Privacy Policy
In this guide (11)
Last updated: 28 September 2026
1. Who Handles Your Data
The controller is HiLoud Solutions, S.L. (Tax ID B43990076), C/ Prades 19, 43393 Almoster (Tarragona), Spain, the company that runs the LOVIUX shop. This policy explains what data we process, why, on what legal basis, how long we keep it and who else receives it.
Contact for any privacy question: info@loviux.ie
We do not sell your data, we do not use it for personalised advertising or to build profiles from what you buy, and we do not pass it to anyone for their own marketing.
2. What Data We Process, Why and for How Long
Each row is a different use of your data.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Processing your order: taking payment, preparing and shipping it, keeping you updated and handling returns and warranty claims | Name, email, phone number, shipping and billing addresses, products, amounts and payment method (we never see your card number: Stripe handles it); your tax ID if you ask for an invoice | Performance of the purchase contract | For as long as the order lasts and then at least for the periods the law requires for commercial, accounting and tax records (6 years for accounting books and supporting documents). They are kept even if your account is deleted |
| Your customer account, if you choose to create one | Name, email, password (stored encrypted), addresses and order history | Performance of a contract (the account terms) | Until you delete it or ask us to delete it. If 8 years go by without activity (counted from when you signed up, last logged in or last ordered, whichever is most recent), we delete it along with its saved addresses and wish lists; your orders are kept as the law requires |
| Answering you by email and through the contact form | What you write to us, your name, your email and, if you give it, your order number | Performance of the contract if you are a customer; otherwise our legitimate interest in replying to you | For as long as needed to resolve your query and any later claim about it |
| Lova, the shop's chat assistant | What you type in the chat. If you ask about an order: the order number and the email used for the purchase, plus that order's status, products, total and tracking. If you are logged in, your customer number | Your request (pre-contractual steps, or the contract if you ask about an order) and our legitimate interest in helping you | The conversation is deleted automatically 30 days after the last message (backups keep it for up to 14 more days) |
| Email newsletter with offers | Email, first name, last name and the shop you buy from | If you subscribe, your consent. If you have bought from us and did not tick “I don't want news about similar products” at checkout, our legitimate interest in sending you the odd update and offer on products similar to the ones you bought (article 21.2 of the Spanish e-commerce act, Ley 34/2002, LSSI). We tell you at checkout, next to the pay button, and you can object then, and later with one click in any email or by writing to us, free of charge. Either way you can unsubscribe from any newsletter | Until you unsubscribe. If you receive 3 or more newsletters without opening any of them, we ask whether you want to keep getting them and, if you don't open that email or place an order within 14 days, we stop sending them. After you unsubscribe we keep your email on a suppression list, only so that we never write to you again |
| Cart reminder: if you enter your email at checkout and do not finish the purchase, we send you up to three reminders (the second may include a discount or free shipping; the third only offers help) | Email and cart contents | Our legitimate interest in you not losing a purchase you started. You can unsubscribe from the email itself | The cart is deleted after 30 days without changes. We keep a record of the reminder sent so we do not repeat it |
| Asking for your opinion on what you bought, 2 days after the parcel is delivered (or 14 to 30 days after the order is completed if we do not know the delivery date) | Email, name and order | Our legitimate interest in hearing from people who buy. You can unsubscribe from the email itself | We keep a record of the email sent so we do not ask you more than once every 30 days |
| Publishing your review on the product page and, if you add them, your photos. We check every review and every photo by hand before publishing it | The alias you choose (anonymous by default), your rating, your text and your photos. We remove the location and other hidden data from the photos | Your consent when you send it. You can ask us to remove it at any time | While the product is in the shop or until you ask us to remove it. Photos we reject are deleted |
| Knowing whether our order, shipping, cart reminder and review request emails are opened (with a tiny image, or “pixel”, that loads when you open them) | The date and time the email was first opened. We do not store your IP address or device with it | Our legitimate interest in knowing whether our notices arrive and are read. You can prevent it by setting your email app not to load images | For as long as we keep the record of that email |
| Google Customer Reviews survey: on the order confirmation page, Google invites you to rate your purchase | Email, order number, delivery country, estimated delivery date and, where available, the products' GTIN codes | Our legitimate interest in showing you the invitation; Google only sends you the survey if you accept it (your consent) | Decided by Google under its privacy policy |
| Invitation to review the shop on Trustpilot (only in the shops for Spain, the United Kingdom, Italy and Denmark) | Trustpilot receives a blind copy of the order confirmation email: name, email, order number, addresses and products | Our legitimate interest in collecting verified reviews. You can ignore it or ask us not to invite you | Decided by Trustpilot under its privacy policy |
