Privacy Policy
Last updated: October 23, 2026
1. Who Handles Your Data
The business responsible for your personal information is HiLoud Solutions, S.L. (Tax ID B43990076), C/ Prades 19, 43393 Almoster (Tarragona), Spain, the company that runs the LOVIUX shop. This policy explains what personal information we collect, why, on what legal basis, how long we keep it and who else receives it. Because we are established in Spain, the EU General Data Protection Regulation (GDPR) also applies to how we handle your information.
Contact for any privacy question: info@loviux.com
We do not sell your personal information and we do not share it for cross-context behavioral advertising, we do not use it to build profiles from what you buy, and we do not pass it to anyone for their own marketing.
2. What Data We Process, Why and for How Long
Each row is a different use of your data.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Processing your order: taking payment, preparing and shipping it, keeping you updated and handling returns and warranty claims | Name, email, phone number, shipping and billing addresses, products, amounts and payment method (we never see your card number: Stripe handles it); your tax ID if you ask for an invoice | Performance of the purchase contract | For as long as the order lasts and then at least for the periods the law requires for commercial, accounting and tax records (6 years for accounting books and supporting documents). They are kept even if your account is deleted |
| Your customer account, if you choose to create one | Name, email, password (stored encrypted), addresses and order history | Performance of a contract (the account terms) | Until you delete it or ask us to delete it. If 8 years go by without activity (counted from when you signed up, last logged in or last ordered, whichever is most recent), we delete it along with its saved addresses and wish lists; your orders are kept as the law requires |
| Answering you by email and through the contact form | What you write to us, your name, your email and, if you give it, your order number | Performance of the contract if you are a customer; otherwise our legitimate interest in replying to you | For as long as needed to resolve your query and any later claim about it |
| Lova, the shop's chat assistant | What you type in the chat. If you ask about an order: the order number and the email used for the purchase, plus that order's status, products, total and tracking. If you are logged in, your customer number | Your request (pre-contractual steps, or the contract if you ask about an order) and our legitimate interest in helping you | The conversation is deleted automatically 30 days after the last message (backups keep it for up to 14 more days) |
| Email newsletter with offers | Email, first name, last name and the shop you buy from | If you subscribe, your consent. If you have bought from us and did not tick “I don't want news about similar products” at checkout, our legitimate interest in sending you the odd update and offer on products similar to the ones you bought (article 21.2 of the Spanish e-commerce act, Ley 34/2002, LSSI). We tell you at checkout, next to the pay button, and you can object then, and later with one click in any email or by writing to us, free of charge. Either way you can unsubscribe from any newsletter | Until you unsubscribe. If you receive 3 or more newsletters without opening any of them, we ask whether you want to keep getting them and, if you don't open that email or place an order within 14 days, we stop sending them. After you unsubscribe we keep your email on a suppression list, only so that we never write to you again |
| Cart reminder: if you enter your email at checkout and do not finish the purchase, we send you up to three reminders (the second may include a discount or free shipping; the third only offers help) | Email and cart contents | Our legitimate interest in you not losing a purchase you started. You can unsubscribe from the email itself | The cart is deleted after 30 days without changes. We keep a record of the reminder sent so we do not repeat it |
| Asking for your opinion on what you bought, 2 days after the parcel is delivered (or 14 to 30 days after the order is completed if we do not know the delivery date) | Email, name and order | Our legitimate interest in hearing from people who buy. You can unsubscribe from the email itself | We keep a record of the email sent so we do not ask you more than once every 30 days |
| Publishing your review on the product page and, if you add them, your photos. We check every review and every photo by hand before publishing it | The alias you choose (anonymous by default), your rating, your text and your photos. We remove the location and other hidden data from the photos | Your consent when you send it. You can ask us to remove it at any time | While the product is in the shop or until you ask us to remove it. Photos we reject are deleted |
| Knowing whether our order, shipping, cart reminder and review request emails are opened (with a tiny image, or “pixel”, that loads when you open them) | The date and time the email was first opened. We do not store your IP address or device with it | Our legitimate interest in knowing whether our notices arrive and are read. You can prevent it by setting your email app not to load images | For as long as we keep the record of that email |
| Google Customer Reviews survey: on the order confirmation page, Google invites you to rate your purchase | Email, order number, delivery country, estimated delivery date and, where available, the products' GTIN codes | Our legitimate interest in showing you the invitation; Google only sends you the survey if you accept it (your consent) | Decided by Google under its privacy policy |
| Invitation to review the shop on Trustpilot (only in the shops for Spain, the United Kingdom, Italy and Denmark) | After delivery, Trustpilot receives your first name, email and order number in a separate email. It does not receive the products, amounts or address | Our legitimate interest in collecting verified reviews. You can ignore it or ask us not to invite you | Decided by Trustpilot under its privacy policy |
| Visit statistics with Umami, installed on our own server and without cookies | Pages viewed, referring website and campaign tags, what you search for in the shop, browser, operating system, device type, screen size, language, and country, region and city derived from the IP address; for a purchase, the order number and amount. The IP address is not stored: it is used on the spot to calculate an identifier that changes every month | Our legitimate interest in knowing how the shop is used. You can switch it off (see below) | Without your IP address or name, for 25 months; after that they are deleted automatically |
| Knowing where each order comes from (search engine, email, an affiliate, another website) | Channel, referring website, campaign and landing page without its parameters | Our legitimate interest in knowing which channels work | With the order; if you do not buy, it is deleted with the cart after 30 days without changes |
