Privacy Policy — Velvet Nights

This Privacy Policy explains how Velvet Nights ("we", "us") collects, uses, and protects your personal data when you use our website and services. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable national law.

1. Who we are

Velvet Nights is the data controller for the personal data collected through velvetnights.eu and toys.velvetnights.eu. For any privacy-related question, contact us at privacy@velvetnights.eu.

2. What data we collect

We collect only the data necessary to provide our services:

Identity & contact data: name, email address, billing and delivery address, phone number.
Order data: products ordered, order value, payment status, delivery details.
Technical data: IP address, browser type, device information, pages visited (only with your consent where required).
Account data: if you create an account, your login details and order history.

3. Legal bases for processing

We process personal data on the following legal bases under the GDPR:

Contractual necessity (Art. 6(1)(b)): to process and deliver your orders, handle payments, and provide customer support. This is not based on consent.
Legal obligation (Art. 6(1)(c)): to comply with accounting, tax, and consumer-protection obligations (e.g. retaining invoices for 10 years).
Legitimate interests (Art. 6(1)(f)): for fraud prevention, network security, and improving our services, where our interests are not overridden by your rights.
Consent (Art. 6(1)(a)): for marketing communications and for any optional processing described below. Consent is freely given and can be withdrawn at any time.

Special-category data (Art. 9 GDPR): Some products you order may reveal information about your sex life or intimate preferences. Where we process such data, we rely on your explicit consent (Art. 9(2)(a)), given separately from order processing. This consent is optional, granular, and can be withdrawn at any time without affecting your order. We never infer or store sexual orientation or preferences from your purchases without your explicit consent.

4. How we use your data

To process and deliver your orders (contractual necessity).
To manage payments and prevent fraud.
To provide customer support and respond to enquiries.
To send marketing communications, only where you have consented.
To comply with legal and accounting obligations.

5. Who we share data with (processors)

We share personal data only with service providers who process it on our behalf under written data-processing agreements (Art. 28 GDPR), and only to the extent necessary:

Fulfilment partner (Excitasy): receives your name, delivery address, and product list to ship your order.
Payment processor (Breeze): processes payments. We do not store your card details.
Hosting provider, email service, analytics provider: as needed to operate the site.

We never sell your personal data. We do not build advertising audiences based on specific intimate purchases.

6. Data retention

We retain personal data only as long as necessary:

Order and financial records: 10 years (legal/accounting obligation). Product details in these records are masked where possible.
Account data: until you close your account.
Marketing data: until you withdraw consent.
Technical logs: up to 12 months.

7. Your rights

Under the GDPR you have the right to:

Access (Art. 15): request a copy of your personal data.
Rectification (Art. 16): correct inaccurate data.
Erasure (Art. 17): request deletion of your data, subject to legal retention obligations.
Restriction (Art. 18): restrict processing in certain circumstances.
Data portability (Art. 20): receive your data in a machine-readable format.
Object (Art. 21): object to processing based on legitimate interests.
Withdraw consent: at any time, without affecting the lawfulness of prior processing.
Lodge a complaint: with your national data-protection authority.

To exercise any right, email privacy@velvetnights.eu. We respond within one month.

8. Age gate & age verification

Our site is intended for adults aged 18 and over. When you access the adult section (toys.velvetnights.eu), you will be asked to confirm you are 18 or older. Where required by law, we may use age-verification methods that return only an "over 18" result without retaining copies of identity documents. We do not store identity documents.

9. Data security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), restricted staff access, and secure storage. In the event of a personal-data breach, we will notify the relevant supervisory authority within 72 hours and affected individuals where required (Art. 33/34 GDPR).

10. Data Protection Impact Assessment (DPIA)

Because we process special-category data (Art. 9), we have carried out a Data Protection Impact Assessment (Art. 35 GDPR) covering our order-processing activities. This is reviewed annually.

11. International transfers

We aim to keep your data within the EU/EEA. Where a processor transfers data outside the EU/EEA, we ensure appropriate safeguards (e.g. EU Standard Contractual Clauses) are in place.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page, with the date of the last update shown at the top.

← Back to shop