Privacy notice: Taking part in lovlov
As of 4 November 2026
This notice provides information on the processing of personal data when the test is carried out, when taking part as a couple, in the personal area (Space) and for notifications. It is addressed to the participating person and to the person invited by them. Purchase and withdrawal are governed by the privacy notice on purchase and withdrawal.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Alpha 360 Omega GmbH
c/o Unicorn Workspace GmbH
Schlüterstraße 39
10629 Berlin
Germany
Telephone: +49 30 52006260
Email: hello@lovlov.co
2. Data protection officer
The controller has designated an external data protection officer, who can be contacted at datenschutz@lovlov.co; messages sent to this address are forwarded to the data protection officer unchanged.
3. Processing of your personal data
Section 3.10 and Section 6 apply to the exercise of your rights.
3.1 Special categories of personal data
The information provided in the test allows conclusions to be drawn about mental well-being and sex life. It constitutes special categories of personal data within the meaning of Article 9(1) GDPR. This data is processed only on the basis of explicit consent under Article 9(2)(a) GDPR in conjunction with Article 6(1)(a) GDPR. Consent is obtained separately before the first question on content. Without it, the test does not begin.
The content is held under a randomly generated identifier (pseudonym) and stored in encrypted form. The keys are managed separately from the content. This constitutes pseudonymisation within the meaning of Article 4(5) GDPR.
3.2 Information on the relationship phase
Description and scope of processing. Before consent is given, information on the phase of the relationship can be selected. This is a selection without free text. The information is stored exclusively in the browser's session storage and is not transmitted to us.
Purpose of processing. Adapting the way the user is addressed at the start of the test.
Legal basis. For storage in the browser, Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). For the processing, Article 6(1)(f) GDPR; the legitimate interest lies in adapting the way the user is addressed to the selected relationship phase.
Storage period. Until the end of the browser session.
3.3 Consent and record of consent
Description and scope of processing. The time, the confirmed version of the consent text, the type of consent and the confirmation of being at least 18 years old are stored. No IP address is stored in this context.
Purpose of processing. Demonstrating the consents given and withdrawn.
Legal basis. Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.
Storage period. Three years from the end of the calendar year in which the processing based on the consent ends. The record is retained without any link to the content of the test.
3.4 Test and evaluation
Description and scope of processing. The answers on the topics of the test, including free text entries, and the evaluation calculated from them according to fixed rules determined in advance are processed. For the purpose of allocation and to secure retrieval, the identifier (Section 3.1) and a marker relating to the sign-in method are stored in the local storage of the device. For the duration of the session, the selected variant, a code for accessing the result again and, when signing in, the sign-in link are also stored in the browser's session storage.
Purpose of processing. Creating and displaying the evaluation.
Provision of data. The provision of answers is neither required by law nor by contract. Without answers, no evaluation can be created.
Legal basis. Article 6(1)(a) and Article 9(2)(a) GDPR. For storing the items listed above in the local storage and the session storage of the browser, Section 25(2) no. 2 TDDDG.
Storage period. Without a personal area (Section 3.8), until the end of 90 days from the latest of the following points in time: start of the test, purchase, provision of the user's own result. Deletion takes place within twelve hours after the end of this period. With a personal area, until it is deleted.
3.5 Taking part as a couple
Description and scope of processing. The participating person can invite another person. The first name of the inviting person, the display name and pronoun of the invited person provided by the inviting person, and an invitation link are processed. No contact details of the invited person are collected; the inviting person passes on the link themselves. The link is valid for 30 days.
The invited person takes part in the test after giving their own consent. The answers of both persons on the shared topics are displayed to the other person only once both have answered and each has separately consented to their answers being shown to the other person.
Purpose of processing. Creating the invitation and the joint evaluation.
Legal basis. For the data of the inviting person, Article 6(1)(b) GDPR. For the display name and pronoun of the invited person, Article 6(1)(f) GDPR; the legitimate interest lies in providing the invitation requested by the inviting person. For displaying the answers to the other person, Article 6(1)(a) and Article 9(2)(a) GDPR on the basis of the separate consent of each person.
Source. The display name and pronoun of the invited person originate from the inviting person.
Recipients. Within the couple, the answers on the shared topics are displayed to the other person subject to the conditions set out above. Further recipients are set out in Section 4.
Storage period. As in Section 3.4. If the invited person does not join, the invitation and the pronoun are deleted as soon as no valid invitation link remains; the display name is deleted together with the other data of the inviting person. If either of the two persons withdraws their consent, the joint evaluation ends; the other person's own evaluation remains in place.
