Privacy and Personal Data Protection Policy
Last updated: 9 June 2026
Preamble
Family Web Diffusion, the company operating the loveandvibes.co.uk website, attaches the utmost importance to protecting the privacy of its customers and visitors. Given the particular nature of our business, namely the sale of intimate products and sexual wellness items, we are committed to processing your personal data with an enhanced level of discretion and security.
This Privacy Policy is intended to inform you, in a clear and transparent manner, of how we collect, use and protect your personal data, as well as of the rights available to you under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
By browsing our website, creating an account or placing an order, you acknowledge that you have read this Policy.
1. Identity of the data controller
The controller of your personal data is:
FAMILY WEB DIFFUSION, a French limited liability company (Société à responsabilité limitée) with a share capital of EUR 480,000, having its registered office at 1 rue Gustave Eiffel, 31780 Castelginest, France, registered with the Trade and Companies Register of Toulouse under number 530 155 167, VAT number FR66530155167.
For any question regarding the protection of your personal data or to exercise your rights, you can contact us using the following means:
- By email at the dedicated address: [email protected]
- Via the contact form available on our website
- By post to the registered office address mentioned above
2. Personal data collected
As part of our business activity, we collect and process the following categories of data:
Identification and contact data: title, first name, last name, date of birth where applicable, postal address, delivery address, email address, telephone number.
Data relating to your customer account: login credentials, password (stored in hashed form), order history, purchase preferences, wish list, reviews submitted.
Payment data: chosen payment method, transaction amount. Please note that full banking data (card number, security code) is never collected or stored by Family Web Diffusion. This data is processed directly by our secure payment service providers, within a PCI-DSS certified environment.
Browsing and technical data: IP address, session identifiers, browser and operating system type, pages viewed, visit duration, data from cookies and trackers.
Data relating to your orders: products ordered, amounts, dates, delivery tracking, exchanges with our customer service.
Data from your communications with us: content of emails exchanged with our customer service, messages left via the contact form, post-purchase feedback and reviews.
Family Web Diffusion does not solicit or voluntarily collect special category data within the meaning of Article 9 of the UK GDPR (racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, sexual orientation or stated gender identity). However, we are aware that certain purchases made on our website may, by their context, reflect or suggest a part of your private or intimate life. This data therefore benefits from an enhanced level of confidentiality and security, detailed in section 9 of this Policy.
3. Purposes of processing and legal bases
Your data is collected and processed for the following purposes, each based on a specific legal basis within the meaning of Article 6 of the UK GDPR:
3.1 Order management and contractual relationship
This includes the creation of your customer account, the processing of your orders, the management of payments, the organisation of deliveries, the handling of returns and refunds, the management of after-sales service and any disputes.
Legal basis: performance of the contract of sale entered into between you and Family Web Diffusion (Article 6.1.b of the UK GDPR).
3.2 Compliance with our legal and tax obligations
Retention of invoices and accounting documents, VAT management, legal archiving of transactions, fraud prevention, response to requests from competent authorities.
Legal basis: compliance with legal obligations to which the controller is subject (Article 6.1.c of the UK GDPR).
3.3 Commercial communications and newsletter
Sending of our newsletter, promotional offers and communications about our new products, subject to your prior consent expressed via a dedicated tick box upon your registration, the creation of your customer account or via the subscription form available on our website.
Legal basis: your express consent (Article 6.1.a of the UK GDPR). You may withdraw your consent at any time, in particular via the unsubscribe link in each of our emails or by contacting us directly.
3.4 Customer review requests after purchase
Sending of invitations to leave a review on the products you have purchased, through our partner Avis-Verifies.
Legal basis: our legitimate interest in collecting feedback to improve the quality of our products and services (Article 6.1.f of the UK GDPR).
3.5 Personalisation of your experience and recommendations
Adaptation of the website display according to your preferences, recommendations of products likely to interest you, management of your wish list.
Legal basis: your consent for personalised recommendations by email, and our legitimate interest for simple personalisation on the website (Articles 6.1.a and 6.1.f of the UK GDPR).
3.6 Audience measurement and statistical analysis
Understanding how our website operates, identifying areas for improvement, measuring the performance of our content and campaigns.
Legal basis: your consent, collected via our cookie banner during your first visit (Article 6.1.a of the UK GDPR).
3.7 Website security and fraud prevention
Detection of attempted payment fraud, security of your account, protection against unauthorised access, retention of technical logs necessary for security.
