this and obtain a separate choice.

You can stop updates easily and free of charge using the message's opt-out, your management link or privacy@zavari.com. For WhatsApp you can also reply STOP. Stopping updates keeps your waitlist registration unless you also leave it. Necessary messages about an active request do not contain general marketing.

Retailer enquiries and other contact

We use your name, retailer name, work email and any website or message you voluntarily provide, plus submission language and time. Our basis is our legitimate interest in responding to business enquiries and discussing cooperation. If you personally would be the contracting party, necessary steps requested by you may also use Article 6(1)(b) GDPR. For employees contacting us for a company, legitimate interests remains the basis.

An enquiry does not reserve a first-100 place or conclude a contract. We do not automatically add contacts to marketing lists. If you contact us through WhatsApp or social media, that provider also processes data under its own policy. An ordinary outbound link opens that service only when clicked.

Feedback submitted through this website

We use feedback about the Zavari website, consumer app, retailer website and retailer connection to investigate problems and improve these experiences. You may include an email for a reply and relevant shop or catalogue references. Email is optional and is not used to enroll you in marketing. Hide passwords, access codes and customer details in optional screenshots. Authorized reviewers can read accepted reports and download private screenshots. Accepted reports and screenshots are retained for up to one calendar year after acceptance. Unfinished preparations are removed after 24 hours, subject to live upload authorizations; unowned late uploads are removed after 24 hours. This browser stores your unfinished draft and screenshots for six calendar months after your last content edit, subject to browser eviction. Expired local records are removed when feedback storage next opens; reset and acceptance also attempt to clear the draft. Offline deadline erasure cannot be guaranteed. Contact Zavari through the website privacy contact for access or deletion requests.

Website analytics

Optional analytics are off until you separately consent. With consent, we may use limited events about page views and registration steps, event time and a coarse browser category to improve the website. We exclude form content, management or confirmation tokens, full URL queries, style answers, phone numbers and email addresses. These events are not linked to your waitlist profile or used to assess individual tester eligibility.

Change your choice at any time through Analytics settings. Refusing does not affect registration or website access. Withdrawal stops new optional measurements. Identifiable data whose only basis was the withdrawn consent is then deleted or genuinely and irreversibly anonymised; only necessary choice evidence may remain. Withdrawal does not retrospectively make earlier lawful processing unlawful.

Essential operation and security

Hosting and security services may process IP addresses, request times, requested routes, errors and browser information to deliver the site and prevent abuse. We limit this to what is necessary, without substituting it for refused marketing or analytics. Our basis is our legitimate interest in a reliable, secure service.

Essential browser storage remembers language, privacy choices and temporary form or session state. The cookie notice describes this storage. Storage strictly necessary for a function you request does not require marketing consent. Optional measurements do require consent under our website policy.

4. Recipients and international transfers

Authorised team members have access only for their tasks. The website uses Vercel for hosting, Supabase for data storage and Resend for email handling. Providers receive the data required for the relevant service under data-processing and security arrangements. External communication services such as WhatsApp may separately act as controllers for their own purposes.

We do not sell waitlist, profile or contact data. We do not give individual style profiles or contacts to retailers for their marketing. Assortment planning may use sufficiently aggregated information that cannot identify individuals. Limited disclosure may be necessary to meet a legal obligation or deal with a specific legal claim.

Providers and support services may process data outside the European Economic Area. Where this occurs, we use an applicable adequacy decision or appropriate safeguards, such as European Commission standard contractual clauses and any necessary supplementary measures. You may request information about the relevant transfer and a copy of the safeguards from privacy@zavari.com, with others' data and confidential business information protected. European hosting alone does not exclude overseas support or subprocessors.

5. Retention

These are maximum periods. Data is removed earlier when the purpose ends or a valid request requires it.

Leaving the waitlist immediately stops use for that purpose. Name, email, style answers, attribution and associated tokens are removed without unnecessary delay, normally within 7 days. A separate product-update subscription remains only if you intentionally keep it; the leaving function also lets you stop all updates. If you are subscribed to nothing, only a necessary minimal opt-out/evidence record remains.

Deleted data may remain in restricted recovery backups for up to 30 days, without normal use. Previous deletions are reapplied following recovery. For a legal retention duty or a specific dispute, we isolate only the relevant information and do not use it for marketing. Basic tax administration generally requires 7-year retention; this does not automatically apply to an entire waitlist or style profile.

6. Rights

You may request access, correction, erasure, restriction and, where applicable, portability. You may object on grounds relating to your situation to processing based on legitimate interests. We always honour objections to direct marketing. You may withdraw consent at any time without disadvantages for functions that do not require it.

Contact privacy@zavari.com. We respond and act without unnecessary delay and within one month. A necessary extension of up to two further months for complexity or request volume is explained within the first month. We ask for additional identity information only where there is reasonable doubt; we do not routinely request a complete identity-document copy.

You may complain to the Dutch Autoriteit Persoonsgegevens, through autoriteitpersoonsgegevens.nl, or a competent authority where you live, work or where the alleged infringement occurred.

7. Required information, age and decisions

An email address is necessary for a waitlist request; we cannot process that request without it. Providing your first name is optional. Style questions, marketing and analytics are optional. The public website has no general 16+ restriction. If you are under 16, ask your parent or other legal representative to help with your waitlist request through privacy@zavari.com. We limit this contact to arranging the request; we do not activate an optional profile, advertising messages or optional analytics based only on your own consent. Your legal representative must give separate valid consent for those purposes. We take reasonable, proportionate steps to verify their involvement. A checkbox you tick yourself or the ability to pay is not sufficient.

Where necessary, we use a limited age band, your representative's contact details and minimal evidence of their consent. For this low-risk website we do not routinely request a full date of birth or identity-document copy. Data for an unconfirmed parental-consent request is deleted within 14 days; necessary evidence follows the relevant purpose's retention period and, for marketing evidence, the separate evidence rule above. We give additional weight to children's protection. If consent is missing or invalid, we stop the relevant optional processing and erase data where required. Your representative may also withdraw consent.

A testing invitation explains which features you may actually use and what permission is required. Purchases and online payments are also subject to their own legal and provider requirements. We do not make solely automated decisions with legal or similarly significant effects within the website functions covered here.

8. Changes

We publish a new version date when this notice changes. Where necessary, we inform you before materially new purposes or a change of controller. A new consent-based purpose requires a new choice. Updating this notice does not constitute consent.