Privacy Policy

LOVEFUR PRIVACY POLICY Version 1.0 Effective Date: 25 August 2026 1. INTRODUCTION LoveFur respects your privacy and is committed to protecting personal data processed through the LoveFur service. This Privacy Policy explains how personal data is collected, used, stored, disclosed and protected when you use the LoveFur website, account, Pet profiles, LoveFur Tags, QR Codes and related services. LoveFur is a brand operated by F&F Recruitment Limited. This Privacy Policy is intended to provide information in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Maltese data protection law. 2. DATA CONTROLLER The data controller responsible for personal data processed through LoveFur is: F&F Recruitment Limited Malta Company Registration Number: C98457 VAT Number: 28050311 Registered Address: 12 J. F. Marks San Ġwann SGN 2211 Malta Email: info@lovefur.mt 3. PERSONAL DATA WE MAY COLLECT Depending on how you use LoveFur, we may process the following categories of information. 3.1 ACCOUNT INFORMATION This may include: - first name; - last name; - email address; - account identifier; - password authentication information handled through our authentication provider; - address; - telephone number; and - other account details you provide. 3.2 PET INFORMATION This may include: - Pet name; - species; - breed; - date of birth; - nickname; - description; - important information; - photographs; - Lost Pet Mode information; - vaccination information; - veterinary information; and - documents uploaded in connection with the Pet. Information about a Pet is not necessarily personal data by itself. However, Pet information may become personal data when it is linked to an identifiable person, such as the Pet's owner or another contact. 3.3 CONTACT INFORMATION FOR LOST PET MODE If you choose to make contact information available through Lost Pet Mode, LoveFur may process and display information such as: - owner name; - owner telephone number; - secondary contact name; - secondary contact telephone number; and - other information you choose to make publicly available. The account holder controls the relevant privacy settings. If you provide information relating to another person, such as a secondary contact, you should ensure that you are authorised to provide that information and that the person is appropriately informed. 3.4 VETERINARY AND VACCINATION DOCUMENTS LoveFur may allow you to store documents relating to your Pet's veterinary care and vaccinations. These documents may contain information relating to veterinary professionals, clinics or other individuals. You should only upload information that is relevant to the LoveFur service. You should not intentionally upload sensitive medical or health information relating to people unless it is genuinely necessary and lawful to do so. 3.5 PAYMENT AND TRANSACTION INFORMATION When payments are made through LoveFur, payment processing is provided by Stripe. LoveFur may receive and retain information relating to a transaction, including: - payment status; - transaction reference; - amount; - currency; - payment date; - LoveFur Tag associated with the transaction; and - other information required for accounting, support, fraud prevention or legal compliance. LoveFur does not need to store your complete payment card number in its own application database. 3.6 TECHNICAL AND SECURITY INFORMATION We may process technical information necessary to operate and protect the service, such as: - authentication information; - server logs; - IP address where generated by our infrastructure or service providers; - browser or device information; - security events; - error information; and - information necessary to prevent misuse, fraud or unauthorised access. 4. HOW WE COLLECT PERSONAL DATA We generally collect personal data directly from you when you: - create or activate a LoveFur account; - activate a LoveFur Tag; - create or edit a Pet profile; - upload photographs or documents; - activate Lost Pet Mode; - change privacy settings; - renew a LoveFur service; - communicate with LoveFur; or - otherwise use the service. Some information may be provided by another LoveFur account holder. For example, an account holder may provide details relating to a secondary contact. 5. PURPOSES AND LEGAL BASES FOR PROCESSING LoveFur processes personal data only where there is an appropriate legal basis. 5.1 PROVIDING THE LOVEFUR SERVICE We process information necessary to: - create and maintain accounts; - activate LoveFur Tags; - create and maintain Pet profiles; - operate permanent QR Codes; - provide Lost Pet Mode; - store Pet photographs; - store veterinary and vaccination records; - manage service periods and renewals; and - provide account functionality. The primary legal basis for this processing is the performance of a contract or taking steps at your request before entering into a contract, under Article 6(1)(b) GDPR. 5.2 PAYMENTS, ACCOUNTING AND LEGAL OBLIGATIONS We process transaction and accounting information where necessary to: - process or record payments; - maintain financial records; - comply with tax or accounting requirements; - respond to lawful requests; and - comply with other legal obligations. The legal bases may include Article 6(1)(b) GDPR and Article 6(1)(c) GDPR. 5.3 SECURITY, FRAUD PREVENTION AND SERVICE PROTECTION We may process information where reasonably necessary to: - protect accounts; - detect misuse; - investigate security incidents; - prevent fraud; - maintain service integrity; - enforce applicable terms; and - defend legal claims. Where applicable, this processing is based on our legitimate interests under Article 6(1)(f) GDPR. Our legitimate interests include protecting LoveFur, its users, its systems and its services against misuse and security threats. 