Security & Privacy

GENERAL PROVISIONS

This privacy policy (“Privacy Policy”) applies to all Personal Data processed by Lovisa Pty Ltd (“Lovisa”, “we”, “us”, or “Data Controller”). Lovisa complies with:

the Australian Privacy Principles in the Privacy Act 1988 (Cth) (Privacy Act) in relation to Personal Data processed in Australia; and

the General Data Protection Regulation (“GDPR”) in relation to Personal Data processed in the European Union and the United Kingdom.

This privacy policy explains how we collect, hold, use, disclose and otherwise manage:

personal information in Australia (that is, information or an opinion about you, whether true or not, which identifies you or from which your identity is reasonably identifiable); and

personal data in Europe (that is, personal data is defined as any information relating to an identified or identifiable natural person under Art 4 no 1 of the GDPR).

(together, “Personal Data”)

“YOUR PRIVACY: OVERVIEW

At Lovisa, we take our responsibilities under current data protection regulations and laws seriously. We recognise the importance of the Personal Data you have entrusted to us and are committed to properly managing, protecting, and processing Personal Data.

REVISIONS TO THIS PRIVACY POLICY

Lovisa reserves the right to change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date of this Privacy Policy. If we make material changes to this Privacy Policy, we will provide you with additional notice (such as adding a statement to our websites’ homepage).

COLLECTION, PURPOSE AND USE OF PERSONAL DATA

Lovisa only collects Personal Data where it is reasonably necessary for our business activities. Unless it is not reasonable or practicable to do so, and in other cases allowed by law, we will collect Personal Data about you directly from you. For example, we may collect Personal Data you directly give us:

when you make an online inquiry or place an order in relation our goods or services;
when you contact us via telephone or email;
from correspondence (whether in writing or electronically);
through any mobile applications provided by us;
while conducting customer satisfaction and market research surveys;
when administering any of our services; and
as otherwise required to manage our business.

However, in certain cases we may collect Personal Data from publicly available sources and third parties, such as suppliers, recruitment agencies, contractors, our clients and business partners.

In general, we may use or disclose your Personal Data:

for the purposes for which we collected it, and for related purposes which would be reasonably expected by you;
for other purposes to which you have consented; and
as otherwise authorised or required by law.

The kinds of Personal Data that Lovisa collects will vary depending on our particular interaction or dealing with you. However, generally speaking, the kinds of Personal Data Lovisa collects and the purposes for which Lovisa uses Personal Data are set out in this clause

4.1. SENSITIVE INFORMATION

Lovisa may collect sensitive information for the primary purpose of enabling you to buy and receive a piercing in the respective body part (for example, the ear lobe, ear helix or nose) and to analyse and respond to any of your queries, claims or complaints. The kinds of sensitive information that Lovisa may collect includes certain health information such as:

current medication; and
history of infection.

See section 5 below for more details about the kinds of information we collect when obtaining consent for piercings.

Lovisa may also collect and hold other kinds of sensitive information (such as information about your health or medical conditions, racial or ethnic origin, religious beliefs or affiliations, or sexual orientation) with your consent or as otherwise permitted or required by law.

4.2. WEBSITE DATA COLLECTION

When accessing our website, your device automatically transmits data for technical reasons. The following data is stored separately from other data that you may transmit to us:

browser type and browser version
operating system used
referrer URL
host name of the accessing computer
time of the server request
IP address

We save this data for the following purposes:

Load balancing, i.e., to distribute the access to our website across several devices and to be able to offer you the fastest possible loading times.
Ensuring the security of our IT systems (in accordance with Art 32 of the GDPR, where applicable) and based on our legitimate interest in protecting us from misuse of our service, for example, to prevent specific attacks on our systems and to identify attack patterns.
Ensuring the proper operation of our IT systems, for example if errors occur that we can only remedy by storing the IP address.
To enable criminal prosecution, security, or legal prosecution if there are specific indications of criminal offenses or legal liability.

This processing takes place on the basis of our predominant legitimate interests mentioned above in accordance with Sec 25 para 2 no 2 German Telecommunications and Telemedia Data Protection Act (TTDSG) and Art 6 Para 1 lit f) GDPR) (where applicable).

