Skip to content
Demodata: prijzen, artikelen en scores op deze site zijn gegenereerd voor tests en zijn niet echt.
Worth the Bag

Prijzen voor: Nederland, EUR

Privacy policy

Last updated: October 2026

This policy explains which personal data Worth the Bag processes when you use the website, the price alerts or the newsletter, and which rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

Loistava Holding UG (haftungsbeschränkt)
Asternring 9, 15732 Schulzendorf, Germany
Email: [email protected]

2. Overview

You can use this site without an account and without telling us who you are. We process personal data only where it is needed to run the site securely, to send alerts or newsletters you have asked for, or, after your consent, for detailed analytics. We do not sell personal data and we do not use it for advertising profiles.

3. Hosting, delivery and server logs

The website and its database run on servers of Hetzner Online GmbH in Germany. Requests pass through Cloudflare, which provides the content delivery network, DNS and protection against attacks.

When you open a page, the servers technically process your IP address, the date and time, the requested address, the referring page, the browser and operating system. This is necessary to deliver the site and to keep it secure and stable.

  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).
  • Retention: server logs are deleted after 14 days, unless a specific security incident requires us to keep individual entries longer for investigation.

4. Cookies and similar technologies

Before you make a choice in the consent banner, we only store what is strictly necessary for the site to work:

  • Consent cookie: remembers your choice in the consent banner, so we do not ask on every page.
  • Market cookie: remembers the country you selected in the market switcher, so prices are shown for that country. It is set only when you use the switcher.

These are necessary for a service you have requested (§ 25(2) TDDDG; Art. 6(1)(f) GDPR). Other cookies or similar storage are used only after your consent (see section 5). You can change your choice at any time through the cookie settings link in the footer.

5. Analytics

We use PostHog, hosted in the EU, to understand how the site is used.

  • Basic reach measurement without device storage. Page views and visitor counts are measured without cookies and without storing or reading anything on your device. Daily unique visits are estimated from a hash that is calculated on the server and changes daily, so you cannot be recognised across days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing how many people use which pages).
  • Persistent analytics, only with consent. If you agree in the consent banner, PostHog may also store an identifier on your device to recognise repeat visits and to analyse which features are used across sessions. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time through the cookie settings link in the footer, with effect for the future.

6. Price alerts and newsletter

You can ask to be notified by email about a price change, a price increase, a preloved price or an item coming back in stock, and you can separately subscribe to a weekly newsletter.

  • Data: your email address, the item, market, language and type of alert you chose, the time of sign-up and of confirmation, and the version of the consent text you agreed to.
  • Double opt-in: after you sign up, we send an email with a confirmation link that is valid for 7 days. Nothing else is sent until you confirm.
  • Legal basis: Art. 6(1)(a) GDPR (consent). We store the consent version and confirmation time to be able to prove your consent.
  • Withdrawal: every email contains a one-click unsubscribe link. You can also write to us. Withdrawal does not affect the lawfulness of processing before it.
  • Delivery: emails are sent through Resend (see section 9).
  • Retention: sign-ups that are not confirmed are deleted after 7 days. Confirmed subscriptions are kept until you unsubscribe; afterwards we keep the record of your consent and unsubscription for up to 3 years to be able to prove it, and then delete it.

7. Outbound clicks to shops

When you click a link to a retailer or resale platform, we record the click: the shop, the item, the position of the link on the page, the language and the market. We do not store your IP address or any identifier with it, so a click cannot be traced back to you. We use these counts to understand which links are used and to reconcile commissions.

Once you are on the shop's website, the shop and its affiliate network may process data under their own responsibility, for example to attribute a purchase to our link. Their privacy policies apply there.

8. Product matching with a language model

To match product titles from shop feeds to the bags in our catalogue, we may send product titles to Anthropic. Only product data is sent. No personal data of visitors or subscribers is ever sent to Anthropic.

9. Processors

We use the following service providers, who process data on our behalf under data processing agreements (Art. 28 GDPR):

Provider Purpose
Hetzner Online GmbH, Germany hosting and database
Cloudflare, Inc. content delivery, DNS and security
Resend, Inc. email delivery for alerts and the newsletter
PostHog, Inc. (EU cloud) analytics, see section 5
Inngest, Inc. scheduling of background jobs; it receives no personal data beyond what a specific job needs, for example the address an alert is sent to
Anthropic, PBC product title matching only, no personal data

10. Transfers outside the EU

Some providers listed above are based in the United States or may access data from there. Where personal data is transferred to the United States, the transfer is based on the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR) where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), together with additional safeguards where necessary. You can request a copy of the relevant safeguards using the contact details above.

11. Retention at a glance

Data Retention
Server logs 14 days
Outbound click records kept for statistics; they contain no personal data
Unconfirmed alert or newsletter sign-ups deleted after 7 days
Confirmed subscriptions until you unsubscribe
Proof of consent and unsubscription up to 3 years after unsubscribing
Persistent analytics data (with consent) per the PostHog retention settings, at most 12 months

12. Your rights

You have the right to:

  • access the personal data we hold about you (Art. 15 GDPR),
  • have incorrect data corrected (Art. 16),
  • have your data erased (Art. 17),
  • have processing restricted (Art. 18),
  • receive your data in a structured, machine-readable format (Art. 20),
  • object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21),
  • withdraw any consent at any time, with effect for the future (Art. 7(3)).

To exercise these rights, write to [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work, or where the alleged infringement took place (Art. 77 GDPR).

13. Is providing data required?

No. You can use the site without providing personal data. An email address is needed only if you want to receive alerts or the newsletter.

14. No automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

15. Changes

We update this policy when the site or the law changes. The current version is always available on this page.