Privacy Policy

1. WHO WE ARE (CONTROLLER)

Synden s.r.o.
Rybná 716/24
110 00 Praha 1
Czech Republic
IČO: 23005408
Email: [email protected]

We are the data controller responsible for the processing of your personal data on
VelvetCircle.com. For any questions or to exercise your rights, contact us at the
above email address.

No Data Protection Officer has been appointed, as this is not required under Art. 37
GDPR for our processing activities. Data protection inquiries may be sent to
[email protected].

2. WHAT DATA WE COLLECT AND WHY

We process the following categories of personal data for the stated purposes and on
the stated legal bases (Art. 6 and Art. 9 GDPR):

a) Account & identity data
(username, email address, hashed password, date of birth, gender, profile picture,
biography, interests, approximate location)
Purpose: To create and maintain your account and provide the platform service.
Legal basis: Performance of contract (Art. 6(1)(b) GDPR).

b) Sexual orientation and preferences
(where voluntarily provided as part of your profile)
Purpose: To enable matching and service functionality.
Legal basis: Explicit consent (Art. 9(2)(a) GDPR).
Note: This is special category data under Art. 9 GDPR. You may withdraw your
consent at any time by removing this information from your profile or deleting
your account.

c) Usage and technical data
(IP address, device and browser information, login timestamps, pages visited,
interactions such as messages, likes and profile visits)
Purpose: To operate, secure and improve the platform; fraud prevention; age
verification.
Legal basis: Performance of contract (Art. 6(1)(b) GDPR) and legitimate interests
(Art. 6(1)(f) GDPR — securing the platform and preventing abuse).

d) Communications data
(messages sent via the platform, support requests)
Purpose: To provide the messaging service and handle support.
Legal basis: Performance of contract (Art. 6(1)(b) GDPR).

e) Payment and billing data
(billing address, payment method, transaction history — where applicable)
Purpose: To process payments for premium features.
Legal basis: Performance of contract (Art. 6(1)(b) GDPR) and compliance with legal
obligations (Art. 6(1)(c) GDPR — accounting and tax retention requirements).

f) Marketing communications
(email address, usage preferences)
Purpose: To send newsletters, promotions and platform updates.
Legal basis: Your explicit consent (Art. 6(1)(a) GDPR). You may opt out at any time
via the unsubscribe link in any email or by contacting us.

g) Cookies and tracking data
See our separate Cookie Policy for full details.

3. WHO WE SHARE YOUR DATA WITH

We share your personal data only as necessary with the following categories of
recipients:

• Hosting and infrastructure providers — servers, databases, and cloud storage (EEA-based or Standard Contractual Clauses in place)
• Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France) — transactional and marketing email delivery. Brevo participates in the EU-US Data Privacy Framework. Privacy policy: brevo.com/legal/privacypolicy
• Sightengine — automated image moderation to detect and block prohibited content (e.g. nudity, illegal material) in photos uploaded by users. Processing is performed server-side only; no user data is stored beyond the moderation decision. Sightengine is US-based; transfers are governed by Standard Contractual Clauses (SCCs). Privacy policy: sightengine.com/privacy
• Didit.me — identity and age verification (KYC) provider. When you complete identity verification on the platform, your identity document and selfie are submitted to Didit.me for verification. Didit.me processes this data solely to confirm your identity and age. Privacy policy: didit.me/privacy
• Payment processors — where applicable, for processing payments for premium features (EEA-based or SCCs in place)
• Law enforcement or regulatory authorities — where required by applicable law

We do not use Google Analytics, Meta Pixel, or any other third-party analytics or advertising services.

All third-party processors are bound by Data Processing Agreements and may only process your data on our documented instructions.

We do not sell your personal data to third parties.

4. INTERNATIONAL DATA TRANSFERS

Where personal data is transferred to recipients outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, specifically:

• Standard Contractual Clauses (SCCs) approved by the European Commission, or
• Transfers to countries with an EU adequacy decision, or
• Participation in the EU-US Data Privacy Framework (where applicable).

Sightengine (image moderation) is based in the United States and processes data under Standard Contractual Clauses. Didit.me (identity verification) — please refer to their privacy policy for details on transfer mechanisms applicable to their service.

You may request information about specific transfer mechanisms by contacting us at [email protected].

5. HOW LONG WE KEEP YOUR DATA

We retain your personal data for the following periods:

• Account data: for the duration of your account, plus 30 days after deletion
  (to allow for reactivation requests and resolve pending disputes).
• Payment and billing data: 10 years from the date of the transaction, as required
  by Czech accounting law (zákon č. 563/1991 Sb.).
• Communications data: for the duration of your account.
• Security and fraud logs: up to 12 months from the date of recording.
• Marketing data: until you withdraw consent or opt out.

After the applicable retention period, data is securely deleted or anonymised.

6. YOUR RIGHTS UNDER GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): request a copy of your personal data.
• Right to rectification (Art. 16): request correction of inaccurate data.
• Right to erasure (Art. 17): request deletion of your data under certain conditions.
• Right to restriction of processing (Art. 18): request that we limit how we use
  your data.
• Right to data portability (Art. 20): receive your data in a structured,
  machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests or
  for direct marketing purposes.
• Right to withdraw consent (Art. 7(3)): withdraw any consent at any time, without
  affecting the lawfulness of prior processing.
• Right to lodge a complaint (Art. 77): file a complaint with a supervisory authority.

To exercise any of these rights, contact us at: [email protected]

We will respond within 30 days. No fee is charged unless the request is manifestly
unfounded or excessive.

7. RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with the competent supervisory authority:

Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
Email: [email protected]
Website: www.uoou.cz

You may also lodge a complaint with the supervisory authority in your country of
residence within the EU.

8. AUTOMATED DECISION-MAKING AND PROFILING

VelvetCircle.com uses algorithmic matching to suggest connections based on your
profile preferences and behaviour on the platform. This constitutes profiling within
the meaning of Art. 22 GDPR.

This automated processing does not produce legal effects or similarly significant
effects — it is a recommendation feature only. You remain free to ignore suggestions
and initiate connections independently.

You may object to this profiling at any time by contacting [email protected]. Upon
objection, your profile will be excluded from algorithmic matching.

9. MINORS

VelvetCircle.com is strictly for users aged 18 and over. We do not knowingly collect
personal data from persons under 18. If you believe a minor has registered, please
notify us immediately at [email protected] and we will delete the account without
undue delay.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in our practices or applicable
law. We will notify you of material changes via email or a prominent notice on the
platform at least 14 days before they take effect. The updated policy will always be
available at velvetcircle.com/privacy-terms.