4.3. REGISTRATION DATA

To be able to use all functions within our website, you have to register. For this, you have to provide the following mandatory information:

Full Name
Email Address
Phone Number
Password

Your registration data is required to set up and manage a user account for you and so that you can use all the features of our website. In this case, you conclude a (free) usage contract with us on the basis of which we collect this data (Art 6 para 1 lit b) GDPR).

In order to conclude the contract, you have to provide us with this data. However, you are neither contractually nor legally obliged to conclude the contract and thus to provide the data.

In addition, you can provide further voluntary information as part of the registration, for example, you can provide your birthday date. This information is voluntary and not necessary for your registration. We collect this data in order to be able to provide you with the corresponding functions of our website (Art 6 para 1 lit b) GDPR).

Additionally, we process your Personal Data for the following purposes:

Complete Transactions. Complete transactions you request and perform our contractual obligations, including sending notifications related to your purchases, exchanges, and returns based on Art 6 para 1 lit b) GDPR.
Respond to You. To manage your queries, claims and complaints for products in order to identify fraudulent behaviour and technical support matters through email, our chat function, telephone and through social media based upon Art 6 para 1 lit f) GDPR.
Comply with Legal Obligations. To comply with legal obligations, court findings and decisions from authorities based upon Art 6 para 1 lit c) GDPR.

Registration data only needed for providing your user account will be deleted once your user account is closed.

4.4. CONTACT VIA EMAIL OR LIVE CHAT

If you send us a question/query e.g. via e-mail, via our contact page https://www.lovisa.com.au/pages/contact-us or via our live chat, your details will be saved and used to process the question/query. The contact details you provide us with will be used to respond to you in response to your question/query.

Our contact forms and live chat functionality are provided by a service desk management platform, on the servers of the service provider Zendesk Inc. (“Zendesk”) 1019 Market Street, San Francisco, CA 94103 USA. Zendesk processes your data on our behalf, i.e., exclusively according to our instructions. The processing takes place in each region we operate in. From time to time, data may be transferred to the United States as part of Zendesk’s backup and recoverability procedures based upon standard contractual clauses approved by the EU Commission in accordance with Art 46 para 2 lit c) GDPR available at: https://www.zendesk.de/company/data-processing-form/. More information regarding Zendesk’s data and privacy policies can be found here:

https://www.zendesk.com/company/privacy-and-data-protection/.

We store inquiries about contracts or of potentially legal relevance and all other inquiries for the duration of the general limitation period or applicable legal obligations to store such Personal Data.

The storage takes place on the basis of our legitimate interest to document our business operations and the securing of our legal positions (Art 6 para 1 lit f) GDPR). For inquiries about contracts, the data is saved for the initiation and implementation of the respective contractual relationship (Art 6 para 1 lit b) GDPR) and, if applicable, for the fulfilment of legal obligations (Art 6 para 1 lit c) GDPR).

4.5. IN STORE DATA

We offer our customers a choice of either physical or digital receipt when they are shopping in store. When a customer selects to receive a digital receipt, we collect the following information:

Full Name
Phone Number
Email address

The customer’s email address is saved in our CRM System (Klaviyo) for the purpose of being able to send a digital receipt to the customer. If the customer has registered on our website using the same details, we will link this information to their registration data.

4.6. OUR SOCIAL MEDIA CHANNELS

4.6.1. SOCIAL MEDIA GENERALLY

If you visit our social media channels (Facebook Fanpage, Instagram, TikTok, Pinterest) we will process certain data, e.g., when you interact with one of our channels or our social media account, like or comment on a post. The corresponding data processing is carried out based on our legitimate interest (Art 6 para 1 lit. f) GDPR) in providing you with the respective functions or based upon your consent provided to the respective social media provider (e.g., Meta, TikTok Technology Limited, Pinterest Europe Ltd.)

Please note that these areas are publicly accessible and any Personal Data you post or provide when registering or using those areas may be viewed by others. We cannot control how other users use this information. In particular, we cannot prevent unsolicited messages from being sent to you by third parties.