| Serving you in your language and aggregated statistics of orders by language | The language set in your browser: only the main one (for example, pt), never the full list. Your browser sends it itself; no cookies | Our legitimate interest in serving you in your language | With the order; if you do not buy, it is deleted with the cart after 30 days without changes |
| Affiliate programme: if you arrive through an affiliate's link, we store in your session (on our server, without a cookie of our own) which affiliate sent you, so we can pay their commission if you buy within the next 7 days | The affiliate and the time of the click; in the click log, your IP address irreversibly transformed (hashed), the referring website and the landing page. To prevent fraud we check that the buyer is not the affiliate. The affiliate does not receive your name or contact details | Our legitimate interest in paying commissions correctly | The session, 7 days; the click record, for as long as needed to settle commissions |
| Website security and prevention of fraud and spam | IP address, browser, pages requested and time (server logs); in forms, the technical signals analysed by reCAPTCHA and Turnstile; at payment, those analysed by Stripe | Our legitimate interest in protecting the shop and the people who buy from it | Server logs, 30 days |
| Invoicing, accounting and tax obligations | The order's billing details | Compliance with legal obligations | At least the legal periods: 6 years for accounting records, plus the tax limitation periods |
The order details are needed to sell and ship the product to you: without them we cannot complete the purchase. We do not make decisions based solely on automated processing, with one exception: Stripe's anti-fraud system can decline a payment automatically. If that happens to you, write to us and a person will review it.
3. Who Else Receives Your Data
We only share your data with these companies and only for the purpose shown. Most of them work on our behalf and follow our instructions; those that also act as controllers in their own right (Stripe for fraud and payment regulations, PayPal or Klarna if you pay with them, Google, Apple and Trustpilot) also apply their own privacy policy.
| Who | Purpose | What they receive | Where they are and safeguards |
|---|---|---|---|
| Stripe | Processing every payment in the shop: card, PayPal, Amazon Pay, Apple Pay, Google Pay, Link and any other method you see at checkout. Preventing fraud | Amount, payment method details, your name, email, phone number and address if you give them at payment, IP address and device data | Stripe Payments Europe, Ltd. (Ireland). It may process data in the US: Stripe is certified under the EU-U.S. Data Privacy Framework and uses standard contractual clauses |
| Google Pay and Apple Pay | Express payment buttons in the side cart and on the checkout page, through Stripe | If you pay with them, Google or Apple pass us, through Stripe, your name, email, phone number and shipping address. When the Google Pay button is shown, Google receives your IP address and browser data | Google and Apple, each under its own policy; they may process data outside the EEA |
| Brevo | Sending the newsletter and the welcome email with its coupon, and measuring newsletter opens and clicks | Email, first name, last name and customer number, if you subscribe or buy from us | Sendinblue SAS (France), which hosts the data in the European Union |
| MillionVerifier | Checking that an email address exists before sending it the newsletter | Hungary (EU), with servers in Hungary and Sweden | |
| Google Maps Platform | Autocompleting your address on the checkout page | What you type in the address field (from 3 characters) and the address you choose; when the checkout page opens, your IP address and browser data | Google, as an independent controller. It may process data in the US: Google LLC is certified under the EU-U.S. Data Privacy Framework |
| Google reCAPTCHA | Protecting the contact form against bots. It only loads when you start typing in a form that uses it | IP address, browser data and signals about how the page is used | Google. It may process data in the US (EU-U.S. Data Privacy Framework) |
| Cloudflare Turnstile | Protecting the newsletter, the welcome pop-up, contact, registration, account and password reset forms against bots. It only loads when you use those forms | IP address, browser data and technical device signals | Cloudflare, Inc. (US): EU-U.S. Data Privacy Framework and standard contractual clauses |
| Anthropic | The artificial intelligence model that answers in the Lova assistant. It also helps us read and answer customer service emails | What you write to Lova and the order details you look up in the chat; the content of the emails you send us | Anthropic (Anthropic Ireland Limited and Anthropic PBC, US), with standard contractual clauses. For Lova, under its terms, it does not train models on this data and deletes it after 30 days |
| Google Customer Reviews | Inviting you to rate your purchase (see the table above) | Email, order number, delivery country and estimated delivery date, GTIN codes | Google, under its own policy. It may process data in the US (EU-U.S. Data Privacy Framework) |
| Trustpilot | Inviting you to review the shop (Spain, the United Kingdom, Italy and Denmark) | First name, email and order number, in a separate email after delivery | Trustpilot A/S (Denmark, EU), under its own policy |
| Logistics and wholesale providers that prepare and ship your order | Preparing and shipping your order | Name, delivery address and phone number, and the products. They do not receive your email address | In Spain (European Union). For orders from the UK shop, also in the United Kingdom, which the European Commission recognises as providing an adequate level of protection |
| Delivery companies | Delivering your order. For example SEUR, UPS, DHL, Correos Express, Colissimo, Nacex or DPD | Name, delivery address and phone number. To follow the shipment we only look up the tracking number with them | In your country and in transit countries; if the destination is outside the EEA, the transfer is necessary to deliver your purchase |
| Holded | Invoicing and accounting software | The details needed for invoices | Holded Technologies S.L. (Spain), which hosts the data in the European Union |
| OVH | Hosting the servers for the shop, the database, email and statistics | All the data in this policy that we store ourselves | OVH SAS, data centres in France (EU) |
| Kiwop | Technical maintenance of the shop and backups | Technical access to the shop's data and its backups | Spain (EU) |
| Public authorities and courts | Meeting legal obligations (for example, tax) or complying with a court order | Only the data the law requires | Depending on the case |
4. Where Your Data Is Processed
LOVIUX is operated from Spain. Our servers are in France and we store your data in the European Union. Some providers may process data in the United States: Stripe, Google, Cloudflare and Anthropic, with the safeguards required by the GDPR (the EU-U.S. Data Privacy Framework for certified companies and, in addition or instead, the European Commission's standard contractual clauses).
