Privacy Policy

Notice version v1.0-2026-10-17. Last updated: 17 October 2026.

1. Who is responsible (the data controller)

[TO CONFIRM before publication: legal entity name, trade name, registration number and registered address] ("Jovy", "we", "us") operates this website and the Jovy Merchants registration programme, and is the data controller for the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR).

Privacy contact: [TO CONFIRM: privacy contact email]. [TO CONFIRM before publication: add a postal address and, if one is appointed, Data Protection Officer contact details.]

2. Personal data we collect

• Registration of interest (merchant or creator form): your name, work email address, store or marketplace URL (or creator profile URL), the platform you use and the account type you choose — plus, only if you tick the separate optional box, your marketing preference together with the date and time you gave it and the version of this policy.
• Cookie consent: a random consent ID, your choices (essential, analytics, advertising), the decision type (accept all, reject optional or custom), the timestamp, the page URL and your browser's user-agent string. This is the evidence of which consent applies to you.
• Privacy requests: the name, email address, request type and any details you provide in the request form below.
• Technical data: when you use the site, our hosting platform processes standard technical logs (such as IP address, device and browser type and the pages you request) to deliver and secure the service. [TO CONFIRM: exactly what the hosting provider logs and for how long.]

We do not collect special categories of personal data, and we do not knowingly collect data from children.

3. Why we process it, and on what lawful basis

• Handling your registration and following up with next steps — performance of pre-contractual steps at your request (Article 6(1)(b) GDPR).
• Sending you marketing emails about Jovy Merchants — only with your consent, given through the separate, optional and unticked checkbox on the registration form (Article 6(1)(a)). Consent to marketing is never a condition for registering; you can withdraw it at any time (section 8).
• Analytics and advertising, including the Meta Pixel and Meta's Conversions API for our Instagram and Facebook campaigns — only with your consent via the cookie banner (Article 6(1)(a) GDPR and the ePrivacy rules). No non-essential technology is set or fired before you make that choice, and server-side events are sent only if you have consented.
• Keeping the service secure, evidencing your consent choices and complying with legal obligations — our legitimate interests and, where applicable, a legal obligation (Articles 6(1)(f) and 6(1)(c) GDPR).

4. Cookies and similar technologies

The categories and technologies we use are listed in our Cookie Policy. Non-essential technologies stay switched off until you allow them, and you can review or withdraw your choice at any time via "Cookie Settings" in the footer of every page.

5. Who we share data with (service providers)

We share personal data only with the processors and partners we actually use, under agreements that meet Article 28 GDPR. Currently:

• Hosting and application platform: [TO CONFIRM: Base44 — confirm the contracting entity, processing locations and data-retention terms.] It stores form submissions, consent records and privacy requests on our behalf.
• Meta Platforms (Meta Platforms Ireland Ltd. / Meta Platforms Inc.): when — and only when — you consent to advertising, the Meta Pixel (browser-side) and Meta's Conversions API (server-side) receive event data used to measure and deliver our Facebook and Instagram campaigns. Email addresses are irreversibly hashed before any server-side transfer.
• [TO CONFIRM: any other provider used for email delivery, analytics, CRM or campaign management — with its role and processing location.]

6. How long we keep data (retention)

We keep personal data only as long as necessary for the purposes above, after which we delete or anonymise it. The concrete periods must still be fixed and confirmed by Jovy before publication:

• Registration-of-interest records: [TO CONFIRM — for example, until the follow-up is completed plus a short buffer, or X months from our last contact with you.]
• Marketing-consent records and other consent evidence: [TO CONFIRM — for example, X years after consent is withdrawn, so that consent can still be demonstrated.]
• Privacy-request correspondence: [TO CONFIRM — for example, X years, as documentation that the request was handled.]

7. International data transfers

Where personal data is transferred outside the European Economic Area, Jovy ensures an appropriate safeguard applies. The following still need to be confirmed before publication:

• Where our hosting provider and other service providers store and process data: [TO CONFIRM].
• The transfer mechanism relied on for each provider: [TO CONFIRM — for example an EU adequacy decision, the EU Standard Contractual Clauses (with a transfer impact assessment), the UK Addendum where relevant, or participation in the EU–US Data Privacy Framework.]

8. Your rights

You have the right to:

• get a copy of your personal data (access);
• have incorrect data corrected;
• have your data erased (for example when it is no longer needed or you withdraw consent);
• restrict processing or object to it — including an unconditional right to object to direct marketing at any time, free of charge;
• receive your data in a portable, machine-readable format where technically applicable (portability);
• withdraw consent at any time — for marketing emails, analytics or advertising. Withdrawal does not affect processing that was lawful before it.

You can also lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement — for example the Autoriteit Persoonsgegevens in the Netherlands. We would, however, appreciate the chance to resolve any concern directly first.

9. How to exercise your rights

Use the request form below, or email [TO CONFIRM: privacy contact email]. We answer within one month of receiving your request and may ask for proof of identity where necessary to verify who you are. The form lets you request access, correction or deletion, or object to direct marketing and withdraw marketing consent.

10. Changes to this policy

We post any new version of this policy on this page with a new version number and date. The version recorded with your consent tells you which policy applied when you gave it.