3.6 Estimating each other
Description and scope of processing. When inviting and when joining, each person can switch on the “Guess each other” feature. With this feature, each person estimates what the other needs on the shared topics, including intimacy. The inviting person can submit their estimate before the invited person joins; until the invited person joins, the estimate is attributed exclusively to the inviting person. When joining, the invited person is informed, before making their decision, that an estimate about them exists which may contain information about their sex life or their mental well-being, and decides on the feature themselves. The estimates are compared and displayed alongside the answers of the other person only if both persons have switched on the feature.
Purpose of processing. Comparing estimate and answer in the joint evaluation.
Legal basis. Article 6(1)(a) and Article 9(2)(a) GDPR on the basis of the consent of the estimating person; for the comparison and display, additionally on the basis of the consent of the person estimated.
Source. With regard to the estimate about the invited person: the inviting person.
Storage period. If either of the two persons does not switch on the feature, no estimate is compared and the estimate about the invited person is deleted when they join. If the feature is switched off later, the estimates of both persons are deleted. Otherwise as in Section 3.4.
Exercising your rights. The feature can be switched off at any time.
3.7 Exercises
Description and scope of processing. Exercises are offered on the results. Exercise answers are stored only with explicit consent and are displayed to the other person of the couple only if the participating person shares them and has separately and explicitly consented to this.
Purpose of processing. Storing and, on request, sharing the exercise answers.
Provision of data. The provision of exercise answers is neither required by law nor by contract.
Legal basis. Article 6(1)(a) and Article 9(2)(a) GDPR.
Storage period. As in Section 3.4. Sharing can be revoked at any time; the shared answers are then no longer displayed to the other person.
3.8 Personal area (Space) and renewed access
Description and scope of processing. The participating person can create a personal area. For this purpose, their email address is processed. It is stored as an irreversible value for login. If the personal area is created when taking part as a couple (Section 3.5), including before the invitation is sent, it is additionally stored in encrypted form for notifications (Section 3.9). For login, a link is sent that is valid for 15 minutes. Without a personal area, a link for accessing the result again can be generated, which is valid for as long as the result can be accessed. To protect against misuse, login attempts and attempts to access a result again are counted for no longer than one hour by means of an irreversible value of the IP address.
Purpose of processing. Setting up the personal area, login and renewed access to the results.
Provision of data. Providing the email address is voluntary. Without it, no personal area can be created.
Legal basis. Article 6(1)(b) GDPR. For protection against misuse, Article 6(1)(f) GDPR; the legitimate interest lies in the security of the login.
Storage period. The personal area, including all content and the email address, is deleted if it has not been used for twelve months; each use restarts this period. If an email address for notifications is stored, the deletion is announced by email 30 days and 7 days in advance. The participating person can delete the personal area themselves at any time or request its deletion by email to hello@lovlov.co. Erased data remains in the backup copies of the database for up to seven days and is overwritten thereafter.
3.9 Email notifications
Description and scope of processing. Only the following messages are sent to the email address provided: login links, the notification that the other person of the couple has answered, the confirmation of a requested notification, information on the personal area and on security, the announcement of a deletion under Section 3.8 and notifications of changes to the terms. No advertising is sent to this address. The messages do not contain any content of the test.
Without a personal area, an email address can be provided for a single notification. It is deleted when the person requests it or when taking part as a couple ends, and no later than 90 days after it was provided.
Purpose of processing. Delivery of the messages listed.
Legal basis. Article 6(1)(b) GDPR.
Provision of data. Providing an email address is voluntary. Without it, no notifications are sent.
Storage period. As in Section 3.8; an address for a single notification as set out above.
Exercising your rights. The deletion of the email address can be requested at any time by email to hello@lovlov.co.
3.10 Withdrawal of consent and deletion
Consent can be withdrawn at any time with effect for the future in the settings or by email to hello@lovlov.co. If consent to storage is withdrawn, the content concerned is deleted. If only the consent to sharing is withdrawn, the display to the other person ends. Switching off “Guess each other” is governed by Section 3.6. Content is deleted by destroying the associated key. Where content is necessary for the establishment, exercise or defence of a specific legal claim, it is retained subject to restriction of processing on the basis of Article 6(1)(f) in conjunction with Article 9(2)(f) GDPR until that claim has been finally resolved. The record of consent is governed by Section 3.3.
3.11 Origin of access
Description and scope of processing. When the test is started, the domain of the website from which access is made and the campaign parameters contained in the link (source, medium and name of a campaign) are stored together with the identifier (Section 3.1). The campaign parameters designate a campaign, not individual persons. The full address of the referring website is not stored.
