Privacy policy

1. Who we are

Velena Lifestyle is a UK social media marketing agency, user generated content studio and digital products store. Our website is velenalifestyle.com.

Item	Detail
Registered company	VELENA NIKOLOVA LIFESTYLE LIMITED
Trading as	Velena Lifestyle
Company number	14080048, registered in England and Wales
Registered office	The Pavilion, 4 The Pavilion, Lilys Walk, High Wycombe, England, HP11 2FX
We work from	High Wycombe, Buckinghamshire, United Kingdom
Data protection contact	[email protected]

For the purposes of UK data protection law, Velena Lifestyle is the data controller for the personal data described in this policy. We do not have a statutory Data Protection Officer, which is not required at our size, so questions come to the founders directly.

2. The data we collect and why

We collect only the personal data we need to run the business, answer you, and deliver what you asked for. The table sets out the categories, the purpose, and the lawful basis we rely on under UK GDPR.

Type of data	Why we use it	Lawful basis
Enquiry and contact details: name, email, business name, your message	To answer enquiries about social media management, UGC, web and influencer services, and to prepare quotes and proposals	Legitimate interests, and steps taken before entering a contract
Order and billing details: name, billing address, email, phone	To process and fulfil orders and to deliver services and digital products	Performance of a contract
Payment information	To take payment securely through our payment providers. We do not store full card numbers on this website	Performance of a contract, and legal obligation
Brief and project content: your product details, approved claims, brand assets, shipping details	To produce the content you ordered and to keep a record of what was agreed	Performance of a contract
Account details: name, email, username, order history	To run your customer account, where you create one	Performance of a contract, and legitimate interests
Marketing details: name, email	To send updates and offers where you have asked to hear from us	Consent
Comment details: name, email, website, IP address, browser information	To publish and moderate blog comments and to detect spam	Legitimate interests, and consent
Free tool inputs: what you enter, plus an email address if you ask for your results	To return your results and, where you ask, to follow up	Consent, and legitimate interests
Technical and usage data: IP address, device and browser, pages viewed	To keep the site secure, measure performance and improve what we publish	Legitimate interests, and consent for analytics

You do not have to give us personal data. If you do not, we may not be able to answer your enquiry, complete your order, or provide the service you asked for.

Media you upload

If you upload images to this website, avoid images carrying embedded location data. Visitors can download images and extract any location information held inside them.

3. Cookies

Cookies are small text files stored on your device. We use them to keep the site working, to hold your basket, to keep the site secure, and, with your agreement, to understand how the site is used.

Every cookie this site sets is listed by name, purpose and duration in the cookie policy, which also explains how to switch off the ones that are not essential. In short: no advertising or retargeting pixels run on this website, and analytics run only if you agree to them.

4. Embedded content from other sites

Pages here may include embedded content such as video. Embedded content behaves exactly as if you had visited the other website, and those sites may set cookies, collect data and monitor your interaction with that content.

Video on this site loads behind a still image and requests nothing from the video platform until you press play, so nothing is set unless you choose to watch.

5. Data we handle for our clients

This section matters if you are a customer or follower of a brand we work for, rather than a visitor to this site.

• When we manage a client's social channels, inbox or analytics, we see personal data belonging to that client's audience. For that data the client is the controller and we act as their processor. We use it only on their instructions and never for our own purposes.
• We do not export, copy or reuse audience data between clients, and we do not add it to any marketing list of ours.
• If you want your data removed from a brand's channel, the brand is the right place to ask, because they decide what happens to it. Tell us and we will pass it on the same day.
• Where a client needs a written data processing agreement, we put one in place on request.

6. Who we share your data with

We share personal data only with the providers that help us run the business, and only as far as needed.

• Hosting and infrastructure: our website host stores the site and its data.
• Content delivery and security: Cloudflare protects the site and keeps it fast.
• Payments: regulated payment providers process payments securely.
• Analytics: Google Analytics, where you have consented.
• Email and productivity: Google Workspace handles our email and enquiry correspondence.
• Spam protection and avatars: Automattic provides spam detection and the Gravatar service for blog comments. An anonymised hash of your email address may be sent to Gravatar to check whether you have an account there.
• Scheduling and delivery tools: the platforms we use to publish content and to share finished files with clients.
• Professional advisers and authorities: where we are legally required to disclose, or to take advice.

7. International data transfers

Some providers process data outside the United Kingdom, including in the United States. Where that happens we rely on appropriate safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement, or Standard Contractual Clauses, so your data keeps a similar level of protection.

8. How long we keep your data

• Enquiries: up to 24 months after our last contact, unless you ask us to delete sooner.
• Orders and accounting records: at least 6 years, as required by HMRC and UK tax law.
• Project files, including footage and briefs: 12 months after delivery, then deleted, unless a longer period is agreed.
• Customer accounts: until you ask us to close the account.
• Marketing: until you unsubscribe or ask us to stop.
• Blog comments: kept indefinitely, so follow up comments can be recognised and approved automatically rather than queued.

If you register on this website, your profile data is stored in your user profile. You can see, edit or delete it at any time, except your username. Site administrators can also see and edit it.

9. How we protect your data

We take reasonable technical and organisational measures: encrypted connections across the whole site, firewall and security protection through Cloudflare, access limited to the two founders, two factor authentication on the accounts that support it, and regular review of the providers we use.

No transmission over the internet is completely secure. If a breach occurred that was likely to risk your rights and freedoms, we would report it to the Information Commissioner's Office within 72 hours of becoming aware and tell you directly where the law requires it.

10. Automated decisions and profiling

We do not make decisions about you by automated means alone, and we do not profile you for advertising. Our free tools calculate a result from figures you enter, and that result is a calculation rather than a decision about you. Nothing on this site produces a legal or similarly significant effect automatically.

11. Your rights under UK GDPR

• Access: a copy of the personal data we hold about you.
• Rectification: correction of data that is wrong or incomplete.
• Erasure: deletion, where we are not required to keep it.
• Restriction: limiting how we use it.
• Portability: a copy in a portable format.
• Objection: objecting to processing based on our legitimate interests.
• Withdraw consent: at any time, where we rely on consent. Withdrawing is as easy as giving it.

Ask through the contact page or at [email protected]. We reply within one business day and answer fully within one month, which is the statutory deadline. There is no charge unless a request is manifestly unfounded or excessive.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

12. Marketing and unsubscribing

• We only email marketing to people who asked for it, or to existing customers about services similar to what they bought.
• Every marketing email carries an unsubscribe link, and unsubscribing takes effect immediately.
• Unsubscribing from marketing does not stop the emails we have to send about an order you placed.
• We do not add enquiry contacts to a marketing list simply because they asked us a question.

13. Children's privacy

Our services and content are for adults and are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, tell us and we will remove it.

Separately, we do not film children or produce content directed at children. That is set out in our terms and conditions.

14. Comments and the blog

When you leave a comment we collect the data shown in the comment form, plus your IP address and browser user agent string, to help with spam detection. Comments may be checked by an automated spam detection service.

15. Changes to this policy

We update this policy when our services, technology or the law change. Material changes are reflected in the version and date at the top of this page. Where a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you noticing.

16. How to contact us

Email [email protected] or use the contact page. We are High Wycombe, Buckinghamshire, United Kingdom and we reply within one business day.