Privacy Policy

1. About This Policy and Who We Are

Nothing To Wear Club Inc. (operating as "Nothing To Wear") is the organization responsible for the personal information collected through the Platform. Our privacy practices are guided by British Columbia's Personal Information Protection Act (PIPA), the federal Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable to our activities, and Canada's Anti-Spam Legislation (CASL). We have designated a Privacy Officer who is accountable for our compliance with this Policy — see Section 15 for contact details.

2. Personal Information We Collect

2.1 Information You Give Us

• Account information: name, email address, phone number, password, birth date (to confirm age of majority), and profile photo.
• Identity verification information: government-issued ID or other verification details, collected when required for higher-value or higher-risk Transactions and processed through our identity-verification vendor (see Section 5).
• Listing content: photographs, descriptions, sizing, condition notes, and pricing you post for an item.
• Transaction information: rental/purchase history, shipping or pickup address, delivery preferences, and communications about a Transaction.
• Payment information: we do not store full payment card numbers; payment details are collected and processed directly by our Payment Processor, Stripe (see Section 5).
• Messages and support requests: content of messages exchanged with other Users through the Platform, and correspondence with our support team.
• Reviews and ratings: feedback you leave about, or receive from, another User.

2.2 Information Collected Automatically

• Device and usage data: IP address, browser type, device identifiers, app version, pages viewed, and interaction data, collected through cookies, SDKs, and similar technologies (see Section 6).
• Location data: approximate location (derived from IP address or postal code) to show nearby Listings, and, where you enable it, more precise device location to support pickup/delivery coordination.

2.3 Information From Third Parties

• Payment Processor: confirmation of successful payment, refund status, and limited fraud-risk signals.
• Identity verification vendor: a confirmation of whether your identity was successfully verified.
• Social or single sign-on providers: basic profile information, if you choose to register or log in using a third-party account.

We do not knowingly collect sensitive categories of personal information (such as health or financial account information beyond what is needed to process payment) unless you choose to share it with us, for example in a support request.

3. How We Use Personal Information

We use personal information to:

• create and administer your account, and verify your identity and eligibility to use the Platform;
• operate the marketplace — publishing Listings, processing bookings and purchases, facilitating payments, and enabling communication between Users;
• provide customer support and resolve disputes, damage claims, and "not as described" complaints;
• detect, investigate, and prevent fraud, policy violations, and safety issues;
• send transactional messages (booking confirmations, return reminders, payment receipts, account and security notices);
• send marketing communications, where you have provided consent as described in Section 11;
• comply with tax, accounting, and other legal obligations described in our Terms and Conditions; and
• analyze, maintain, and improve the Platform, including troubleshooting and measuring performance.

We only use personal information for a new purpose beyond what is described here with your consent or where otherwise permitted or required by law.

4. Consent

Under Canadian private-sector privacy law, our collection, use, and disclosure of your personal information is generally based on your consent. Depending on the sensitivity of the information and the context, we rely on:

• Express consent — for example, when you tick a box to accept marketing emails, or submit ID for identity verification.
• Implied consent — for example, when you provide a delivery address, we take it that you consent to that address being shared with the Lender/Seller you are transacting with in order to complete the Transaction.

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us at the details in Section 15 or adjusting your in-app settings. Withdrawing consent for information necessary to operate your account or complete an active Transaction may mean we can no longer provide part or all of the Services to you.

5. How We Share Personal Information

5.1 With Other Users

To complete a Transaction, we share the information necessary for that Transaction — for example, a Renter/Buyer's delivery details are shared with the Lender/Seller, and vice versa. Users are responsible for handling one another's personal information appropriately and only for the purpose of completing the Transaction, and may not use it for unrelated marketing or contact.

5.2 With Service Providers

We share personal information with third-party service providers who perform functions on our behalf, under contractual obligations to protect it and use it only as we direct, including:

• our Payment Processor, Stripe;
• cloud hosting and infrastructure providers, including Render (our application hosting provider) and Sharetribe (our marketplace platform provider);
• mapping and location services, including Mapbox;
• push notification services, including OneSignal;
• analytics and product-performance tools, if and when we adopt any;
• customer support and messaging platforms, if and when we adopt any; and
• courier and shipping partners, where a Listing involves shipping.

5.3 For Legal and Safety Reasons

We may disclose personal information where required by law (such as in response to a court order or lawful request from a Canadian law enforcement or regulatory authority), or where necessary to protect the rights, property, or safety of Nothing To Wear, our Users, or the public, or to investigate suspected fraud or violations of our Terms.