| Visit statistics with Umami, installed on our own server and without cookies | Pages viewed, referring website and campaign tags, what you search for in the shop, browser, operating system, device type, screen size, language, and country, region and city derived from the IP address; for a purchase, the order number and amount. The IP address is not stored: it is used on the spot to calculate an identifier that changes every month | Our legitimate interest in knowing how the shop is used. You can switch it off (see below) | Without your IP address or name, for 25 months; after that they are deleted automatically |
| Knowing where each order comes from (search engine, email, an affiliate, another website) | Channel, referring website, campaign and landing page without its parameters | Our legitimate interest in knowing which channels work | With the order; if you do not buy, it is deleted with the cart after 30 days without changes |
| Serving you in your language and aggregated statistics of orders by language | The language set in your browser: only the main one (for example, pt), never the full list. Your browser sends it itself; no cookies | Our legitimate interest in serving you in your language | With the order; if you do not buy, it is deleted with the cart after 30 days without changes |
| Affiliate programme: if you arrive through an affiliate's link, we store in your session (on our server, without a cookie of our own) which affiliate sent you, so we can pay their commission if you buy within the next 7 days | The affiliate and the time of the click; in the click log, your IP address irreversibly transformed (hashed), the referring website and the landing page. To prevent fraud we check that the buyer is not the affiliate. The affiliate does not receive your name or contact details | Our legitimate interest in paying commissions correctly | The session, 7 days; the click record, for as long as needed to settle commissions |
| Website security and prevention of fraud and spam | IP address, browser, pages requested and time (server logs); in forms, the technical signals analysed by reCAPTCHA and Turnstile; at payment, those analysed by Stripe | Our legitimate interest in protecting the shop and the people who buy from it | Server logs, 30 days |
| Invoicing, accounting and tax obligations | The order's billing details | Compliance with legal obligations | At least the legal periods: 6 years for accounting records, plus the tax limitation periods |
The order details are needed to sell and ship the product to you: without them we cannot complete the purchase. We do not make decisions based solely on automated processing, with one exception: Stripe's anti-fraud system can decline a payment automatically. If that happens to you, write to us and a person will review it.
3. Who Else Receives Your Data
We only share your data with these companies and only for the purpose shown. Most of them work on our behalf and follow our instructions; those that also act as controllers in their own right (Stripe for fraud and payment regulations, PayPal or Klarna if you pay with them, Google, Apple and Trustpilot) also apply their own privacy policy.
| Who | Purpose | What they receive | Where they are and safeguards |
|---|---|---|---|
| Stripe | Processing every payment in the shop: card, PayPal, Klarna, Bizum, iDEAL, Bancontact, BLIK, MB WAY, Apple Pay, Google Pay and the other methods you see at checkout. Preventing fraud | Amount, payment method details, your name, email, phone number and address if you give them at payment, IP address and device data | Stripe Payments Europe, Ltd. (Ireland). It may process data in the US: Stripe is certified under the EU-U.S. Data Privacy Framework and uses standard contractual clauses |
| Google Pay and Apple Pay | Express payment buttons in the side cart and on the checkout page, through Stripe | If you pay with them, Google or Apple pass us, through Stripe, your name, email, phone number and shipping address. When the Google Pay button is shown, Google receives your IP address and browser data | Google and Apple, each under its own policy; they may process data outside the EEA |
| Brevo | Sending the newsletter and the welcome email with its coupon, and measuring newsletter opens and clicks | Email, first name, last name and customer number, if you subscribe or buy from us | Sendinblue SAS (France), which hosts the data in the European Union |
| MillionVerifier | Checking that an email address exists before sending it the newsletter | Hungary (EU), with servers in Hungary and Sweden | |
| Google Maps Platform | Autocompleting your address on the checkout page | What you type in the address field (from 3 characters) and the address you choose; when the checkout page opens, your IP address and browser data | Google, as an independent controller. It may process data in the US: Google LLC is certified under the EU-U.S. Data Privacy Framework |
| Google reCAPTCHA | Protecting the contact form against bots. It only loads when you start typing in a form that uses it | IP address, browser data and signals about how the page is used | Google. It may process data in the US (EU-U.S. Data Privacy Framework) |
| Cloudflare Turnstile | Protecting the newsletter, the welcome pop-up, contact, registration, account and password reset forms against bots. It only loads when you use those forms | IP address, browser data and technical device signals | Cloudflare, Inc. (US): EU-U.S. Data Privacy Framework and standard contractual clauses |
| Anthropic | The artificial intelligence model that answers in the Lova assistant. It also helps us read and answer customer service emails | What you write to Lova and the order details you look up in the chat; the content of the emails you send us | Anthropic (Anthropic Ireland Limited and Anthropic PBC, US), with standard contractual clauses. For Lova, under its terms, it does not train models on this data and deletes it after 30 days |
