Privacy policy

Velena Lifestyle is a UK social media marketing agency, user generated content studio and digital products store. Our website is velenalifestyle.com.

For the purposes of UK data protection law, Velena Lifestyle is the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer, and we are not required to. Under UK GDPR article 37 one is needed by a public authority, or where an organisation's core activities consist of regular and systematic monitoring of people on a large scale, or of large-scale processing of special category data or of data about criminal convictions and offences. Ours do not. Questions about your data come straight to the founders.

We collect only the personal data we need to run the business, answer you, and deliver what you asked for. The table sets out the categories, the purpose, and the lawful basis we rely on under UK GDPR.

You do not have to give us personal data. If you do not, we may not be able to answer your enquiry, complete your order, or provide the service you asked for.

Media you upload

If you upload images to this website, avoid images carrying embedded location data. Visitors can download images and extract any location information held inside them.

Cookies are small text files stored on your device. We use them to keep the site working, to hold your basket, to keep you signed in and to keep the site secure.

Every cookie this site sets is listed by name, purpose and duration in the cookie policy, which also explains your choices. In short: no advertising or retargeting pixels run on this website, and counting visits uses no cookie at all (section 3). When we run adverts, their cookies are set only with your consent, which you give or refuse in the strip at the bottom of the page and can change on the cookie choices page.

Pages here may include embedded content such as video. Embedded content behaves exactly as if you had visited the other website, and those sites may set cookies, collect data and monitor your interaction with that content.

Video on this site loads behind a still image and requests nothing from the video platform until you press play, so nothing is set unless you choose to watch.

The booking calendar works the same way: it is loaded from our booking provider only when you press "Book a free call".

This section matters if you are a customer or follower of a brand we work for, rather than a visitor to this site.

When we manage a client's social channels, inbox or analytics, we see personal data belonging to that client's audience. For that data the client is the controller and we act as their processor. We use it only on their instructions and never for our own purposes.

We do not export, copy or reuse audience data between clients, and we do not add it to any marketing list of ours.

If you want your data removed from a brand's channel, the brand is the right place to ask, because they decide what happens to it. Tell us and we will pass it on the same day.

Where a client needs a written data processing agreement, we put one in place on request.

We share personal data only with the providers that help us run the business, and only as far as needed.

• Hosting and infrastructure: our website host stores the site and its data.
• Content delivery and security: Cloudflare protects the site, keeps it fast, and tells us the place a visit comes from (section 3).
• Payments: Stripe and PayPal, which are regulated payment providers, process payments securely.
• Our email lists: Brevo sends our monthly emails and the basket reminder, and holds the two lists.
• Bookings: TidyCal holds the calendar for free calls.
• Email and productivity: Google Workspace handles our email and enquiry correspondence.
• Scheduling and delivery tools: the platforms we use to publish content and to share finished files with clients.
• Our own business system: enquiries and sales figures are also kept in the internal system we run the company with, on infrastructure we rent.
• Professional advisers and authorities: our accountant, and anyone else where we are legally required to disclose, or to take advice.

If you request a password reset, your IP address is included in the reset email.

Some providers process data outside the United Kingdom, including in the United States and the European Union. Where that happens we rely on UK adequacy regulations or on appropriate safeguards, such as the UK International Data Transfer Agreement or Standard Contractual Clauses, so your data keeps a similar level of protection.

If you are outside the United Kingdom, your data is sent to the United Kingdom, where we work, and to the providers described above.

• Enquiries: up to 24 months after our last contact, unless you ask us to delete sooner.
• Orders and accounting records: at least 6 years, as required by HMRC and UK tax law.
• Digital product orders: the billing country, the card country and the download records are part of the order and are kept for the same period.
• Project files, including footage and briefs: 12 months after delivery, then deleted, unless a longer period is agreed.
• Customer accounts: until you ask us to close the account.
• Marketing: until you unsubscribe or ask us to stop.
• Visit information: the detail of visits is kept for 25 months, so that one year can be compared with the one before. After that only totals remain. The pages tied to an enquiry, an order, a sign-up or a booking are kept as long as that enquiry, order, subscription or booking.
• Bookings: up to 24 months after our last contact.
• A tool or quiz result you asked for by email: the result itself is deleted once it has been sent. If you ask for a result by email and do not join our list, we keep your address for 30 days, then delete it.
• A basket you left: 30 days.

If you register on this website, your profile data is stored in your user profile. You can see, edit or delete it at any time, except your username. Site administrators can also see and edit it.

We take reasonable technical and organisational measures: encrypted connections across the whole site, firewall and security protection through Cloudflare, access limited to the people on our team who need it for their work, two factor authentication on the accounts that support it, and regular review of the providers we use.

No transmission over the internet is completely secure. If a breach occurred that was likely to risk your rights and freedoms, we would report it to the Information Commissioner's Office within 72 hours of becoming aware and tell you directly where the law requires it.

We do not make decisions about you by automated means alone, and we do not profile you for advertising. Our free tools and quizzes calculate a result from what you enter, and that result is a calculation rather than a decision about you. Nothing on this site produces a legal or similarly significant effect automatically.

• Access: a copy of the personal data we hold about you.
• Rectification: correction of data that is wrong or incomplete.
• Erasure: deletion, where we are not required to keep it.
• Restriction: limiting how we use it.
• Portability: a copy in a portable format.
• Objection: objecting to processing based on our legitimate interests.
• Withdraw consent: at any time, where we rely on consent. Withdrawing is as easy as giving it.
• Marketing: you can always object to marketing, and we will stop.

Ask through the contact page or at [email protected]. We reply within one business day and answer fully within one month, which is the statutory deadline. There is no charge unless a request is manifestly unfounded or excessive.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

If you live outside the United Kingdom, you keep any rights the data protection law of your own country gives you, and you may complain to the authority there.

• We have two lists, one for brands and one for creators. You choose which one on the form. We never guess, and you can be on both.
• You join only by ticking a box that is never ticked in advance, and then by clicking the link in one confirmation email.
• We send about one email a month, and at most two seasonal offers a year.
• Every marketing email carries an unsubscribe link, and unsubscribing takes effect immediately.
• If you ticked the box to hear from us and then leave something in your basket, we send one reminder a day later, and never a second one. We do this with your consent, and you can withdraw it through the link in that email.
• Unsubscribing from marketing does not stop the emails we have to send about an order you placed.
• We do not add enquiry contacts to a marketing list simply because they asked us a question.
• A tool or quiz result you ask for by email is sent whether or not you tick the box. Only those who tick it join a list.

Our services and content are for adults and are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, tell us and we will remove it.

A digital product can be bought only by someone aged 18 or over. A parent or guardian may buy for a younger creator, and in that case the order holds the adult's details, not the child's.

Separately, we do not film children or produce content directed at children. That is set out in our terms and conditions.

We update this policy when our services, technology or the law change. Material changes are reflected in the version and date at the top of this page. Where a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you noticing.

Email [email protected] or use the contact page. We are in High Wycombe, Buckinghamshire, United Kingdom and we reply within one business day.