5.4 Business Transfers

If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to the protections required under applicable privacy law.

5.5 We Do Not Sell Personal Information

We do not sell personal information to third parties for their own independent marketing purposes.

6. Cookies and Similar Technologies

We and our service providers use cookies, SDKs, and similar technologies to keep you logged in, remember preferences, understand how the Platform is used, and, where you have consented, measure the performance of marketing communications. Most browsers and devices let you control or clear cookies through their settings; disabling cookies may affect parts of the Platform's functionality. Where our app uses mobile advertising or analytics identifiers, we will describe those uses, and any opt-out available through your device settings, in the app's privacy disclosures.

7. Cross-Border Storage and Transfer of Information

Some of our service providers — including our Payment Processor, hosting provider, or analytics tools — may store or process personal information outside British Columbia, including elsewhere in Canada or in other countries such as the United States. When personal information is processed outside Canada, it becomes subject to the laws of that jurisdiction, including lawful access requests by foreign courts, law enforcement, or government authorities. We take contractual and technical steps to require service providers to protect personal information to a standard comparable to the protections required under BC PIPA, but we cannot guarantee that a foreign jurisdiction's laws will not permit access to information stored there. You may contact our Privacy Officer for more information about, or a general account of, our third-party service providers and where they store data.

8. Data Retention and Destruction

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, including to satisfy legal, accounting, dispute-resolution, or tax record-keeping requirements (for example, retaining Transaction records for the period required under Canadian tax law). When personal information is no longer needed for these purposes, we securely destroy, delete, or anonymize it.

9. How We Protect Personal Information

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, or disposal, appropriate to the sensitivity of the information. These include encryption of data in transit, access controls limiting employee access on a need-to-know basis, and vetting of third-party service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Privacy Rights

10.1 Access and Correction

You have the right to request access to the personal information we hold about you, and to request correction of information you believe is inaccurate or incomplete. We will respond to a written request within 30 days, as required under BC PIPA, or explain any extension needed. We may need to verify your identity before processing a request, and in limited circumstances permitted by law we may be unable to provide access to certain information (for example, information subject to solicitor-client privilege or that would reveal personal information about another individual).

10.2 Account Closure

You may close your account at any time through the app or by contacting us. Closing your account stops active use of the Platform; some information may be retained afterward as described in Section 8.

10.3 Marketing Preferences

See Section 11 for how to opt out of marketing communications.

11. Marketing Communications and CASL

We will only send you promotional or marketing messages (such as newsletters or promotional offers) if you have consented to receive them, consistent with Canada's Anti-Spam Legislation (CASL). Every marketing message will identify us and include our contact information and a working unsubscribe mechanism. You can withdraw consent at any time by using the unsubscribe link or updating your notification settings in the app; this will not affect transactional messages necessary to operate your account or complete a Transaction.

12. Children's Privacy

The Platform is intended for Users who are at least 18 years old and have reached the age of majority in their province or territory of residence, consistent with the eligibility requirements in our Terms and Conditions. We do not knowingly collect personal information from children. If we learn that we have collected personal information from someone under the applicable age of majority without appropriate consent, we will take reasonable steps to delete it.

13. Privacy Breaches

If a breach of security safeguards creates a real risk of significant harm to an individual, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required under PIPEDA for the data flows to which PIPEDA applies (generally, activities involving Users outside British Columbia or otherwise subject to federal jurisdiction). For activities governed by BC PIPA, mandatory breach notification is not currently required by law, but it is our practice to notify British Columbia's Office of the Information and Privacy Commissioner and affected individuals where a breach poses a real risk of significant harm, consistent with the OIPC's published guidance.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. Where a change is material, we will provide notice (for example, by email or an in-app notice) before it takes effect. The "Last Updated" date at the top of this Policy shows when it was last revised. Continued use of the Platform after a change takes effect constitutes acceptance of the updated Policy.

15. Contact Our Privacy Officer

Questions, access requests, or correction requests relating to this Policy can be directed to:

Nothing To Wear Club Inc. (operating as "Nothing To Wear")
Attn: Privacy Officer
Address: Unit #30, 5300 Main St, Kelowna, BC V1W 3W4
Email: help@nothingtowearclub.ca

16. How to Make a Complaint

If you are not satisfied with our response to a privacy concern, you may contact:

• Office of the Information and Privacy Commissioner for British Columbia (OIPC) — oipc.bc.ca — for concerns about our handling of personal information under BC PIPA.
• Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca — for concerns about our handling of personal information under PIPEDA.