Security & Privacy

GENERAL PROVISIONS

This privacy policy (“Privacy Policy”) applies to all Personal Data processed by Lovisa Pty Ltd (“Lovisa”, “we”, “us”, or “Data Controller”). Lovisa complies with the General Data Protection Regulation (“GDPR”).

This privacy policy explains how we collect, hold, use, disclose and otherwise manage personal data in Europe (that is, personal data is defined as any information relating to an identified or identifiable natural person under Art 4 no 1 of the GDPR – “Personal Data”).

YOUR PRIVACY: OVERVIEW

At Lovisa, we take our responsibilities under current data protection regulations and laws seriously. We recognise the importance of the Personal Data you have entrusted to us and are committed to properly managing, protecting, and processing Personal Data.

REVISIONS TO THIS PRIVACY POLICY

Lovisa reserves the right to change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date of this Privacy Policy. If we make material changes to this Privacy Policy, we will provide you with additional notice (such as adding a statement to our websites’ homepage).

COLLECTION, PURPOSE AND USE OF PERSONAL DATA

Lovisa only collects Personal Data where it is reasonably necessary for our business activities. Unless it is not reasonable or practicable to do so, and in other cases allowed by law, we will collect Personal Data about you directly from you. The kinds of Personal Data that Lovisa collects will vary depending on our particular interaction or dealing with you. However, generally speaking, the kinds of Personal Data Lovisa collects and the purposes for which Lovisa uses Personal Data are set out in this clause

4.1. SENSITIVE INFORMATION

Lovisa may collect sensitive information for the primary purpose of enabling you to buy and receive a piercing in the respective body part (for example, the ear lobe, ear helix or nose) and to analyse and respond to any of your queries, claims or complaints. The kinds of sensitive information that Lovisa may collect includes certain health information such as:

history of medication; and
history of infection.

Lovisa may also collect and hold other kinds of sensitive information as permitted or required by law or other kinds of personal information that we notify you of at or about the time of collection.

4.2. WEBSITE DATA COLLECTION

When accessing our website, your device automatically transmits data for technical reasons. The following data is stored separately from other data that you may transmit to us:

browser type and browser version
operating system used
referrer URL
host name of the accessing computer
time of the server request
IP address

We save this data for the following purposes:

Load balancing, i.e., to distribute the access to our website across several devices and to be able to offer you the fastest possible loading times.
Ensuring the security of our IT systems in accordance with Art 32 GDPR and based on our legitimate interest in protecting us from misuse of our service, for example, to prevent specific attacks on our systems and to identify attack patterns.
Ensuring the proper operation of our IT systems, for example if errors occur that we can only remedy by storing the IP address.
To enable criminal prosecution, security, or legal prosecution if there are specific indications of criminal offenses.

This processing takes place on the basis of our predominant legitimate interests mentioned above in accordance with Sec 25 para 2 no 2 German Telecommunications and Telemedia Data Protection Act (TTDSG) and Art 6 Para 1 lit f) GDPR).

4.3. REGISTRATION DATA

To be able to use all functions within our website, you have to register. For this, you have to provide the following mandatory information:

Full Name
Email Address
Phone Number
Password

Your registration data is required to set up and manage a user account for you and so that you can use all the features of our website. In this case, you conclude a (free) usage contract with us on the basis of which we collect this data (Art 6 para 1 lit b) GDPR).

In order to conclude the contract, you have to provide us with this data. However, you are neither contractually nor legally obliged to conclude the contract and thus to provide the data.

In addition, you can provide further voluntary information as part of the registration, for example, you can provide your birthday date. This information is voluntary and not necessary for your registration. We collect this data in order to be able to provide you with the corresponding functions of our website (Art 6 para 1 lit b) GDPR).

Additionally, we process your Personal Data for the following purposes:

Complete Transactions. Complete transactions you request and perform our contractual obligations, including sending notifications related to your purchases, exchanges, and returns based on Art 6 para 1 lit b) GDPR.
Respond to You. To manage your queries, claims and complaints for products in order to identify fraudulent behaviour and technical support matters through email, our chat function, telephone and through social media based upon Art 6 para 1 lit f) GDPR.
Comply with Legal Obligations. To comply with legal obligations, court findings and decisions from authorities based upon Art 6 para 1 lit c) GDPR.

Registration data only needed for providing your user account will be deleted once your user account is closed.

4.4. CONTACT VIA EMAIL OR LIVE CHAT

If you send us a question/query e.g. via e-mail, via our contact page https://www.lovisajewellery.eu/pages/contact-us or via our live chat, your details will be saved and used to process the question/query. The contact details you provide us with will be used to respond to you in response to your question/query.

Our contact forms and live chat functionality are provided by a service desk management platform, on the servers of the service provider Zendesk Inc. (“Zendesk”) 1019 Market Street, San Francisco, CA 94103 USA. Zendesk processes your data on our behalf, i.e., exclusively according to our instructions. The processing takes place in each region we operate in. From time to time, data may be transferred to the United States as part of Zendesk’s backup and recoverability procedures based upon standard contractual clauses approved by the EU Commission in accordance with Art 46 para 2 lit c) GDPR available at: https://www.zendesk.de/company/data-processing-form/. More information regarding Zendesk’s data and privacy policies can be found here:

https://www.zendesk.com/company/privacy-and-data-protection/.

We store inquiries about contracts or of potentially legal relevance and all other inquiries for the duration of the general limitation period or applicable legal obligations to store such Personal Data.

The storage takes place on the basis of our legitimate interest to document our business operations and the securing of our legal positions (Art 6 para 1 lit f) GDPR). For inquiries about contracts, the data is saved for the initiation and implementation of the respective contractual relationship (Art 6 para 1 lit b) GDPR) and, if applicable, for the fulfilment of legal obligations (Art 6 para 1 lit c) GDPR).

