GDPR Notice for European Data Subjects
About this document
The General Data Protection Regulation entered into force on 25 May 2018 and remains the most influential data protection framework in the world. Its substantive provisions have been adopted, with adaptations, by the United Kingdom in the form of UK GDPR, by Switzerland in the form of the Federal Act on Data Protection, and by an increasing number of jurisdictions outside Europe in legislation modeled on its core architecture. This Notice describes how Since Love Jewelry, a U.S.-established controller, complies with these European frameworks in connection with the personal data of data subjects in the European Economic Area, the United Kingdom, and Switzerland.
The structure of GDPR is materially different from that of the California privacy framework. CCPA imposes specific disclosure and opt-out obligations on businesses, but does not require a particular legal basis for the processing itself. GDPR, by contrast, requires that every processing of personal data rest on one of six enumerated lawful bases, with the choice of basis determining many of the rights available to the data subject and the obligations applicable to the controller. This Notice therefore begins with the lawful bases rather than with the rights, because the lawful bases are the foundation on which the rights operate.
If at any point you would prefer to speak with a person rather than read further, our Privacy Lead at euprivacy@sincelovejewelry.com or privacy@sincelovejewelry.com is available to assist. The dedicated European address routes inquiries to the team member with primary responsibility for European data subject rights.
This Notice supplements our Privacy Policy with disclosures specific to the rights of data subjects in the European Economic Area, the United Kingdom, and Switzerland under the applicable data protection regulations of those jurisdictions. Where this Notice addresses a topic that is also addressed in the Privacy Policy, the Privacy Policy provides the general framework and this Notice provides the European-specific detail. Where the two documents differ in their treatment of a particular topic for European data subjects, this Notice controls.
Geographic Scope
This Notice applies to natural persons located in the European Economic Area (the 27 member states of the European Union together with Iceland, Liechtenstein, and Norway), the United Kingdom of Great Britain and Northern Ireland, and the Swiss Confederation. The applicable legal frameworks for each jurisdiction are: for the EEA, Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"); for the United Kingdom, the UK General Data Protection Regulation as supplemented by the Data Protection Act 2018 ("UK GDPR"); for Switzerland, the Federal Act on Data Protection of 25 September 2020 ("FADP"). The substantive provisions of these three frameworks substantially align, but they are administered by different supervisory authorities and contain certain jurisdiction-specific differences. Where this Notice references "GDPR," the corresponding provisions of UK GDPR and FADP apply equivalently to data subjects in the United Kingdom and Switzerland respectively unless this Notice expressly states otherwise.
Data Controller Identity
The data controller for personal data processed pursuant to this Notice is SoarNet LLC, a Wyoming limited liability company operating the Since Love Jewelry brand under license, with registered address at 30 North Gould Street, Suite 6362, Sheridan, Wyoming 82801, United States of America. SoarNet LLC determines the purposes and means of the processing of personal data described herein. SoarNet LLC has not appointed an EU representative under GDPR Article 27 because we do not currently maintain an establishment in the European Union; data subjects may contact us directly through the channels described in Section 8.
Data Protection Contact
Although Since Love Jewelry is not currently required by GDPR Article 37 to designate a Data Protection Officer, we maintain a dedicated privacy function and a Privacy Lead who is the primary point of contact for all data protection matters. The Privacy Lead may be contacted directly at privacy@sincelovejewelry.com for any matter relating to this Notice or to the processing of personal data of European data subjects. For matters specific to European data subjects, you may also use the dedicated address euprivacy@sincelovejewelry.com.
Every processing of personal data conducted by Since Love Jewelry in relation to European data subjects rests on one of the six lawful bases enumerated in GDPR Article 6. We do not engage in processing for which no lawful basis applies. The six bases are explained below, together with the specific business activities at Since Love Jewelry that rely on each. Where a single business activity may rely on more than one basis, we identify the primary basis and any secondary basis that supplements it. This section is the most important section of this Notice from a regulatory perspective; the operation of every other right described in subsequent sections depends on which lawful basis applies to the processing in question.