Purpose of processing. Evaluation of the channels through which the test is used and purchases are made.
Legal basis. Article 6(1)(f) GDPR. The legitimate interest lies in the evaluation of these channels.
Provision of data. There is no statutory or contractual obligation to provide the data. The test can also be used without this information.
Storage period. As for the answers under Section 3.4.
Exercising your rights. You can object to the processing at any time under Article 21 GDPR (Section 6).
4. Recipients of personal data
The following recipients act as processors:
| Recipient | Function | Place of processing | Basis for transfers to third countries |
|---|---|---|---|
| Hosting service provider | Hosting and delivery | Germany; logs and protection against overload attacks also in the USA | adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses |
| Database service provider | Database | Germany | standard contractual clauses |
| Key management service provider | Management of encryption keys | Germany | no transfer |
| Email delivery service provider | Sending emails | Ireland; metadata also in the United States | standard contractual clauses |
| Email service provider | Email mailbox | European Union; transfer to the United States possible | adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses |
Further recipients are the other person of the couple under the conditions of Sections 3.5 to 3.7 and bodies to which there is a statutory disclosure obligation.
5. Transfers to third countries
When certain service providers are used, personal data may be transferred to servers in third countries outside the European Union, in particular to the United States. For the United States, an adequacy decision under Article 45(3) GDPR has applied since 11 July 2023 to providers certified under the EU-US Data Privacy Framework. Where a provider is not certified, the transfer is based on appropriate safeguards under Article 46(2)(c) GDPR (standard contractual clauses of the European Commission). The basis applicable to each recipient is set out in Section 4. You can request a copy of the standard contractual clauses at hello@lovlov.co.
Please note that a transfer to the United States involves risks despite an adequacy decision or standard contractual clauses. Providers of electronic communication services established in the United States are subject to surveillance by US intelligence services under 50 U.S. Code § 1881a (“FISA 702”) and may be obliged to make personal data available to US authorities. Under the CLOUD Act (18 U.S.C. § 2713), US security authorities are also entitled to access data of European companies whose parent companies are established in the United States.
6. Your rights
If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights against the controller:
Right of access (Article 15 GDPR). You have the right to obtain confirmation as to whether personal data concerning you is being processed. Where this is the case, you have the right to access this data and the following information: the purposes of processing; the categories of personal data; the recipients or categories of recipients; the envisaged storage period or the criteria used to determine it; the existence of the rights to rectification, erasure, restriction or objection; the right to lodge a complaint with the competent supervisory authority; where applicable, the source of the data; where applicable, the existence of automated decision-making including profiling; where applicable, the transfer to a third country.
Right to rectification (Article 16 GDPR). If your personal data is inaccurate or incomplete, you can request its rectification or completion without undue delay.
Right to restriction of processing (Article 18 GDPR). You can request the restriction of processing if you contest the accuracy of the data, for the period of verification; if the processing is unlawful and you request restriction instead of erasure; if we no longer need the data but you require it for the establishment, exercise or defence of legal claims; or if you have objected, pending verification whether our legitimate grounds override yours.
Right to erasure (Article 17 GDPR). You can request the erasure of your personal data without undue delay if the data is no longer necessary for the purposes for which it was collected; if you withdraw your consent and there is no other legal ground; if you have objected and there are no overriding legitimate grounds; if the data has been processed unlawfully; or if erasure is required to comply with a legal obligation. This does not apply to the extent that processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
Right to data portability (Article 20 GDPR). Where the processing is based on consent or a contract and carried out by automated means, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format or, where technically feasible, to have it transmitted to another controller.
Right to withdraw consent (Article 7(3) GDPR). You can withdraw consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
An informal message to hello@lovlov.co is sufficient to exercise your rights.
Right to object (Article 21 GDPR). You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR. Please send your objection to hello@lovlov.co.
To allocate a request, the identifier of the case, the email address provided or other suitable information can be provided. If allocation is not possible, the requesting person is informed of this where possible (Article 11(2) GDPR).
7. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR (Article 77 GDPR). The supervisory authority competent for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59-61
10555 Berlin
Germany
www.datenschutz-berlin.de
8. Automated decision-making
The evaluation is calculated according to fixed rules. It does not give rise to any decision producing legal effects or similarly significantly affecting you within the meaning of Article 22 GDPR.
Die verbindliche deutsche Fassung: Datenschutzhinweis auf Deutsch. Bei Abweichungen geht sie vor.