4.5. IN STORE DATA

We offer our customers a choice of either physical or digital receipt when they are shopping in store. When a customer selects to receive a digital receipt, we collect the following information:

Full Name
Phone Number
Email address

The customer’s email address is saved in our CRM System (Klaviyo) for the purpose of being able to send a digital receipt to the customer.

4.6. OUR SOCIAL MEDIA CHANNELS

4.6.1 SOCIAL MEDIA GENERALLY

If you visit our social media channels (Facebook Fanpage, Instagram, TikTok, Pinterest) we will process certain data, e.g., when you interact with one of our channels or our social media account, like or comment on a post. The corresponding data processing is carried out based on our legitimate interest (Art 6 para 1 lit. f) GDPR) in providing you with the respective functions or based upon your consent provided to the respective social media provider (e.g., Facebook Ireland, TikTok Technology Limited, Pinterest Europe Ltd.)

Please note that these areas are publicly accessible and any personal information you post or provide when registering may be viewed by others. We cannot control how other users use this information. In particular, we cannot prevent unsolicited messages from being sent to you by third parties.

Content posted in community areas may be stored for an unlimited period of time. If you would like us to remove any content you have posted, please send us an e-mail to the address given.

4.6.2 FACEBOOK FANPAGES

You can find us on our Facebook Fanpage: https://www.facebook.com/lovisajewellery/.

For users outside the U.S. and Canada Facebook Services are provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta Ireland”). For users in the U.S. and Canada Meta Platforms Inc., 1601 South California Avenue, Palo Alto, CA 94304, U.S., provides the services.

Even if you are not registered with Facebook and visit our Facebook Fanpage, Meta may collect pseudonymous usage data from you. You can find more information in Meta’s data policy at https://www.facebook.com/privacy/policy/ and at https://www.facebook.com/legal/terms/information_about_page_insights_dataIn the data policy, you will also find information on the settings options for your Facebook account.

Meta Ireland may share your data within the Meta group companies and with other third parties. This may involve the transfer of Personal Data to the U.S. and other third countries for which there is no EU Commission adequacy decision. In this case, Meta Ireland will use the standard contractual clauses approved by the EU Commission in accordance with Art 46 para 2 lit c) GDPR. Further information can also be found in Meta's data policy.

We are also jointly responsible with Meta for the processing of so-called insights data when visiting our Facebook fan page. With the help of this insights data, Meta Ireland analyses the behaviour on our Facebook fan page and makes this data available to us in anonymised form. For this purpose, we have concluded an agreement with Meta Ireland on joint responsibility for data processing, which can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum In this agreement, Meta Ireland undertakes, among other things, to assume primary responsibility under the GDPR for the processing of insights data and to fulfil all obligations under the GDPR with regard to the processing of insights data. The processing serves our legitimate economic interests in the optimisation and needs-based design of our Facebook fan page, Art 6 para 1 lit f) GDPR.

We would also like to draw your attention to the following: If you visit or like our Facebook fan page as a registered Facebook user, Meta Ireland collects Personal Data. If you are not registered with Facebook and visit the Facebook fan page, Meta Ireland may collect pseudonymous usage data.

Specifically, the following information is collected by Meta Ireland:

Accessing a page or a post or a video from a page;
Subscribe or unsubscribe to a page;
Tag a page or post with "like" or "no longer like";
Recommend a Page in a post or comment;
Comment on, share or respond to a Page post (including how to respond);
Hide a Page post or report it as spam;
Click on a link leading to the Page from another page on Facebook or from a website outside Facebook;
Hover over the name or profile picture of a Page to preview Page content;
Click on the webpage button, phone number button, "plan a route" button or any other button on a page; and
Information whether you are logged in via a computer or a mobile device.

For more information, please see Facebook's privacy policy at: https://www.facebook.com/legal/terms/information_about_page_insights_data

PIERCING CONSENT

In order to carry out piercing procedures in our store, we require that you fill out our piercing consent form. You can access this consent form via QR codes accessible in our stores. After you complete the consent form on your personal device and have digitally signed it, this information is sent to the local store email address.

The respective Lovisa company in your jurisdiction acts as the data controller: Lovisa Holdings Ltd [Australia] and all of its subsidiaries including Lovisa Austria GmbH [Austria], Lovisa Australia Pty Ltd [Australia], Lovisa Pty Ltd [Australia], Lovisa Belgium BV [Belgium], Lovisa Canada Ltd [Canada], Lovisa France SARL [France], Lovisa Retail France SARL [France], Lovisa Retail Germany GmbH [Germany], Lovisa Hong Kong Ltd [Hong Kong], Lovisa Luxembourg SARL [Luxembourg], Lovisa Malaysia Sdn Bhd [Malaysia], Lovisa Retail Mexico S.A. DE [Mexico], Lovisa Netherlands BV [Netherlands], Lovisa New Zealand Pty Ltd [New Zealand], Lovisa Poland sp. Z o.o. [Poland], Lovisa Singapore Pte Ltd [Singapore], DCK Jewellery South Africa (Pty) Ltd [South Africa], Lovisa Accessories (Pty) Ltd [South Africa], Lovisa Switzerland AG [Switzerland], Lovisa UK Ltd [United Kingdom], Lovisa America LLC [United States of America].

The processing of the following Personal Data is carried out solely for the purpose of the providing you our piercing services:

Information

What we use for

Full Name

For contact tracing – consent form accuracy

Date of Birth

For contact tracing – consent form accuracy

Phone Number

For contact tracing - consent form accuracy

Address

For contact tracing – consent form accuracy

Lobe or cartilage piercing

For consent form accuracy.

E-mail address

Send consent form to customer so they retain copy.

Confirm not on any medications