Consent
The data subject has given consent to the processing of personal data for one or more specific purposes. Consent must be freely given, specific, informed, and unambiguous, and may be withdrawn at any time without penalty.
Contract
Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
Legal Obligation
Processing is necessary for compliance with a legal obligation to which the controller is subject under EU or member state law (or, for U.S. operations, applicable federal and state law).
Vital Interests
Processing is necessary in order to protect the vital interests of the data subject or of another natural person. This basis applies in narrow emergency contexts only.
Public Interest
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This basis is generally relied upon by public authorities and is not applicable to commercial businesses.
Legitimate Interests
Processing is necessary for the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Subject to a balancing test.
Legitimate Interests Balancing Test
Where we rely on legitimate interests under Article 6(1)(f), we conduct a balancing test to determine whether our legitimate interests are overridden by the interests, rights, or freedoms of the data subject. The balancing test considers the nature of the legitimate interest, the necessity of the processing for that interest, the impact of the processing on the data subject, and the safeguards we have put in place to mitigate that impact. The summary below describes the balancing analysis for the principal categories of processing relying on legitimate interests.
- Fraud prevention and information security. The legitimate interest in protecting our business and our customers from fraud is substantial and is supported by recital 47 of the GDPR which expressly recognizes fraud prevention as a legitimate interest. The processing is limited to data necessary for fraud detection, retained only as long as necessary, and not used for any unrelated purpose. The impact on data subjects is minimal because the processing protects them as well as us. Balance: legitimate interests prevail.
- Analytics for service improvement. Our legitimate interest in understanding how our website and services are used in order to improve them is substantial and proportionate. We use first-party analytics with appropriate safeguards (IP truncation, aggregation, limited retention) and we honor opt-out signals. The impact on data subjects is minimal. Balance: legitimate interests prevail, subject to consent for non-strictly-necessary cookies.
- Retargeting and cross-context advertising. Our legitimate interest in reaching potential clients efficiently is substantial. However, the impact on data subjects of cross-context behavioral tracking is non-trivial, and the European data protection community has increasingly converged on the view that consent rather than legitimate interest is the appropriate basis for advertising-related cookies and tracking. We therefore do not rely on legitimate interests for cross-context behavioral advertising in the European context; in the EEA, UK, and Switzerland, we rely on consent obtained through our Cookie Preference Center.
- Defense of legal claims. The legitimate interest in retaining records necessary to defend against potential legal claims is recognized at GDPR recital 52 and is proportionate when limited to data actually relevant to potential claims and retained only for the applicable limitation period. Balance: legitimate interests prevail.
GDPR Articles 13 and 14 require that we provide data subjects with specific information about the personal data we collect, including the categories of data, the sources, the purposes, the legal bases, the retention periods, and the recipients. The disclosures below address each of these required elements. Where information is identical to the information provided in our CPRA Notice Section 2, we maintain consistency between the two documents; the principal addition in the European context is the explicit identification of the lawful basis for each processing activity.
Categories of Personal Data Collected
The categories of personal data we collect from European data subjects are substantially identical to those collected from data subjects in other jurisdictions. The categories include identifiers (name, email, postal address, phone number, online identifiers, account credentials), customer records (billing address, shipping address, transaction history), demographic data where voluntarily provided (age range, anniversary date), commercial information (browsing activity, purchases), internet and network activity (IP address, device information, server logs), approximate geolocation derived from IP address, sensory data limited to recorded customer service interactions where you have consented to recording, professional information for corporate account inquiries where applicable, and inferences derived from your interactions with our Services. We do not collect biometric data of European data subjects. Education data is collected only in the employment context and is exempt from this Notice.
Sources of Personal Data
Personal data is collected directly from you when you create an account, place an order, contact customer service, register for a virtual consultation, or otherwise interact with our Services. Personal data is also collected automatically from your device when you visit our website (cookies, pixels, server logs). In limited cases, we receive personal data from third parties: from financing partners where you elect financing for a purchase, from social-login providers where you choose to use one, and from referral partners where you arrive at our Services through a referral. We do not purchase personal data from data brokers and we do not receive personal data from sources to which you have not directed disclosure or whose disclosure to us is not contractually authorized.