Content posted in community areas may be stored for an unlimited period of time. If you would like us to remove any content you have posted, please send us an e-mail to the address given.

4.6.2 FACEBOOK FANPAGES

You can find us on our Facebook Fanpage: https://www.facebook.com/lovisajewellery/.

Facebook Services are provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta Ireland”), for users outside the U.S. and Canada, or Meta Platforms Inc., 1601 South California Avenue, Palo Alto, CA 94304, U.S. (“Meta Platforms”) for users in the U.S. and Canada (collectively, “Meta”).

Even if you are not registered with Facebook and visit our Facebook Fanpage, Meta may collect pseudonymous usage data from you. You can find more information in Meta’s data policy at https://www.facebook.com/privacy/policy/ and at https://www.facebook.com/legal/terms/information_about_page_insights_dataIn the data policy, you will also find information on the settings options for your Facebook account.

Meta may share your data within the Meta group companies and with other third parties. This may involve the transfer of Personal Data to the U.S. and other third countries for which there is no EU Commission adequacy decision. In this case, Meta Ireland will use the standard contractual clauses approved by the EU Commission in accordance with Art 46 para 2 lit c) GDPR (where applicable). Further information can also be found in Meta's data policy.

We are also jointly responsible with Meta for the processing of so-called insights data when visiting our Facebook fan page. With the help of this insights data, Meta analyses the behaviour on our Facebook fan page and makes this data available to us in anonymised form. For this purpose, we have concluded an agreement with Meta Ireland on joint responsibility for data processing, which can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum In this agreement, Meta Ireland undertakes, among other things, to assume primary responsibility under the GDPR for the processing of insights data and to fulfil all obligations under the GDPR with regard to the processing of insights data. The processing serves our legitimate economic interests in the optimisation and needs-based design of our Facebook fan page, Art 6 para 1 lit f) GDPR.

We would also like to draw your attention to the following: If you visit or like our Facebook fan page as a registered Facebook user, Meta collects Personal Data. If you are not registered with Facebook and visit the Facebook fan page, Meta may collect pseudonymous usage data.

Specifically, the following information is collected by Meta:

Accessing a page or a post or a video from a page;
Subscribe or unsubscribe to a page;
Tag a page or post with "like" or "no longer like";
Recommend a Page in a post or comment;
Comment on, share or respond to a Page post (including how to respond);
Hide a Page post or report it as spam;
Click on a link leading to the Page from another page on Facebook or from a website outside Facebook;
Hover over the name or profile picture of a Page to preview Page content;
Click on the webpage button, phone number button, "plan a route" button or any other button on a page; and
Information whether you are logged in via a computer or a mobile device.

For more information, please see Facebook's privacy policy at: https://www.facebook.com/legal/terms/information_about_page_insights_data

4.7. NEWSLETTERS, NOTIFICATIONS AND SURVEYS (DIRECT MARKETING)

In addition to the other purposes outlined in this clause 4, we may collect, use and disclose Personal Data in order to inform you of events, products or services that may be of interest to you and to conduct surveys regarding our products or services. This may include Lovisa disclosing Personal Data to related companies of Lovisa or other entities with which Lovisa has a commercial relationship or arrangement for the purpose of the other entity contacting you for such marketing purposes. Details of these marketing purposes are set out in further detail below. If you do not wish to receive such communications, you can opt-out by contacting Lovisa via the contact details set out in paragraph 20 of this privacy policy or through the opt-out mechanism contained in a marketing communication to you.

4.7.1. EMAIL MARKETING

Our customers can sign up to our newsletter list by providing an email address. As a subscriber to our newsletter, they will receive marketing emails including but not limited to: special offers, new products & services, time sensitive email alerts and surveys.

We offer a free newsletter to keep you informed about special offers, product, and styling news and so-called trigger-based communications with time sensitive reminders such as abandoned cart e-mails and post purchase surveys (in order for us to receive feedback on product or website experience, brand and customer satisfaction. If you would like to receive such newsletters, reminders or surveys, we require your e-mail address for registration.

By opting in, you consent to receiving unsolicited electronic commercial messages via email for an indefinite period until you opt out. You may opt out at any time by following the instructions to unsubscribe in any of these messages.