Legal basis: our legitimate interest in ensuring the security of our website and our customers (Article 6.1.f of the UK GDPR).
3.8 Management of data subject rights
Processing of your requests for access, rectification, erasure, objection or portability of your data.
Legal basis: compliance with our legal obligations (Article 6.1.c of the UK GDPR).
3.9 Discretion of delivery and invoicing
Dispatch of your orders in plain packaging, without external mention of the contents or of the Love and Vibes brand, and invoicing under the name of Family Web Diffusion.
Legal basis: performance of the contract and our legitimate interest in protecting the privacy of our customers (Articles 6.1.b and 6.1.f of the UK GDPR).
3.10 No profiling relating to private life
Family Web Diffusion does not carry out any automated profiling intended to infer your sexual orientation, your sexual preferences, your gender identity or any other element relating to your intimate life, from your orders or your browsing behaviour. No automated decision producing legal effects concerning you or significantly affecting you is taken on the basis of such information, in accordance with Article 22 of the UK GDPR.
4. Recipients of the data
Your personal data is accessible only to authorised personnel within Family Web Diffusion, strictly within the scope of their duties and on a need-to-know basis.
It is also communicated, to the extent strictly necessary for the performance of the purposes described above, to the following recipients:
Authorised personnel and integrated partner service providers
Your personal data is accessible to authorised personnel within Family Web Diffusion as well as to certain partner service providers integrated into our operational teams, strictly within the scope of the performance of their missions and on a need-to-know basis. These partner service providers work within our premises or remotely in an integrated manner with our business processes, and may have administrator-level access to the tools used for the operation of our activity. They act as processors within the meaning of Article 28 of the UK GDPR, under a formal data processing agreement that specifies obligations regarding security, confidentiality, retention periods and purpose limitation. These individuals are subject to the same confidentiality obligations as our employees, formalised through a specific clause in their contract. All data processed in this context remains hosted within the European Union and is not subject to any transfer to third countries.
Hosting and backup
The website data is hosted by our hosting provider, whose data centres are located in France. Our backups are additionally copied to Amazon Web Services (AWS), whose data centres used for these backups are located in the European Union (Paris region).
These providers act as processors within the meaning of Article 28 of the GDPR, under data processing agreements. In this context, no data is stored outside the European Union.
Content delivery network and security
To ensure the speed, availability and security of the website (content delivery network, web application firewall, protection against attacks), all traffic passes through a specialised provider acting as a processor within the meaning of Article 28 of the GDPR.
In this capacity, the provider processes technical connection data such as the IP address, the user agent and the pages requested. This provider is established in the United States. Data transfers are governed by its Data Privacy Framework certification and by the European Commission’s standard contractual clauses.
Payment service providers
Mollie B.V., a Dutch company based in Amsterdam, acting as an autonomous data controller in its capacity as an electronic money institution regulated by the Dutch Central Bank (n° F0038). Mollie aggregates various payment methods (Apple Pay, Klarna, Pay by Bank, Trustly) and processes your payment data directly, in compliance with its own legal obligations. For more information, please consult Mollie's privacy policy: https://www.mollie.com/en/legal/privacy
PayPal (Europe) S.à r.l. et Cie, S.C.A., a company based at 22-24 Boulevard Royal, L-2449 Luxembourg, acting as an autonomous data controller for PayPal payments. For more information, please consult PayPal's privacy policy: https://www.paypal.com/uk/legalhub/privacy-full
Carriers and logistics
Our delivery service providers, each acting as autonomous data controllers for the dispatch of your parcels.
Customer review platform
Our customer reviews solution, a French company based in France, which collects, moderates and publishes our customers' reviews after purchase. This solution processes your contact details (surname, first name, email, telephone where applicable), your order number, the date of purchase, the product purchased, as well as the content of the review you submit and its rating. The provider acts as a processor within the meaning of Article 28 of the UK GDPR under a formal Data Processing Agreement. All data is hosted within the European Union or the European Economic Area, with no transfers to third countries. Your personal data is anonymised at the latest 18 months after the submission of your review. The provider commits to notifying any data breach within 48 hours.
Affiliate platform
Our affiliate platform, which manages our affiliate programme and the tracking of affiliate commissions. This platform mainly processes pseudonymous data (individual sequence of digits linked to a transaction, without name or customer email address), acting as a joint controller within the meaning of Article 26 of the UK GDPR for tracking and sales attribution. Any transfers outside the EEA are framed by Standard Contractual Clauses adopted by the European Commission and recognised by the UK ICO. The retention period for tracking data is 36 months.