Purposes and Lawful Bases
The principal purposes for which we process personal data of European data subjects, paired with the lawful basis applicable to each, are as follows: account creation, order processing, payment, shipping, custom commission consultation, and warranty service rely on contract under Article 6(1)(b). Tax record retention, accounting, sanctions screening, and regulatory compliance rely on legal obligation under Article 6(1)(c). Marketing email subscriptions, optional cookie consent, and virtual consultation recording rely on consent under Article 6(1)(a) and may be withdrawn at any time. Fraud prevention, information security, first-party analytics, and defense of legal claims rely on legitimate interests under Article 6(1)(f), subject to the balancing analysis described in Section 2 and to your right to object. Cross-context behavioral advertising relies on consent obtained through our Cookie Preference Center, in alignment with the regulatory consensus described in Section 2.
Categories of Recipients
The categories of recipients to whom we may disclose personal data of European data subjects include service providers acting as processors (payment processors, shipping carriers, hosting providers, email platform, customer service tools), advertising and analytics partners (Meta, Google, TikTok, Pinterest, Shopify marketing integrations, where you have consented to advertising cookies), professional advisors (legal counsel, accountants, tax advisors), regulatory and tax authorities where required by law, and parties to whom you specifically direct disclosure. The complete recipient categories are described in our Privacy Policy Section 5. All processors handling personal data on our behalf are bound by data processing agreements meeting the requirements of GDPR Article 28.
Retention Periods
Personal data is retained for the period necessary to fulfill the purposes for which it was collected, subject to legal retention requirements and the limitation periods applicable to potential claims. Active account data is retained for the duration of your account plus seven years following deactivation, reflecting the seven-year statute of limitations applicable to many commercial claims and the general tax recordkeeping requirement. Marketing consent data is retained until consent is withdrawn or three years after your last interaction with our Services, whichever is shorter. Customer service correspondence is retained for one year unless related to an unresolved matter. Cookie-specific retention periods are inventoried in our Cookie Policy. Where you exercise the right to erasure under Article 17, we delete personal data within thirty days unless a legal retention obligation requires continued retention of specific data.
GDPR Articles 15 through 22 establish eight rights of the data subject. The rights are independent of one another; you may exercise any one without exercising the others, and the procedures for exercising each are described in Section 8. The summary cards below provide an at-a-glance map of all eight rights, the corresponding GDPR Article, and the substantive scope of each right. UK GDPR and FADP provide substantively equivalent rights with minor variations addressed in Section 9.
Right of Access
Obtain confirmation of whether personal data concerning you is being processed and, if so, access to that data together with the information specified in Articles 13 and 14.
Right to Rectification
Obtain rectification of inaccurate personal data and completion of incomplete personal data, including by means of a supplementary statement.
Right to Erasure
Obtain erasure of personal data ("right to be forgotten") where the data is no longer necessary, consent has been withdrawn, you object, or the data has been unlawfully processed. Subject to limited exceptions.
Right to Restriction
Obtain restriction of processing where the accuracy is contested, the processing is unlawful but you oppose erasure, the data is no longer needed but you require it for legal claims, or you have objected pending verification.
Right to Portability
Receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and transmit that data to another controller. Applies to data processed on the basis of consent or contract.
Right to Object
Object to processing based on legitimate interests or public interest, on grounds relating to your particular situation. Absolute right to object to processing for direct marketing purposes.
Automated Decisions
Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. Subject to limited exceptions. See Section 7 for our position.
Withdraw Consent
Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal. Withdrawal must be as easy as giving consent.
As an entity established outside the European Union, Since Love Jewelry transfers personal data of European data subjects to its place of establishment in the United States and, for certain processing activities, to its atelier in Shenzhen, People's Republic of China. These transfers are subject to GDPR Chapter V, which prescribes the safeguards required for transfers to third countries that have not received an adequacy decision from the European Commission. The mechanisms we rely upon for each transfer flow are described below.
