Privacy Policy.
Nothing to hide. Still some data to handle.
1. Data controller
Effective from 11 October 2026
The controller of personal data processed in connection with OfficialNothing.com is:
Tech4Space OÜ
Registry code: 17146788
Tartu mnt 67/1-13b
10115 Tallinn
Estonia
Contact e-mail: nothing@officialnothing.com
2. Data we process
Depending on how you use the website, we may process your e-mail address, name or label used on a certificate, recipient name and e-mail, dedication, order details, product, price, currency, market, payment and digital-delivery information.
Where you voluntarily choose public display, we may process the public name or label you selected and a record of that choice or consent.
For referrals and credit we may process referral codes, credited and used balances, currency-specific wallet information and a private technical identifier used to access the credit.
Our servers may record technical data such as IP address, request time, request type, server response and other security or operational logs.
For transaction security, fraud prevention, legal compliance and dispute evidence, we may also record the checkout consent wording and version, consent timestamp, IP address, browser user-agent, payment and Stripe identifiers, whether enhanced card authentication was requested, available 3-D Secure/card risk information returned by the payment provider, and timestamps showing when digital delivery was generated or sent.
3. Orders and digital delivery
We process information needed to create an order, receive payment, personalise and deliver the digital product in order to enter into and perform the contract with the customer.
This typically includes e-mail, ordered product, personalisation data and information required to confirm payment and delivery.
Separate consent is not normally required for processing that is necessary to perform the contract.
4. Payments
Card payments are processed by Stripe.
The Seller does not store the full card number, card security code or other complete card details entered in Stripe’s payment environment.
The Seller may receive information needed to connect the payment with the order, such as a payment identifier, amount, currency and payment status.
5. Gift orders
If a customer orders a product as a gift, they may provide the recipient’s name and, for direct delivery, the recipient’s e-mail address.
We use this information only to create and deliver the gift, provide related communication and protect legitimate legal claims.
In that situation we receive the recipient’s data from the purchaser rather than directly from the recipient. Privacy information may therefore be provided to the recipient at first contact, typically in the gift e-mail.
The recipient’s name is not made public merely because the purchaser supplied it.
6. Hall of Nothing and Archive of Nothing
Public display of a name or label in the Hall of Nothing or a named Archive of Nothing record is voluntary.
Where public display is based on consent, that consent can be withdrawn for the future by contacting nothing@officialnothing.com.
After withdrawal, we may remove the public name or replace it with an anonymous label. The underlying order and numbered edition record may still be retained where required for contract performance, legal obligations or legitimate interests.
For the global Hall, we also process an internal normalised ranking value assigned to a qualifying paid order. This value is used to maintain a consistent cross-market ranking.
7. Referrals and Nothing credit
We record personal referral codes, orders attributed to those codes, credited amounts, credit use and the relevant wallet currency.
Credit is associated with the customer’s e-mail address.
A private cryptographically signed identifier may be used to access credit. It functions similarly to an access credential and should not be shared.
We process this data to operate the credit programme, prevent fraud and self-referrals, and protect the system from abuse.
8. Legal bases for processing
Depending on the circumstances, we process personal data because it is necessary to enter into or perform a contract, comply with legal obligations, or pursue legitimate interests such as service security, fraud prevention and protection of legal claims.
Where a customer or recipient voluntarily chooses public display of their name, consent may be the legal basis for that publication.
9. Who may receive the data
Personal data may be disclosed where necessary to service providers that supply technical or professional services to us.
These may include Stripe, hosting and server providers, e-mail infrastructure providers and accounting, tax, legal or IT advisers.
Data may also be disclosed to public authorities where required by law or a binding decision.
We do not sell personal data to advertisers and do not use personal data for cross-context behavioural advertising.
10. Transfers outside the EEA
Some technical service providers may process personal data outside the European Economic Area as part of their infrastructure.
Where such a transfer takes place, it must rely on a mechanism permitted by applicable data-protection law, such as an adequacy decision, standard contractual clauses or another valid legal mechanism.
11. Retention
We retain personal data only for as long as needed for the purpose for which it was collected.
Order and payment data may be retained for periods required by accounting, tax and other legal rules and for as long as reasonably necessary to establish, exercise or defend legal claims.
A publicly displayed name based on voluntary consent is processed until consent is withdrawn or the publication purpose ends.
Referral and credit records may be retained while credit remains usable or while needed to operate the programme correctly and protect against abuse.
Technical and security logs are retained only for a period reasonably necessary for operation, diagnostics and security.
12. Cookies and browser storage
OfficialNothing.com currently does not use marketing or cross-site advertising cookies for profiling visitors.
The website may use technically necessary or functional browser storage for features expressly requested by the user. Examples include remembering a selected market/currency or a private credit identifier so the customer does not have to enter it again.
If analytics, advertising or other non-essential cookies or similar technologies are introduced in the future, this policy and any required consent mechanism will be updated before they are activated.
13. Your rights
Subject to the GDPR and other applicable data-protection law, you may have rights including access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests.
Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Requests can be sent to nothing@officialnothing.com. We may request reasonable identity verification where necessary to protect your data from unauthorised disclosure.
Where a United States state privacy law applies to us and grants you additional rights, those rights may include rights to know or access, correct, delete or obtain a copy of certain personal data, and to opt out of certain uses where applicable. We do not sell personal data or use it for cross-context behavioural advertising.
14. Complaints to a supervisory authority
If you believe your personal data is being processed unlawfully, you have the right to lodge a complaint with a competent data-protection supervisory authority.
For the controller in Estonia, the national supervisory authority is Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate). Depending on applicable law, you may also be entitled to contact the supervisory authority in the EU/EEA country where you live, work or where the alleged infringement occurred.
15. Automated decisions
OfficialNothing.com does not carry out automated individual decision-making or profiling that produces legal effects or similarly significantly affects a customer.
Automatic calculations such as referral credit, Hall ranking, patronage tier or numbered-edition allocation are technical service functions based on published rules.
16. Changes to this Policy
We may update this Policy when website functionality, service providers or applicable law change.
The current version is published on this page with its effective date.