No further Personal Data is collected unless provided by you on a voluntary basis. We use this data exclusively for sending the requested information.

The processing of your Personal Data is based on your consent (Art 6 para 1 lit a) GDPR).

Further storage for the purpose of proving consent is based on our legitimate interest, the proper documentation of our business operations and the assertion, safeguarding or defence of claims (Art 6 para 1 lit f) GDPR).

We operate an e-mail marketing platform on the servers of the service provider Klaviyo, Inc. (“Klaviyo”). Klaviyo processes your Personal Data on our behalf, i.e., exclusively according to our instructions. The processing takes place in the United States and for this purpose we have entered into standard contractual clauses approved by the EU Commission in accordance with Art 46 para 2 lit c) GDPR available at https://www.klaviyo.com/legal/dpa. More information regarding Klaviyo's data and privacy policies can be found here:

https://www.klaviyo.com/privacy/policy

4.7.2. SMS MARKETING / MOBILE MESSAGE SERVICE

If you provide us with your consent, we will send you text notifications as specified in the Mobile Terms of Service [include link to the Mobile Terms of Service] via SMS in the future.

By opting in, you consent to receiving unsolicited electronic commercial messages via SMS for an indefinite period until you opt out. You may opt out at any time by following the instructions to unsubscribe in any of these messages.

No further Personal Data other than your name, phone number, country, time of consent and consent method is collected unless provided by you on a voluntary basis. We use this data exclusively for providing you with the Service as specified in the Mobile Terms of Service.

The processing of your Personal Data is based on your consent (Art 6 para 1 lit a) GDPR).

4.7.3. SURVEYS

We may ask you to complete a survey from time-to-time to receive feedback on our products and services and better tailor our products and services to you. We may ask you questions that relate to your experiences, our brand or your customer satisfaction with our products and services.

Our surveys may be conducted by our third party providers who handle Personal Data in accordance with their own privacy policy and may disclose the Personal Data to us. If you opt to complete a survey conducted by a third party provider, we recommend you review their privacy policy.

By providing your feedback via our surveys, you consent to the collection, handling and disclosure of your survey responses and any other information you provide in connection with the survey for purposes necessary or useful in the course of operating our business.

PIERCING CONSENT

In order to carry out piercing procedures in our store, we require that you fill out our piercing consent form. You can access this consent form via QR codes accessible in our stores. After you complete the consent form on your personal device and have digitally signed it, this information is sent to the local store email address.

The respective Lovisa company in your jurisdiction acts as the data controller: Lovisa Holdings Ltd [Australia] and all of its subsidiaries including Lovisa Austria GmbH [Austria], Lovisa Australia Pty Ltd [Australia], Lovisa Pty Ltd [Australia], Lovisa Belgium BV [Belgium], Lovisa Canada Ltd [Canada], Lovisa France SARL [France], Lovisa Retail France SARL [France], Lovisa Retail Germany GmbH [Germany], Lovisa Hong Kong Ltd [Hong Kong], Lovisa Luxembourg SARL [Luxembourg], Lovisa Malaysia Sdn Bhd [Malaysia], Lovisa Retail Mexico S.A. DE [Mexico], Lovisa Netherlands BV [Netherlands], Lovisa New Zealand Pty Ltd [New Zealand], Lovisa Poland sp. Z o.o. [Poland], Lovisa Singapore Pte Ltd [Singapore], DCK Jewellery South Africa (Pty) Ltd [South Africa], Lovisa Accessories (Pty) Ltd [South Africa], Lovisa Switzerland AG [Switzerland], Lovisa UK Ltd [United Kingdom], Lovisa America LLC [United States of America].

The processing of the following Personal Data is carried out solely for purposes related to providing you our piercing services:

Information

What we use for

Full Name

For contact tracing – consent form accuracy

Date of Birth

For contact tracing – consent form accuracy

Phone Number

For contact tracing - consent form accuracy

Address

For contact tracing – consent form accuracy

Lobe or cartilage piercing

For consent form accuracy.

E-mail address

Send consent form to customer so they retain copy.

Confirm not on any medications