The principal data transfer flow involves personal data collected from European data subjects being transferred to SoarNet LLC in Wyoming, United States, where our principal data processing infrastructure is located. The United States does not benefit from a comprehensive adequacy decision from the European Commission, although the EU-U.S. Data Privacy Framework provides a sectoral adequacy mechanism for U.S. companies that have self-certified to the Framework. SoarNet LLC has not currently self-certified to the EU-U.S. Data Privacy Framework; we therefore rely on alternative safeguards.
The principal safeguard for transfers from the EEA to the United States is the Standard Contractual Clauses (SCCs) adopted by the European Commission in Decision (EU) 2021/914 of 4 June 2021. We have implemented Module One (controller-to-controller) and Module Two (controller-to-processor) SCCs as appropriate for each transfer flow. For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) adopted by the UK Information Commissioner's Office, or alternatively the UK International Data Transfer Addendum incorporating the EU SCCs. For transfers from Switzerland, we rely on the SCCs as adapted for Swiss law in accordance with FDPIC guidance.
In addition to the contractual safeguards, we conduct transfer impact assessments in line with the European Data Protection Board's Recommendations 01/2020 on supplementary measures, considering the laws and practices of the destination country and implementing supplementary technical, organizational, and contractual measures where necessary.
Limited categories of personal data are transferred to our atelier in Shenzhen, China, for the specific purpose of fulfilling custom commission orders. The data transferred is restricted to the information necessary to manufacture the specific piece (design specifications, sizing data, inscription content where applicable) and excludes broader account data, payment information, or marketing-related data. The atelier does not maintain a copy of the data beyond the period necessary to complete manufacturing.
The People's Republic of China does not benefit from an adequacy decision from the European Commission. We rely on the Standard Contractual Clauses (Module Two, controller-to-processor) as the contractual safeguard for these transfers. We have conducted a transfer impact assessment for the China transfer flow, considering the Personal Information Protection Law (PIPL) of the People's Republic of China, the access rights of Chinese authorities, and the contractual and technical safeguards applicable to the specific data flow. Supplementary measures applied include data minimization, purpose limitation, encryption in transit and at rest, and contractual prohibition on the atelier's onward transfer of the data to any third party.
For transfers to processors located in third countries other than those described above, we rely primarily on Standard Contractual Clauses where the destination country has not received an adequacy decision, and on the relevant adequacy decision where one applies. Adequacy decisions currently in force for major destination countries include the United Kingdom, Switzerland, Israel, Canada (for commercial activities), Japan, and the Republic of Korea. Where data is transferred to a country covered by an adequacy decision, no additional safeguards beyond ordinary contractual protections are required under Chapter V.
GDPR Article 9 establishes special protections for "special categories of personal data," sometimes referred to as "sensitive personal data." These categories include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person's sex life or sexual orientation. Processing of these categories is generally prohibited unless one of the specific exceptions enumerated in Article 9(2) applies.
Special Categories We Do Not Process
Since Love Jewelry does not collect, process, or maintain special categories of personal data of European data subjects in the ordinary course of business. We do not collect or process: racial or ethnic origin (except as may be incidentally revealed in voluntary photographs you may share with us), political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, data concerning health, or data concerning sex life or sexual orientation. Where any of the above might be voluntarily provided in correspondence with us, we do not deliberately retain or process it as such, and we do not use it for any decision-making about your engagement with our Services.
If Special Categories Are Inadvertently Provided
If you voluntarily provide special categories of personal data to us — for example, by including health information in customer-service correspondence, or by referring to religious significance of a piece in a custom commission consultation — we will treat that information with appropriate confidentiality. The lawful basis for any processing of voluntarily-provided special categories would be your explicit consent under Article 9(2)(a), or, where applicable, the establishment, exercise, or defense of legal claims under Article 9(2)(f). Such information will not be used for advertising, profiling, or any purpose unrelated to the immediate matter to which it pertains.