Your delivery details reach the United States, where your order is delivered, because this is necessary to deliver it.
5. Cookie-Free Statistics and Cookies
To know how many visits we get and which pages are read, we use Umami, installed on our own server. It sets no cookies and stores nothing on your device, it does not store your IP address and it shares no data with anyone. It does record each visit with an identifier that changes every month, together with the data listed in the table above.
If you would rather we did not count your visits, switch it off in this browser (done: this browser is no longer counted).
The cookies we use, all needed for the shop to work, are listed in our Cookie Policy.
6. The Lova Assistant
Lova is an automated assistant: the answers come from an artificial intelligence model by Anthropic, not from a person. It only loads when you open the chat. While the tab is open, your browser keeps a copy of the conversation, which disappears when you close it.
Do not type in the chat anything that is not needed, such as health or bank details. We review conversations to improve the assistant's answers, and they are deleted after 30 days.
7. Emails We Send You
Order, shipping, cart reminder and review request emails are sent from our own mail server; the newsletter and the welcome email, from Brevo. Cart reminder and review request emails, and every newsletter, include a link to unsubscribe.
Order, shipping, cart reminder and review request emails contain a pixel that tells us whether they were opened; Brevo also measures newsletter opens and clicks. If you do not want this recorded, set your email app not to load images automatically.
8. Your Rights
At any time and free of charge, you can:
- Find out what data we hold about you and get a copy (access)
- Have inaccurate data corrected (rectification)
- Ask us to delete it (erasure), except what the law requires us to keep
- Ask us to restrict its use (restriction)
- Object to uses based on our legitimate interest, and in particular to receiving marketing emails (objection)
- Receive the data you gave us in a commonly used format to take it to another company (portability)
- Withdraw your consent whenever you want, without affecting what was done before
Write to info@loviux.com saying which right you want to exercise. To confirm it is you, we will ask you to write from the email address you used for your orders or to give us a detail of an order. We reply within one month at the latest.
If you think we have not handled your data properly, tell us first and we will try to put it right. Because we are established in Spain, you can also lodge a complaint with the Spanish Data Protection Agency (AEPD).
9. Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, where it comes from, why we use it and who we disclose it to: the tables above list every category, purpose, recipient and retention period
- Request a copy of the personal information we hold about you
- Request that we delete it
- Request that we correct it if it is inaccurate
- Opt out of the sale or sharing of your personal information; we do not sell or share it, so there is nothing to opt out of
- Not be discriminated against for exercising any of these rights
Write to info@loviux.com to make a request. We will verify it against the information we already hold, normally your order email address, and answer within 45 days. An authorized agent may act for you if they provide your written permission.
We collect personal information from you directly, from your browser when you use the shop, and from payment providers when you pay. The companies in the table above receive it as service providers or contractors for the business purposes shown. What you buy may reveal information about your intimate life: we use it only to fulfill and support your orders and as the law requires, never to infer characteristics about you. We have not sold or shared personal information in the preceding twelve months, and we do not sell the personal information of consumers under 16.
10. Other US State Privacy Rights
Residents of other states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana, have comparable rights to access, correct, delete and obtain a copy of their personal information, and to opt out of targeted advertising, sale and profiling. We honor those requests through the same address: info@loviux.com. If we deny a request, you may ask us to reconsider it.
11. Children
LOVIUX is an adult shop. The website and its products are only for people aged 18 or over. We do not knowingly collect personal information from minors, and in particular not from children under 13 as defined by the Children's Online Privacy Protection Act. If you think a minor has given us personal information, write to us at info@loviux.com and we will delete it.
12. Security
The whole website runs over an encrypted connection (HTTPS), passwords are stored encrypted, and we never see or store your card number.
13. Changes to This Policy
If we change how we handle your data, we will update this page and its date. If the change is significant, we will announce it on the website.