Privacy Notice

This Privacy Notice explains how we process personal data when you use the SheHerMe App (the “App”).

1. Who is responsible for your data?

For users in the EU / EEA, the controller is Lovehoney Group Germany GmbH, Hermann-Blankenstein-Str. 5, 10249 Berlin, Germany.

For users in the United Kingdom, the controller is Lovehoney Group UK Limited, 100 Locksbrook Road, Bath BA1 3EN, UK.

For users in Switzerland, the controller is Lovehoney Group Switzerland AG, Neue Winterthurerstrasse 99, 8304 Wallisellen, Bulach, Switzerland.

For users in the USA, the controller is Lovehoney Group US Trading Limited, 103 Foulk Road, Suite 202, Wilmington, Delaware 19803-3741, USA.

For users in Canada, the controller is Lovehoney Group Canada Limited, 1545 Carling Avenue, Suite 401, Ottawa, Ontario, K1Z 8P9, Canada.

For users in Australia, the controller is Lovehoney Group Germany GmbH, Hermann-Blankenstein-Str. 5, 10249 Berlin, Germany.

Privacy contact: privacy@lovehoneygroup.com

The data protection officer for Lovehoney Group companies based in Germany is datenschutz nord GmbH, Konsul-Smidt-Str. 88, 28217 Bremen, Germany. The data protection officer for Lovehoney Group companies based outside Germany is FIRST PRIVACY GmbH, Konsul-Smidt-Str. 88, 28217 Bremen, Germany. You can contact the relevant data protection officer via the privacy contact above.

2. What data do we process and why?

Using the App without an account

If you use the App without an account, we process limited technical data generated when the App communicates with our systems, such as your IP address, device, operating system and App information, and security or log data. We use this data to provide, secure and technically operate the App.

Account and sign-in

If you create an account, we process your email address, password or other authentication data, account and session information, and records of required confirmations and consents. Where relevant to a feature, we may also process an age group.

If you use a third-party sign-in service such as Google, we receive the information needed to authenticate you, such as your email address or an account identifier. The sign-in provider processes your use of its service under its own privacy terms.

Wellbeing functions

If you use account-based wellbeing functions, we process information you provide, including symptoms, menstruation or cycle information, journal entries, an age group and other health- or wellbeing-related information. This may include information about your health or sex life. We use it to provide the functions you request and to store and display your entries and history.

Connected devices

If you connect a compatible device, we process information needed to connect and use it, including device identifiers, connection information and information about device use. We may also process technical diagnostic data such as firmware, connection or error information. Device data may, depending on its content, constitute sensitive personal data, including information about health or sex life.

App analytics and error diagnostics

If you consent, we process limited technical usage and diagnostic data about how the App is used and performs so that we can identify technical problems and improve the App. You can withdraw your consent at any time in the App settings.

Email updates

If you consent to email updates, we process your email address and information needed to manage and document your subscription. You can withdraw your consent at any time using the unsubscribe function in our emails or the App settings.

Notifications and device permissions

If you enable notifications, we process a push token and your notification settings to send reminders or messages you select. Bluetooth is used to connect compatible devices. On some Android versions, the operating system may require location permission to discover nearby Bluetooth devices; the permission is requested for that technical purpose.

When you contact us

If you contact customer support or otherwise communicate with us, we process your contact details, the content of your request, information you choose to provide and technical information needed to review and respond to your request.

3. Legal bases in the EU / EEA and United Kingdom

We process the data needed to provide the App, your account and functions you request because this is necessary to perform our contract with you or take steps at your request (Art. 6(1)(b) GDPR / UK GDPR).

Where a requested function involves special categories of personal data, we additionally rely on your explicit consent (Art. 9(2)(a) GDPR / UK GDPR).

We process app analytics data on the basis of your consent (Art. 6(1)(a) GDPR / UK GDPR). Where applicable law requires consent to store information on or access information from your device, we obtain that consent in accordance with the applicable requirements.

We process data for email updates based on your consent (Art. 6(1)(a) GDPR / UK GDPR) and the applicable rules for electronic direct marketing.