| Google Customer Reviews | Inviting you to rate your purchase (see the table above) | Email, order number, delivery country and estimated delivery date, GTIN codes | Google, under its own policy. It may process data in the US (EU-U.S. Data Privacy Framework) |
| Trustpilot | Inviting you to review the shop (Spain, the United Kingdom, Italy and Denmark) | A blind copy of the order confirmation email | Trustpilot A/S (Denmark, EU), under its own policy |
| Logistics and wholesale providers that prepare and ship your order | Preparing and shipping your order | Name, delivery address and phone number, and the products. They do not receive your email address | In Spain (European Union). For orders from the UK shop, also in the United Kingdom, which the European Commission recognises as providing an adequate level of protection |
| Delivery companies | Delivering your order. For example SEUR, UPS, DHL, Correos Express, Colissimo, Nacex or DPD | Name, delivery address and phone number. To follow the shipment we only look up the tracking number with them | In your country and in transit countries; if the destination is outside the EEA, the transfer is necessary to deliver your purchase |
| Holded | Invoicing and accounting software | The details needed for invoices | Holded Technologies S.L. (Spain), which hosts the data in the European Union |
| OVH | Hosting the servers for the shop, the database, email and statistics | All the data in this policy that we store ourselves | OVH SAS, data centres in France (EU) |
| Kiwop | Technical maintenance of the shop and backups | Technical access to the shop's data and its backups | Spain (EU) |
| Public authorities and courts | Meeting legal obligations (for example, tax) or complying with a court order | Only the data the law requires | Depending on the case |
4. Transfers Outside the European Economic Area
Our servers are in France and we store your data in the European Union. Some providers may process data in the United States: Stripe, Google, Cloudflare and Anthropic. They do so with the safeguards provided for in the GDPR: the EU-U.S. Data Privacy Framework for certified companies and, in addition or instead, the European Commission's standard contractual clauses.
If your order goes to a country outside the EEA (for example the United Kingdom, Switzerland or the United States), the delivery details reach that country because this is necessary to deliver it. The European Commission recognises the United Kingdom and Switzerland as providing adequate protection.
5. Cookie-Free Statistics and Cookies
To know how many visits we get and which pages are read, we use Umami, installed on our own server. It sets no cookies and stores nothing on your device, it does not store your IP address and it shares no data with anyone. It does record each visit with an identifier that changes every month, together with the data listed in the table above.
If you would rather we did not count your visits, switch it off in this browser (done: this browser is no longer counted).
The cookies we use, all needed for the shop to work, are listed in our Cookie Policy.
6. The Lova Assistant
Lova is an automated assistant: the answers come from an artificial intelligence model by Anthropic, not from a person. It only loads when you open the chat. While the tab is open, your browser keeps a copy of the conversation, which disappears when you close it.
Do not type in the chat anything that is not needed, such as health or bank details. We review conversations to improve the assistant's answers, and they are deleted after 30 days.
7. Emails We Send You
Order, shipping, cart reminder and review request emails are sent from our own mail server; the newsletter and the welcome email, from Brevo. Cart reminder and review request emails, and every newsletter, include a link to unsubscribe.
Order, shipping, cart reminder and review request emails contain a pixel that tells us whether they were opened; Brevo also measures newsletter opens and clicks. If you do not want this recorded, set your email app not to load images automatically.
8. Your Rights
At any time and free of charge, you can:
- Find out what data we hold about you and get a copy (access)
- Have inaccurate data corrected (rectification)
- Ask us to delete it (erasure), except what the law requires us to keep
- Ask us to restrict its use (restriction)
- Object to uses based on our legitimate interest, and in particular to receiving marketing emails (objection)
- Receive the data you gave us in a commonly used format to take it to another company (portability)
- Withdraw your consent whenever you want, without affecting what was done before
Write to info@loviux.ie saying which right you want to exercise. To confirm it is you, we will ask you to write from the email address you used for your orders or to give us a detail of an order. We reply within one month at the latest.
If you think we have not handled your data properly, tell us first and we will try to put it right. You can also lodge a complaint with the Irish Data Protection Commission or the Spanish Data Protection Agency (AEPD), as we are established in Spain.
9. Children
LOVIUX is an adult shop. The website and its products are only for people aged 18 or over, and we do not knowingly collect data from minors. If you think a minor has given us personal data, write to us at info@loviux.ie and we will delete it.
10. Security
The whole website runs over an encrypted connection (HTTPS), passwords are stored encrypted, and we never see or store your card number.
11. Changes to This Policy
If we change how we handle your data, we will update this page and its date. If the change is significant, we will announce it on the website.