Privacy
Draft for legal review. This text is written so the waitlist can ship with a clear basis under the GDPR. It is not a substitute for counsel. The registered address and company registration number below are still outstanding and are shown as pending. The controller is identifiable and reachable, so consent collected in the meantime is valid; the missing address is an imprint obligation under Austrian §5 ECG, and it will be published as soon as the entity has one.
1. Who is responsible
The controller of personal data processed through this website is:
TREFA App
Registered address: pending
Registration number: pending
Contact: office@trefaapp.com
TREFA is based in the European Union. User data stays in the EU.
2. What this policy covers
This page is the public marketing site for TREFA. Until the product launches, the only personal data we intend to collect here is an email address if you ask to be told when TREFA launches (the waitlist).
TREFA is not a marketplace. We do not host, broker or facilitate the sale or transfer of firearms, parts or ammunition.
3. What we collect and why
Launch waitlist
- Data: the email address you submit; the date and time you submitted it and the date and time you confirmed it; which version of this notice you were shown; and the language of the page you used.
- Your IP address: we keep a one-way cryptographic hash of it, never the address itself. This is our record that the sign-up really happened, and it is what stops one machine flooding the form. It cannot be turned back into your IP address by us or by anyone who obtained a copy of the database.
- Purpose: to send you one thing only, either that TREFA has launched or that sign-up is open, plus, if needed, a short operational follow-up (for example a confirmation or a correction).
- What we do not do: we do not add you to a marketing list, sell or rent your address, or use it for unrelated advertising.
The waitlist is confirmed opt-in. Submitting the form does not put you on the list. We email you a link, and only when you open that link are you on it. If the link is never opened, the address is deleted automatically after seven days. This protects you from being signed up by somebody else, which matters more here than on most sites: a list of unverified addresses would be a list of people whom somebody else asserted are interested in firearms, and we are not willing to hold one.
The site itself does not use analytics cookies, advertising trackers, or third-party embeds. With no analytics and no third-party fonts or scripts, a typical visit does not set cookies on your device through this page.
4. Lawful basis
For the waitlist we rely on consent under Article 6(1)(a) of the GDPR. You give consent by entering your email, submitting the form after being told what it is for, and then opening the confirmation link we email you.
You can withdraw consent at any time. Every email we send carries a removal link, and using it deletes your address. We do not keep a record that you were once on the list. Emailing office@trefaapp.com does the same thing, and a request to be removed is always acted on however it reaches us.
If we later process data for other purposes (for example when you create an account in the product), we will state the purpose and the lawful basis for that processing at the point of collection, and this policy will be updated.
5. Where data is stored
Waitlist addresses are stored in the European Union, under a written agreement that requires EU residency and appropriate security.
The website and the waitlist database are hosted by easyname GmbH, an Austrian provider, on servers in the European Union. The confirmation email is sent through Microsoft 365 on Microsoft's EU tenant. Both act only on our instructions and may not use the data for their own purposes.
The form on the homepage posts to /waitlist.php, an endpoint we operate on the same site. It validates the address, stores it, sends the confirmation, and rejects abuse. Confirmation and removal links are stored hashed, so nobody reading the database can confirm or delete anyone else's entry.
6. How long we keep it
We keep a waitlist address until the earlier of:
- you never open the confirmation link, in which case it is deleted automatically seven days after you submitted it;
- you withdraw consent or ask us to delete it;
- we have notified you that TREFA has launched (or that sign-up is open) and a short wind-down period has passed (no more than 90 days after that notice, unless you have created an account and different retention rules apply); or
- we decide not to launch and close the waitlist, in which case we delete the list.
7. Who we share data with
We do not sell personal data. We may use EU-based processors (for example email delivery or hosting) solely to run the waitlist. Processors act on our instructions and may not use the data for their own purposes.
We disclose data if required by law, or if necessary to protect rights, safety, or the integrity of the service, and only to the extent required.
8. Your rights
Under the GDPR you can:
- access the personal data we hold about you;
- correct inaccurate data;
- erase data in the cases the law provides (including when you withdraw waitlist consent);
- restrict or object to certain processing;
- receive a copy of data you provided, in a portable format, where applicable;
- withdraw consent without affecting the lawfulness of processing before withdrawal.
To exercise these rights, contact office@trefaapp.com. You also have the right to lodge a complaint with your local supervisory authority. In Czechia that is the Úřad pro ochranu osobních údajů (UOÚ).
9. Children
TREFA is for adults. The site and the product are 18+. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.
10. Changes
If we change this policy in a way that affects you, we will update the date above. For material changes that affect the waitlist, we will also notify addresses on the list where practical.
11. Contact
Privacy questions: office@trefaapp.com