Children's Personal Data
GDPR Article 8 provides specific protections for children's personal data in connection with information society services offered directly to children. Our Services are not directed to children, and we do not knowingly collect personal data from children under the age of sixteen (the threshold may be reduced to thirteen by member state law in certain EEA jurisdictions). If we learn that we have inadvertently collected personal data from a child below the applicable age threshold, we will delete that data within thirty days. To request deletion of any personal data we may have inadvertently collected from a child, contact our Privacy Lead at privacy@sincelovejewelry.com.
GDPR Article 22 provides data subjects with the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects the data subject. Profiling is defined in Article 4(4) as any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person. The provisions of Article 22 are subject to limited exceptions where the automated decision is necessary for entering into or performing a contract, authorized by EU or member state law, or based on explicit consent.
Our Position on Automated Decision-Making
Since Love Jewelry does not engage in automated decision-making producing legal effects or similarly significantly affecting data subjects. We do not use algorithmic systems to determine eligibility for our Services, to set individualized pricing, to deny service, or to make any other decision about a data subject's relationship with us that would fall within the scope of Article 22. The pricing of our products is uniform; the availability of our services is uniform; the terms applicable to one client are the terms applicable to every client. There is no algorithmic decision in this process that would trigger Article 22.
Profiling for Marketing Purposes
We do engage in profiling for marketing purposes, in the limited sense that we use information about your interactions with our Services (pages viewed, products examined, items saved) to deliver more relevant marketing communications. This profiling does not produce legal effects or similarly significantly affect you; it does not determine pricing, availability, or any service-related outcome, and it can be opted out of at any time through the mechanisms described in our Interest-Based Advertising Statement. Where you have consented to marketing communications, the profiling activities described in this paragraph are conducted on the basis of that consent under Article 6(1)(a); where you object to such profiling under Article 21, we will cease the activity for direct marketing purposes immediately.
Automated Fraud Detection
Our payment processing and fraud-prevention systems include automated checks that may flag certain transactions for additional review. These automated checks are not solely automated decision-making within the meaning of Article 22 because they trigger human review rather than automatic decline. A transaction flagged as potentially fraudulent is reviewed by a member of our team, who makes the final determination based on additional context. Where a transaction is declined for fraud-prevention reasons, you have the right to request human re-review and to contest the determination through customer service. The lawful basis for the automated component of fraud detection is legitimate interests under Article 6(1)(f), as described in Section 2.
The procedures for exercising your rights under GDPR, UK GDPR, and FADP are designed to be accessible through multiple channels, with response timelines aligned to the GDPR statutory maximum of one month from receipt with a possible two-month extension for particularly complex requests. The descriptions below cover submission channels, identity verification, response timeline, and your right to lodge a complaint with a supervisory authority.
Submission Channels
You may exercise any right described in this Notice through any of the following channels: email to euprivacy@sincelovejewelry.com (preferred for European data subjects) or privacy@sincelovejewelry.com with a clear statement of which right you are exercising and the scope of your request; the embedded form on our Do Not Sell or Share My Personal Information page (this form serves European data subjects exercising rights related to objection and consent withdrawal in the advertising context, in addition to its primary California function); telephone to +1 (307) 263-8735 during boutique business hours (Tuesday through Saturday, 11:00 to 19:00 PT, which is 19:00 to 03:00 CET / UTC+1 the following day); written request to SoarNet LLC, Attn: Privacy Lead, 30 North Gould Street, Suite 6362, Sheridan, Wyoming 82801, USA. We do not currently maintain an EU representative under GDPR Article 27; submissions should be made through one of the channels above.
Identity Verification
To protect your personal data, we will verify your identity before processing requests under Articles 15, 16, 17, 18, or 20. The verification standard is calibrated to the sensitivity of the request and the nature of the personal data involved. For most requests, verification is satisfied by matching the email address from which the request is submitted to the email address associated with your account or transactions. For requests involving particularly sensitive information, we may require additional verification such as confirmation of recent transaction details. We will not request information beyond what is reasonably necessary for verification, and we will not use information provided for verification for any other purpose.