Where your communication with us or customer care request relates to the App or your account, processing may be necessary to perform our contract with you. Otherwise, we rely on our legitimate interest in handling and responding to requests (Art. 6(1)(f) GDPR / UK GDPR).

For security and required technical logs, we rely on our legitimate interest in operating the App and accounts securely and reliably (Art. 6(1)(f) GDPR / UK GDPR).

We may process data where necessary to comply with legal obligations or to establish, exercise or defend legal claims. Where special categories of personal data are processed for legal claims, we rely on Art. 9(2)(f) GDPR / UK GDPR.

You can withdraw consent at any time with effect for the future. If a function requires the processing of special categories of personal data, withdrawing consent may mean that the function can no longer be provided.

Where personal data are required to provide an account or function you request, we may be unable to provide that account or function if you do not provide the data. Other information is voluntary.

4. Who receives your data?

Recipients may include Lovehoney Group companies and service providers that support hosting and cloud infrastructure, authentication, connected-device and backend functions, email delivery, App analytics and error diagnostics, customer support, security and IT. They may process personal data only for the relevant services and are subject to appropriate contractual and technical safeguards as required by law.

We may also disclose personal data to competent authorities or professional advisers where required by law or where necessary to establish, exercise or defend legal claims.

5. International data transfers

Lovehoney Group companies and service providers operate internationally, so personal data may be processed outside the country where you live. For transfers from the EU / EEA or the United Kingdom to countries without an applicable adequacy decision, we use appropriate safeguards where required, such as approved standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum. You can contact us for information about the safeguards applicable to a transfer.

For users in Canada, processing outside Canada may mean that personal data is subject to the laws of the country where it is processed. For users in Australia, overseas recipients may in particular be located in the EU, the United Kingdom or the USA.

6. How long do we keep your data?

We keep personal data only for as long as necessary for the purposes described in this Notice, taking into account the status of your account, applicable legal requirements, security needs and backup cycles. Account deletion initiates deletion of account-related App data, subject to limited backup periods and legal retention requirements. Consent records, security logs and support data may be retained for longer where necessary to demonstrate compliance, maintain security or handle legal claims. Marketing data is retained until you withdraw your consent or it is no longer needed for that purpose.

7. Your rights in the EU / EEA and United Kingdom

Subject to applicable law, you may request access to, correction or deletion of your personal data, restriction of processing and data portability, and you may object to processing based on legitimate interests. You may withdraw consent at any time with effect for the future. To exercise your rights, contact privacy@lovehoneygroup.com.

You also have the right to lodge a complaint with the competent data protection authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO).

8. Additional information for users in Switzerland

For users in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies. Subject to applicable law, you may in particular request information about your personal data and its correction or deletion and exercise other rights available to you under the FADP. To exercise your rights, contact privacy@lovehoneygroup.com. International processing is described in section 5 above.

9. Additional information for users in the USA

Depending on where you live, US state privacy laws may provide additional rights or require additional disclosures. Our US Supplemental Privacy Notice for SheHerMe explains the applicable state-specific information and how to exercise those rights. It is available from the Privacy section in the App and on our website.

Additional disclosures concerning consumer health data are provided in our Washington Consumer Health Data Privacy Policy, available from the Privacy section in the App and on our website.

10. Additional information for users in Canada

Applicable federal and provincial privacy laws may provide additional rights in relation to your personal data. Health, sexual and other intimate information, including relevant connected-device data, may be considered sensitive personal information. We obtain consent where required by applicable law.

Subject to applicable law, you may in particular request access to and correction of your personal data, withdraw consent with effect for the future and make a privacy complaint to us or the competent privacy authority. Contact privacy@lovehoneygroup.com. International processing is described in section 5 above.

11. Additional information for users in Australia

For users in Australia, health information and information about sexual practices are sensitive information under applicable law. We obtain consent where required. Subject to applicable law, you may request access to and correction of your personal information and make a privacy complaint to us.

Send requests and complaints to privacy@lovehoneygroup.com. We handle privacy complaints in accordance with applicable law. If you are not satisfied with our response, you may also contact the Office of the Australian Information Commissioner (OAIC).