Privacy Policy

This translation is provided for information purposes only. In the event of any discrepancy, the French version shall prevail.

1. Introduction

This Privacy Policy describes how VELVET (hereinafter ‘we’, ‘our’, ‘the Site’) collects, uses, retains and protects the personal data of its users (hereinafter ‘you’ or ‘the user’).

VELVET undertakes to process your personal data transparently, confidentially and securely, in accordance with the revised Federal Act on Data Protection (FADP), which entered into force on 1 September 2023, and, for users residing in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679).

2. Controller

Controller:
Business name: Velvet
Legal form: Sole proprietorship
Person responsible: Dany Varone
Address: PO Box, 1971 Grimisuat, Switzerland
Business identification number (UID): CHE-385.675.745
Contact email: [email protected]

VELVET acts as controller for all data collected on its site and through its services.

For any question relating to the protection of your data, you can contact our dedicated team at: [email protected]

3. Data collected

VELVET applies the principle of data minimisation and collects only the data strictly necessary for the proper functioning of its dating service and for improving the user experience.

3.1 Data provided directly by the user

• Identification data: surname, first name, date of birth, gender
• Contact data: email address
• Profile data: profile photos, personal description, dating preferences (gender sought, age range, desired location)
• Communication data: messages exchanged with other members, messages to support
• Verification data: verification selfie and, where applicable, a copy of an identity document (processed and deleted within a maximum of 30 days after validation)
• Payment data: processed directly by our payment service provider (CCBill); VELVET does not store any complete bank details

3.2 Data collected automatically

• IP address (anonymised for analytics processing)
• Type of device, browser, operating system
• Time zone and browser language
• Browsing and activity data on the Site (pages viewed, profiles visited, interactions)
• Cookies and similar technologies (see our Cookie Policy: https://velvet-dating.ch/politique-de-cookies/)

3.3 Pre-registration for the new platform

Before the new platform opens, you can pre-register on the public website. We then collect the following data: email address, first name, year of birth, gender, gender sought, town or city, and language of the site.

This data is used solely to prepare your account and to inform you of the opening of the platform.

The following consents are collected and recorded separately, with their date and version, together with the truncated IP address and the type of browser, in order to keep proof of them:

• acceptance of the terms of use and of this policy, with the declaration that you are aged 18 or over;
• agreement to receive an email when the platform opens;
• optional agreement for VELVET to use your gender and the gender sought in order to prepare your affinities (sensitive data, see section 5).

Pre-registration is validated only once your address has been confirmed via a link sent by email (double opt-in). Unconfirmed pre-registrations are deleted 30 days after they are submitted.

Every email contains an unsubscribe link. If you request the deletion of your data, we retain only a hash of your email address (calculated using the SHA-256 algorithm), in a suppression list, in order to comply with your request: no longer to write to you and not to re-import your data.

4. Purposes and legal bases of processing

No data is used for targeted advertising purposes without your prior explicit consent. Your data is never resold or transferred to third parties for commercial purposes.

5. Sensitive data

As a dating service, VELVET is required to process data regarded as sensitive within the meaning of the FADP and the GDPR, in particular data relating to sexual orientation and relationship preferences.

The processing of this sensitive data is based on your explicit consent, collected separately and specifically at registration. At pre-registration, this consent covers the use of your gender and the gender sought in order to prepare your affinities; it is optional. You may withdraw this consent at any time from your account settings. Withdrawal of consent will result in the deactivation of the personalised suggestion features, without affecting access to the other features of the service.

6. Data retention

Personal data is retained in accordance with the following principles:

Once these periods have elapsed, the data is deleted or irreversibly anonymised.

The user may request the early deletion of their account and data at any time (see section 8).

7. Data sharing

VELVET does not resell or rent your data to third parties.

Certain data may be shared with the following categories of recipients, in strict compliance with the principle of minimisation:

• Hosting provider: Hostinger International Ltd. (Cyprus) – hosting of the server, located in France (Paris), which hosts the public website, its content management system (CMS), the application and the database (Supabase, installed on that same server, with no additional provider)
• Payment service provider: CCBill (United States) – secure processing of transactions (PCI-DSS certified)
• Email delivery: Resend (Plus Five Five, Inc., United States) – sending of transactional emails, for example the pre-registration confirmation
• Anti-bot protection: Cloudflare, Inc. (United States), Turnstile service – protection of the pre-registration form against bots
• Analytics, only with your consent: Microsoft Corporation (United States), Microsoft Clarity service – analysis of the use of the public website (pages viewed, clicks, scrolling)
• Advertising measurement, only with your consent: Meta Platforms Ireland Ltd. (Ireland), Meta pixel – measurement of the effectiveness of our advertising campaigns
• Competent authorities: where there is a legal obligation or a court decision, or for the prevention of criminal offences

Microsoft and Meta receive no data until you have accepted the corresponding cookie category (‘Analytics’ or ‘Marketing’). You may withdraw your agreement at any time via the ‘Manage my cookies’ link at the bottom of the page.

All processors are subject to data processing agreements (DPAs) compliant with the FADP and the GDPR, including confidentiality clauses and security obligations.