Partner programmes
Sovendus GmbH (Germany), based at c/o Design Offices Karlsruhe Bahnhofplatz, Bahnhofplatz 12, 76137 Karlsruhe, Germany, as part of the Sovendus Voucher Network which offers discount vouchers to our customers after purchase. Sovendus processes, as a processor on our behalf, your name, your title, pseudonymised transaction data and technical usage and session data. The legal basis is our legitimate interest in providing you with personal and secure access to the Sovendus Voucher Network and in enabling the anonymous settlement of redeemed vouchers. This data is retained for a maximum of 4 weeks. If you give your consent to additional functions offered by Sovendus, certain data will be transferred to Sovendus as an independent data controller; the categories of data and the purposes will then be specified to you as part of the collection of your consent. For more information on the processing by Sovendus, please consult the Sovendus privacy policy: https://web.sovendus.com/en/privacy
Orders placed through marketplaces
Some orders come from third-party marketplaces, for example La Redoute, eBay, Rakuten or Cdiscount. To fulfil these orders, the data required for delivery (first name, last name, address, email address) is provided to us by these marketplaces, through a provider specialising in product feed management and order integration, which acts as a processor within the meaning of Article 28 of the GDPR.
For an order placed on a marketplace, that marketplace is responsible for the relationship established on its platform. We invite you to exercise your rights directly with it for that relationship. On our side, this data is processed solely to fulfil and track your order.
These data are kept by this provider only for as long as is necessary to process the order, and are then anonymised within thirty days of its closure.
Google Ads and Google Tag Manager
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) provides two services used on our website: Google Ads for the delivery of targeted advertisements, remarketing and conversion measurement of our advertising campaigns on the Google network, and Google Tag Manager for the deployment and technical management of our measurement tags. Google acts as a processor within the meaning of Article 28 of the UK GDPR for both services, under the Google Ads Data Processing Terms, a data processing agreement automatically applicable to businesses established in the European Economic Area, the United Kingdom or Switzerland. The data processed includes your IP address, technical identifiers (Google advertising cookies, your device's advertising ID), pages viewed on our website, actions performed (product views, add to cart, purchase), as well as the value and details of your order for conversion measurement. Processing is based on your consent, collected via our cookie banner on your first visit. Your consent signal is transmitted to Google in real time via the Consent Mode v2 technical mechanism, which guarantees compliance with your choice (acceptance or refusal) throughout your browsing session. The transfer of this data to the United States is framed by two cumulative mechanisms: Google's certification under the EU-US Data Privacy Framework (recognised by the UK ICO under the UK Extension) and the Standard Contractual Clauses adopted by the European Commission. Google is ISO/IEC 27001 certified for its information security practices. The list of sub-processors engaged by Google for the provision of these services is publicly available at: https://privacy.google.com/businesses/subprocessors. To understand how Google processes your data in the context of our advertising services, please visit Google's dedicated page: https://business.safety.google/privacy/
Microsoft Advertising (Bing Ads)
Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) provides the delivery of targeted advertisements on the Bing network and the measurement of conversions for our Microsoft Advertising campaigns. Microsoft acts as an independent controller within the meaning of the UK GDPR for the data collected as part of Microsoft Advertising. The applicable contractual framework is the Microsoft Advertising Agreement, automatically accepted upon creation of our advertiser account. Microsoft reserves the right to use the collected data for its own advertising purposes and for the improvement of its services. The data processed includes your IP address, technical identifiers (Microsoft advertising cookies, your device's advertising ID), pages viewed on our website and actions performed, including purchases for conversion measurement via the Universal Event Tracking (UET) tag. Processing is based on your consent, collected via our cookie banner. Your consent signal is transmitted to Microsoft in real time via the Consent Mode v2 technical mechanism, which guarantees compliance with your choice (acceptance or refusal) throughout your browsing session. The transfer of this data to the United States is framed by two cumulative mechanisms: Microsoft Corporation's certification under the EU-US Data Privacy Framework (recognised by the UK ICO under the UK Extension) and the Standard Contractual Clauses adopted by the European Commission. Microsoft is ISO/IEC 27001, SOC 2 Type II and ISO/IEC 27018 certified for its security and data protection practices. For more information on how Microsoft processes your data as part of its advertising services, please refer to the Microsoft Privacy Statement: https://www.microsoft.com/privacy/privacystatement and the Microsoft Advertising Privacy Policies: https://about.ads.microsoft.com/en-us/policies/legal-privacy-and-security