Response Timeline
We commit to the following response timelines, aligned to GDPR Article 12. Acknowledgment within five business days of receipt. Substantive response within one month of receipt for the substantial majority of requests; we may extend this period by up to two further months where necessary, taking into account the complexity and number of requests, and we will inform you of any such extension within the first month together with the reasons for the delay. Our standard service level is to complete most requests within fifteen business days of acknowledgment, well within the statutory envelope. Information provided in response to your request is provided free of charge in accordance with Article 12(5); we may charge a reasonable fee or refuse to act only where requests are manifestly unfounded or excessive, particularly because of their repetitive character.
Format of Response
Responses are provided in writing, in the language in which the request was made where this is one of the principal European languages we operate in (English, German, French, Italian, Spanish), or in English where the request was made in another language. Where you have requested information in electronic form and have not requested a different format, the information is provided in a commonly used electronic format. For requests under Article 20 (data portability), data is provided in a structured, commonly used, machine-readable format.
Refusal and Right to Complain
In limited circumstances we may be unable to fully comply with a request — for example, where the right does not apply to the specific data (such as a request for portability of data not covered by Article 20), where compliance would prejudice another data subject's rights, where compliance would prejudice the establishment, exercise, or defense of legal claims, or where a specific exception under GDPR applies. In such cases, we will explain in writing the reasons for the refusal or partial refusal, the limited exceptions on which we rely, and your right to lodge a complaint with a supervisory authority and to seek a judicial remedy. The supervisory authorities and the procedure for lodging a complaint are described in Section 9.
Under GDPR Article 77, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the member state of habitual residence, place of work, or place of the alleged infringement, if the data subject considers that the processing of personal data relating to them infringes GDPR. Under Article 79, every data subject has the right to an effective judicial remedy where they consider that their rights under GDPR have been infringed as a result of the processing of personal data in non-compliance with the Regulation. The contact details for the principal supervisory authorities for European data subjects of Since Love Jewelry are listed below.
European Data Protection Board (EDPB)
The EDPB is the European Union body that ensures consistent application of the GDPR across all 27 EU member states plus Iceland, Liechtenstein, and Norway. The EDPB website provides a complete directory of all EEA supervisory authorities with contact information and complaint-lodging procedures for each member state, including all EEA jurisdictions not individually listed below. For data subjects in member states not listed below, the EDPB directory is the recommended starting point.
Open EDPB Members DirectoryOne-Stop-Shop Mechanism
For controllers established in the European Union with cross-border processing, GDPR provides a "one-stop-shop" mechanism whereby a single lead supervisory authority handles complaints from data subjects across all member states. Since Love Jewelry is established in the United States, not the European Union, and is therefore not subject to the one-stop-shop mechanism; data subjects may lodge complaints with the supervisory authority in their member state of habitual residence, of place of work, or of the alleged infringement, without needing to identify a "lead authority." We will engage with whichever authority receives the complaint, in the manner described below.
Cooperation with Supervisory Authorities
Since Love Jewelry cooperates with supervisory authorities in good faith. We respond to formal inquiries within the timeframes specified by the inquiring authority, we provide requested information promptly, and we implement remediation measures where deficiencies are identified. Pursuing a complaint with a supervisory authority does not preclude continued direct communication with our Privacy Lead, and we welcome the opportunity to address concerns directly even where a regulatory complaint has been filed.
Right to Effective Judicial Remedy
In addition to lodging a complaint with a supervisory authority, GDPR Article 79 provides every data subject with the right to an effective judicial remedy where they consider that their rights have been infringed as a result of processing in non-compliance with GDPR. Such proceedings may be brought before the courts of the member state where you have your habitual residence or where the alleged infringement took place. The arbitration provisions of our Terms and Conditions do not preclude or limit your right to seek judicial remedy under GDPR Article 79, nor your right to lodge a complaint with a supervisory authority under Article 77.