5.4 SERVICE COMMUNICATIONS We may send communications necessary for operation of the LoveFur service, including: - account communications; - email verification; - security notices; - service information; - payment or renewal information; and - vaccination reminders where the relevant feature is enabled. Such communications are not marketing communications. The legal basis will normally be performance of the service contract or our legitimate interests in operating the service. 6. MARKETING LoveFur does not currently use account information to send promotional marketing communications. If LoveFur introduces optional marketing communications in the future, we will provide the required information and use an appropriate legal basis, including consent where required by law. Users will be provided with appropriate means to withdraw from optional marketing communications. 7. PUBLIC PET PROFILES AND QR CODES A LoveFur Tag contains a permanent QR Code associated with a permanent LoveFur public code. Anyone who scans the QR Code or otherwise obtains the public profile URL may be able to access information that you have chosen to make public. You are responsible for deciding what optional information you make publicly available through LoveFur. Lost Pet Mode may make additional contact information visible when you enable the relevant options. LoveFur is designed so that a person who finds a Pet may view the information made available by the account holder without receiving access to the account holder's private account. 8. PRIVACY SETTINGS LoveFur provides privacy controls for certain information associated with Pet profiles and Lost Pet Mode. You should review these settings carefully before making personal contact information public. Changing a privacy setting may change what information is immediately visible through the public LoveFur profile. 9. SERVICE PROVIDERS LoveFur relies on external service providers to operate the service. These may include: 9.1 SUPABASE Used for services including database infrastructure and authentication. 9.2 VERCEL Used for application hosting and delivery. 9.3 CLOUDFLARE Cloudflare Images is used to store and deliver certain public Pet images. 9.4 HETZNER Hetzner Object Storage is used to store certain private veterinary and vaccination documents. 9.5 RESEND Used to deliver service-related emails. 9.6 STRIPE Used to process payments and payment-related information. These providers may process personal data on our behalf or, for particular processing activities, under their own applicable terms and privacy obligations. We disclose only the information reasonably necessary for the relevant service. 10. INTERNATIONAL DATA TRANSFERS Some service providers may process information in countries outside Malta or outside the European Economic Area. Where personal data is transferred outside the European Economic Area and the GDPR requires safeguards, LoveFur will rely on an appropriate transfer mechanism as applicable. Such mechanisms may include: - an adequacy decision adopted by the European Commission; - Standard Contractual Clauses approved by the European Commission; or - another lawful transfer mechanism available under the GDPR. 11. DATA RETENTION LoveFur retains personal data only for as long as reasonably necessary for the purposes for which it was collected and as required by applicable law. 11.1 ACTIVE ACCOUNTS Account and Pet information is generally retained while the LoveFur account remains active or while it is required to provide the service. 11.2 ACCOUNT DELETION Users may delete their LoveFur account directly through the LoveFur platform. When an account is deleted, associated personal information and Pet profile information will be deleted, anonymised or otherwise handled in accordance with applicable data protection requirements. Public information belonging to the deleted account will no longer remain available merely because the physical LoveFur Tag and permanent QR Code continue to exist. The physical LoveFur Tag and its permanent public code may remain in the LoveFur system after account deletion. The Tag will no longer remain linked to the deleted account or Pet. The previous activation secret will not remain valid for reactivation. Previously deleted account or Pet information will not automatically be restored if the Tag later becomes eligible for a new activation. 11.3 LEGALLY REQUIRED RECORDS Certain information may be retained where necessary to comply with: - accounting requirements; - tax requirements; - legal obligations; - fraud prevention requirements; - dispute resolution; or - the establishment, exercise or defence of legal claims. Where possible and appropriate, retained records may be minimised, anonymised or separated from the deleted account. 11.4 SERVICE PROVIDER AND BACKUP RETENTION Deletion from the active LoveFur service does not necessarily mean that every residual copy disappears instantaneously from every technical system. Where backup or recovery systems are used, residual copies may remain temporarily until the relevant backup or retention cycle expires. Service providers may also retain information where independently required to do so by law. 12. ACCOUNT DELETION AND LOVEFUR TAGS Deleting a LoveFur account does not destroy or invalidate the physical LoveFur Tag itself or its permanent QR Code. When the account is deleted: - the Pet profile is removed; - personal information associated with the account is removed or otherwise handled according to applicable law; - the Tag is disconnected from the former account; - the Tag is placed into a revoked state; - the old activation secret becomes invalid; and - the permanent public LoveFur code may remain in the system. A revoked Tag may only become eligible for future activation through an authorised LoveFur process using a newly issued activation credential. Deleted information is not restored to a future account. 