Advertising retargeting partner
Criteo S.A., a French public limited company with its registered office at 32 rue Blanche, 75009 Paris, France, acts as our advertising retargeting partner. This technology enables us to display personalised advertisements to you on other websites you visit, based on your browsing on our site. Criteo and Family Web Diffusion act as joint controllers, within the meaning of Article 26 of the UK GDPR. The allocation of responsibilities is defined in the Criteo Data Protection Agreement. The data processed includes a unique identifier (contained in a cookie), the pages you visit on our website, the products you view and, where applicable, information on your transactions. Criteo is only activated after obtaining your consent via our cookie consent management solution, in the 'Marketing cookies' category. You may at any time withdraw your consent or object to Criteo retargeting by changing your cookie preferences or by using the opt-out link available in the Criteo privacy policy. Any data transfers outside the European Economic Area carried out by Criteo (in particular to Sendgrid in the United States) are framed by Standard Contractual Clauses adopted by the European Commission and recognised by the UK ICO. Main hosting is performed by AWS in Ireland (European Union). For more information on how Criteo processes your data and to exercise your rights, please refer to the Criteo privacy policy: https://www.criteo.com/privacy
Loading the Criteo tag may result in the placement of cookies by Criteo's third-party advertising technology partners (in particular ID5, PubMatic, Adobe Audience Manager, and other actors in the advertising ecosystem). These partners act within the framework of the Consented Third-party Vendors defined in Article 9(g) of the Criteo DPA. You may refuse their cookies by refusing the marketing cookies in our consent management solution, or by using the opt-out tools available in the Criteo privacy policy.
Microsoft Clarity
Microsoft Clarity is a behavioural analytics tool provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). This tool helps us understand how you use our website (heatmaps, session recordings, navigation paths) in order to improve your experience. Microsoft acts as an independent data controller within the meaning of the UK GDPR for the data collected via Clarity. The data processed includes your interactions with the website (clicks, scrolling, mouse movements), your IP address (anonymised), your user-agent and the pages you visit. Microsoft reserves the right to use this data for its own purposes, including advertising. Microsoft Clarity is only activated after obtaining your consent via our cookie consent management solution. Data transfers to the United States are framed by the Data Privacy Framework (DPF), to which Microsoft Corporation is certified, supplemented by Standard Contractual Clauses adopted by the European Commission and recognised by the UK ICO. The retention period for Clarity cookies is a maximum of 1 year. For more information on how Microsoft processes your data, please refer to the Microsoft Privacy Statement: https://www.microsoft.com/privacy/privacystatement
Email service provider
Our email service provider, a European company based in France, which handles the sending of our newsletter and our transactional emails (order confirmation, delivery tracking, etc.).
Audience measurement tool
Our web analytics solution, provided by a company based in New Zealand (a country recognised by the European Commission as offering an adequate level of personal data protection within the meaning of Article 45(3) of the UK GDPR, and equivalent provisions under UK law). This solution allows us to understand traffic on our website, the most visited pages, visitor journeys and conversions, in order to continuously improve your experience. The provider acts as a processor within the meaning of Article 28 of the UK GDPR under a formal Data Processing Agreement. The data processed includes your IP address (which can be anonymised), pages visited, your browser, your operating system, traffic sources, and purchase data where applicable. All data is hosted entirely within the European Union (AWS data centres in Frankfurt and Dublin), with no transfers to third countries outside the European Economic Area or countries recognised as adequate. The provider is ISO/IEC 27001 certified. The data collected is retained for a maximum of 13 months for visitor identifiers, in accordance with the recommendations of the UK ICO and the French CNIL.
Customer service provider
Our customer service management tool, an international platform that handles our tickets, emails and chat with our customers. Data transfers to the United States are framed by Binding Corporate Rules approved by European authorities, the UK Extension to the EU-US Data Privacy Framework and Standard Contractual Clauses.
Cookie consent management tool
Our cookie consent management solution (Consent Management Platform), a European company based in the European Economic Area, which collects and stores the proof of your consent to non-essential cookies. This solution processes only technical and pseudonymous data (IP address anonymised by removal of the last octet, country code, user-agent, date and time of consent), acting as a processor within the meaning of Article 28 of the UK GDPR under a formal data processing agreement. The provider is ISO 27001 certified and undertakes to notify any personal data breach without undue delay, in accordance with Article 33 of the UK GDPR.