8. Your rights

In accordance with the FADP and the GDPR, you have the following rights:

• Right of access: to obtain confirmation that your data is being processed and to receive a copy of it
• Right to rectification: to correct inaccurate or incomplete data
• Right to erasure (right to be forgotten): to request the deletion of your data, subject to statutory retention obligations
• Right to restriction: to restrict processing in certain circumstances
• Right to data portability: to receive your data in a structured, commonly used and machine-readable format (JSON or CSV). This feature is available from your account settings (‘Export my data’ section)
• Right to object: to object to processing based on legitimate interest
• Right to withdraw consent: to withdraw your consent at any time, without affecting the lawfulness of prior processing

How to exercise your rights:

• By email: [email protected]
• Via your account settings for the export and deletion of data

Any request will be dealt with within a maximum of 30 days. In the case of a complex request, this period may be extended by 60 days, in which case you will be informed within the initial 30-day period.

If you consider that your rights are not being respected, you have the right to lodge a complaint with:

• the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland: https://www.edoeb.admin.ch/
• the competent supervisory authority in your EU/EEA Member State (for example the CNIL in France: https://www.cnil.fr/)

9. Automated decisions and recommendation algorithms

VELVET uses recommendation and artificial intelligence algorithms to suggest compatible profiles on the basis of your preferences and your activity.

This automated processing:

• does not produce legal effects concerning you,
• does not restrict your freedom to use the service,
• does not constitute high-risk profiling within the meaning of the FADP.

You may:

• request information on the general logic of these algorithms at [email protected],
• deactivate personalised suggestions from your account settings,
• withdraw your consent to the processing of your sensitive data by the algorithms (see section 5).

10. Data security

VELVET implements state-of-the-art technical and organisational security measures:

• Encryption in transit: SSL/TLS protocol for all communications between your browser and our servers
• Encryption at rest: sensitive data stored on our servers is encrypted (AES-256)
• Passwords: hashed using the bcrypt algorithm; VELVET never stores passwords in plain text
• Access control: access to data limited to authorised personnel only, with access logging
• Anomaly detection: monitoring of suspicious logins (inconsistent geolocation, multiple login attempts)
• Automatic deletion: automated mechanisms for purging expired data

VELVET carries out data protection impact assessments (DPIAs) for processing that presents a high risk, in accordance with Art. 22 FADP and Art. 35 GDPR.

11. Notification of data breaches

In the event of a personal data breach likely to result in a risk to the rights and freedoms of the data subjects:

• VELVET notifies the FDPIC as soon as possible (in accordance with Art. 24 FADP) and, where applicable, the competent European supervisory authority within 72 hours (in accordance with Art. 33 GDPR).
• The users concerned are informed by email and by notification on the Site as soon as possible, with an indication of:
  • the nature of the breach,
  • the categories of data concerned,
  • the likely consequences,
  • the measures taken or proposed to remedy it,
  • the recommendations to follow to protect their data (change of password, etc.).

12. International data transfers

Users’ data is hosted on a server located in the European Union, in France (Paris) (via Hostinger).

Certain third-party providers (in particular CCBill, Resend and Cloudflare, as well as Microsoft and Meta if you have accepted the corresponding cookies) may process data in countries outside Switzerland and the EU/EEA. In that case, VELVET ensures that appropriate safeguards are put in place:

• Transfer to a country recognised as offering an adequate level of protection by the Swiss Federal Council and/or the European Commission,
• Failing that, the conclusion of standard contractual clauses (SCCs) approved by the European Commission,
• Or any other transfer mechanism compliant with the FADP and the GDPR.

For Microsoft (Microsoft Clarity) and Meta (Meta pixel), which are involved only with your consent, data may be transferred to the United States. These transfers are governed by the standard contractual clauses and, where the recipient is certified under it, by the Data Privacy Framework between Switzerland and the United States and between the European Union and the United States.

The list of countries recognised as adequate is available on the FDPIC website: https://www.edoeb.admin.ch/

13. Cookies and trackers

The Site uses cookies and similar technologies. The use of these technologies is governed by our separate Cookie Policy, available at: https://velvet-dating.ch/politique-de-cookies/

No non-essential cookie is placed without your prior consent, collected via our cookie management banner.

With your consent only, the public website uses an analytics tool (Microsoft Clarity) and an advertising measurement tool (Meta pixel). Without your agreement, neither of these tools is loaded. You may withdraw your agreement at any time via the ‘Manage my cookies’ link at the bottom of the page.

14. External links

The Site may contain links to third-party websites. VELVET is not responsible for the privacy practices, content or security of those external sites. We recommend that you consult the privacy policies of the sites you visit via these links.

15. Protection of minors

The VELVET service is strictly reserved for adults (aged 18 and over). VELVET does not knowingly collect personal data from minors. If we discover that a minor has registered, their account will be immediately deleted and their data erased.

16. Changes to this policy

VELVET reserves the right to amend this Policy at any time in order to remain compliant with the legislation in force or to improve the transparency of data processing.

In the event of a substantial change, users will be informed by email and/or by notification on the Site at least 15 days before the new provisions enter into force.

The most recent version is always available at: https://velvet-dating.ch/politique-de-confidentialite/

17. Contact

For any question relating to this policy or to the management of your data:

VELVET – Data Protection Department
Person responsible: Dany Varone
Email: [email protected]
Address: PO Box, 1971 Grimisuat, Switzerland
Business identification number (UID): CHE-385.675.745