13. SECURITY LoveFur uses technical and organisational measures intended to protect personal data against: - unauthorised access; - unauthorised disclosure; - accidental loss; - alteration; - destruction; and - misuse. These measures may include authentication controls, access restrictions, encrypted communications and restricted private storage. No internet-based service can guarantee absolute security. 14. PASSWORDS AND AUTHENTICATION Users are responsible for keeping account credentials confidential. Passwords and authentication services are handled using LoveFur's authentication infrastructure. You should use a strong password and should not share your login credentials with another person. 15. ESSENTIAL COOKIES AND SIMILAR TECHNOLOGIES LoveFur may use cookies or similar browser technologies where necessary for: - authentication; - maintaining a signed-in session; - security; - user preferences; and - essential operation of the website. LoveFur does not currently use personal data for behavioural advertising or advertising profiling. Third-party services, such as payment providers, may operate their own websites or interfaces and may apply their own cookie and privacy practices. 16. AUTOMATED DECISION-MAKING LoveFur does not currently use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on users. If this changes, this Privacy Policy will be updated as required. 17. YOUR DATA PROTECTION RIGHTS Subject to the conditions and exceptions in applicable law, you may have the following rights under the GDPR: 17.1 RIGHT OF ACCESS You may request confirmation of whether we process your personal data and request access to that information. 17.2 RIGHT TO RECTIFICATION You may request correction of inaccurate personal data and completion of incomplete personal data. 17.3 RIGHT TO ERASURE You may request deletion of personal data in circumstances provided by the GDPR. The right to erasure is not absolute. Information may be retained where processing is necessary to comply with a legal obligation or for other grounds permitted by the GDPR. 17.4 RIGHT TO RESTRICTION You may request restriction of processing in circumstances provided by the GDPR. 17.5 RIGHT TO DATA PORTABILITY Where the GDPR requirements for data portability apply, you may request personal data you provided to us in a structured, commonly used and machine-readable format. 17.6 RIGHT TO OBJECT Where processing is based on legitimate interests, you may have the right to object to that processing on grounds relating to your particular situation. 17.7 RIGHT TO WITHDRAW CONSENT Where a particular processing activity is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. 18. HOW TO EXERCISE YOUR RIGHTS To exercise a data protection right or ask a privacy-related question, contact: F&F Recruitment Limited LoveFur Privacy Email: info@lovefur.mt We may need to verify your identity before fulfilling certain requests in order to protect account and personal information. Requests will be handled in accordance with the time limits and requirements established by applicable data protection law. 19. RIGHT TO COMPLAIN You have the right to lodge a complaint with the competent supervisory authority. In Malta, the supervisory authority is: Office of the Information and Data Protection Commissioner Malta Website: https://idpc.org.mt You may also have the right to contact another competent supervisory authority where applicable under the GDPR. 20. INFORMATION ABOUT OTHER PEOPLE If you provide personal information about another person through LoveFur, including a secondary contact, you should: - have an appropriate basis for providing that information; - ensure that the information is accurate; - inform the person that their information is being provided to LoveFur where appropriate; and - avoid making their information public without appropriate authority. 21. USER RESPONSIBILITY FOR UPLOADED CONTENT You are responsible for information and documents that you upload to LoveFur. You should avoid uploading unnecessary personal information about other individuals. You should not use LoveFur to store information that is unlawful, irrelevant to the service or that you do not have the right to provide. 22. CHANGES TO THIS PRIVACY POLICY LoveFur may update this Privacy Policy when necessary to reflect: - changes to the service; - changes to processing activities; - changes to service providers; - legal or regulatory requirements; or - security and operational developments. The current version and effective date will be made available through the LoveFur website. Where required by law, users will receive additional notice of material changes. 23. RELATIONSHIP WITH THE TERMS AND CONDITIONS This Privacy Policy explains how personal data is processed. Use of the LoveFur service is also governed by the applicable LoveFur Terms and Conditions. If there is any inconsistency concerning mandatory data protection rights, applicable data protection law will prevail. 24. CONTACT For questions about this Privacy Policy or the processing of personal data through LoveFur, contact: F&F Recruitment Limited LoveFur 12 J. F. Marks San Ġwann SGN 2211 Malta Email: info@lovefur.mt END OF PRIVACY POLICY