Accounting firm
Our accounting firm, which receives customer invoicing data for the keeping of our accounts, strictly within the scope of its assignments and subject to the confidentiality obligations of the profession.
Administrative, judicial and tax authorities
In the event of a legal obligation, judicial requisition or administrative inspection, your data may be communicated to the competent authorities strictly within the scope of their requests.
We have formalised the data processing agreements provided for in Article 28 of the UK GDPR with all our service providers processing personal data on our behalf, in order to contractually frame the applicable security, confidentiality and retention conditions.
Your data is never sold or rented to third parties for commercial purposes.
The detailed and updated list of all our processors handling personal data on our behalf is available on simple request to [email protected].
5. Retention periods
We retain your data for the periods strictly necessary for the purposes described above, in accordance with the following durations:
Customer account: your data is retained as long as your account is active and you interact with our website or our communications. In the event of prolonged inactivity, your data may be deleted or anonymised, except where contractually necessary or where required by a legal retention obligation.
Order and invoicing data: 10 years from the closing of the accounting year, in accordance with applicable accounting obligations.
Prospecting data (newsletter, non-customer prospects): up to 3 years after the last contact or last interaction on your part.
Cookies and trackers: maximum duration of 13 months for cookies placed on your device. Proof of your consent is retained for a minimum of 6 months.
Connection logs and technical security data: 12 months from their collection, in accordance with applicable security recommendations.
Customer service tickets and email exchanges: 3 years after the closing of the last ticket.
Identity documents provided in the context of verification: maximum 30 days, except in the case of a fraud prevention procedure where retention may be extended for the time strictly necessary to resolve the procedure.
Upon expiry of these periods, your data is either anonymised, deleted, or archived with restricted access where a legal obligation requires us to do so.
6. Data transfers outside the United Kingdom and the European Union
The majority of our service providers are established in the European Union or in the European Economic Area, which guarantees a level of protection equivalent to the UK GDPR.
Certain transfers outside the United Kingdom and the European Union may nevertheless occur as part of our activity:
European Union: most of our processors are based in the EU, transfers are covered by the adequacy decision of the UK government recognising the equivalent level of protection of the EU GDPR. No additional formalities are required.
United States: transfers to our customer service management tool, to our content delivery network and security provider, and to our advertising and analytics partners (Google, Microsoft). Occasional transfers may also occur via certain sub-processors of our advertising retargeting partner. These transfers are governed by several cumulative protection mechanisms: Binding Corporate Rules approved by the European authorities (applicable to our customer service tool), the EU-US Data Privacy Framework certification (applicable to Google, Microsoft, our content delivery network and security provider, and our customer service tool), and the standard contractual clauses adopted by the European Commission (as a complementary safeguard).
Country of destination of your order: for international deliveries, your details may be processed by local carriers in the country of destination, strictly within the scope of the performance of your order (Article 49.1.b of the UK GDPR).
In all cases, we ensure that transfers outside the United Kingdom are governed by appropriate safeguards within the meaning of Articles 44 to 49 of the UK GDPR.
The majority of our service providers are established in the European Union or in the European Economic Area, which guarantees a level of protection equivalent to the UK GDPR.
Certain transfers outside the United Kingdom and the European Union may nevertheless occur as part of our activity:
European Union: transfers between the United Kingdom and the European Union are covered by the adequacy decision of the European Commission of 28 June 2021 concerning the United Kingdom. No additional formalities are required.
United States: transfer to Zendesk Inc. for the management of customer service, framed by the Standard Contractual Clauses adopted by the European Commission and by the Data Privacy Framework certification held by this provider.
Country of destination of your order: for international deliveries, your details may be processed by local carriers in the country of destination, strictly within the scope of the performance of your order (Article 49.1.b of the UK GDPR).
In all cases, we ensure that transfers outside the United Kingdom are governed by appropriate safeguards within the meaning of Articles 44 to 49 of the UK GDPR.
7. Your rights
In accordance with Articles 15 to 22 of the UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:
Right of access (Article 15): you can obtain confirmation that your data is being processed and receive a copy of it.
Right to rectification (Article 16): you can request the correction of inaccurate or incomplete data concerning you.
Right to erasure (Article 17): you may request the deletion of your personal data. This deletion is carried out subject to the data we are required to retain in order to comply with our legal and accounting obligations, in particular your invoices, retained for ten years, as well as data necessary for the establishment, exercise or defence of legal claims. Data retained on this basis is placed under restricted access and then deleted at the end of the applicable period.
Right to restriction of processing (Article 18): you can request the suspension of the processing of your data in certain cases provided for by the UK GDPR.
Right to data portability (Article 20): you can receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
Right to object (Article 21): you can object, at any time, to the processing of your data for reasons relating to your particular situation, and in particular to processing for direct marketing purposes.
Right to withdraw consent (Article 7.3): where the processing is based on your consent, you can withdraw it at any time, without this affecting the lawfulness of the processing carried out before such withdrawal.
Right relating to automated decisions (Article 22): you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.
How to exercise your rights
- By email at [email protected]
- Via our contact form
- By post to the registered office address
In order to ensure the security of your data, we may ask you to prove your identity by any appropriate means.
We undertake to respond to your request within one month from its receipt, in accordance with Article 12.3 of the UK GDPR. This period may be extended by two additional months in the event of a complex request or multiple requests, in which case we will inform you accordingly.
Right to lodge a complaint
If you consider that your rights have not been respected, you have the option of lodging a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. Telephone: 0303 123 1113. Website: www.ico.org.uk
8. Cookies and trackers
Our website uses cookies and trackers for its proper operation, to measure its audience and, subject to your consent, to personalise your experience.
Categories of cookies used
Strictly necessary cookies: essential for the operation of the site (cart management, account login, security). These cookies do not require your consent.
Audience measurement cookies: allow us to analyse how the site is used and identify improvements. Subject to your consent.
Functional cookies: improve your experience (display preferences, etc.). Subject to your consent.
Marketing and advertising cookies: enable the display of targeted advertisements on other websites, retargeting, measurement of our advertising campaign conversions and anonymised behavioural analysis (heatmaps, session recordings). Notably concern our partners Google Ads, Microsoft Advertising, Criteo and Microsoft Clarity. Subject to your consent.
Managing your consent
During your first visit to our website, an information banner allows you to accept, refuse or customise your consent to non-essential cookies. Your choice is then retained for a maximum period of 6 months.
You can change your preferences at any time by clicking on the Cookie management link in the footer of the website.
9. Data security
We implement appropriate technical and organisational measures to ensure the security of your personal data, in accordance with Article 32 of the UK GDPR:
On the technical side: encryption of communications via the HTTPS protocol throughout the website, passwords stored in hashed form, regular backups, security updates of our systems, protection measures against common attacks.
Organisational measures: access to data strictly limited to authorised personnel within the scope of their duties, employees with access to data are bound by confidentiality obligations, GDPR data processing agreements formalised with all our service providers in accordance with Article 28 of the UK GDPR.
In the event of a data breach presenting a risk to your rights and freedoms, we undertake to notify the ICO within the legal deadlines and, where applicable, to inform you directly.
10. Discretion and confidentiality of your purchase
Given the nature of our products, we pay particular attention to the confidentiality of your purchase:
Plain packaging: all our parcels are shipped in plain packaging, without any logo or external reference to the contents or to the Love and Vibes brand. The displayed sender is Family Web Diffusion.
Anonymous invoicing: your bank statement will mention Family Web Diffusion and not Love and Vibes, except in case of payment via certain alternative methods (notably PayPal).
Limited internal access: only strictly authorised personnel within Family Web Diffusion access your order data, on a need-to-know basis.
Confidentiality obligation of employees: all our employees with access to data are subject to a formal confidentiality obligation, which in particular prohibits commenting on, sharing or disclosing any information relating to your order.
No profiling relating to private life: as indicated in section 3.10, we do not carry out any automated profiling intended to infer your intimate life from your orders.
11. Updates to this Policy
This Privacy Policy may evolve to reflect changes in our business, in the tools we use, or in the applicable regulations.
In the event of a substantial change, we will inform you by any appropriate means, in particular by email or by a message on our website.
The date of the last update is indicated at the top of this Policy.
12. Contact
For any question, request or complaint relating to the protection of your personal data, you can contact us:
By email: [email protected]
Via contact form: accessible from loveandvibes.co.uk
By post:
Family Web Diffusion
Data Protection Service
1 rue Gustave Eiffel
31780 Castelginest
France