Privacy notice: Purchase and withdrawal
As of 4 November 2026
This notice provides information on the processing of personal data when the paid test is purchased, in bookkeeping and when a withdrawal is declared. The carrying out of the test is governed by the privacy notice on participation.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Alpha 360 Omega GmbH
c/o Unicorn Workspace GmbH
Schlüterstraße 39
10629 Berlin
Germany
Telephone: +49 30 52006260
Email: hello@lovlov.co
2. Data protection officer
The controller has designated an external data protection officer, who can be contacted at datenschutz@lovlov.co; messages sent to this address are forwarded to the data protection officer unchanged.
3. Processing of your personal data
Section 6 applies to the exercise of your rights.
3.1 Order and payment
Description and scope of processing. Payment is processed via Stripe. The payment data (in particular card number and security code) is collected directly by Stripe and does not reach us. We process:
- the email address provided with the payment
- the service selected, the price and the time of the order
- an order reference and a payment reference
- the time at which the General Terms and Conditions were accepted
- the pseudonymous identifier of the participating person; together with the order reference, the service selected and the time at which the General Terms and Conditions were accepted, it is also transmitted to Stripe for the purpose of allocating the payment
We receive the email address and the payment reference from Stripe. The email address is stored in encrypted form and separately from the content of the test. The order confirmation, together with the General Terms and Conditions, is sent to the email address.
Purpose of processing. Conclusion and performance of the purchase contract, sending of the order confirmation and allocation of a later withdrawal.
Legal basis. Article 6(1)(b) GDPR.
Provision of data. Providing an email address is required for the conclusion of the contract. Without it, an order is not possible.
Storage period. The data processed for the performance of the contract, including the email address and the time at which the General Terms and Conditions were accepted, is erased as soon as it is no longer necessary for the performance and settlement of the contract, including a withdrawal and a chargeback, and in any event no later than 120 days after the purchase. Erased data remains in the backup copies of the database for up to seven days and is overwritten thereafter. The retention periods under Section 3.3 apply to the order confirmation as a commercial letter and to the order details as an accounting voucher.
3.2 Stripe: processing on our behalf and own responsibility
Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, processes personal data both on our behalf and as an independent controller. As a processor, Stripe executes payment transactions in accordance with our instructions. For its own purposes, Stripe processes data in particular for the selection of banks and payment service providers, for billing, for fraud detection and the prevention of financial loss, for compliance with its own anti-money laundering obligations and for the improvement of its own products and services. The processing under Stripe's own responsibility, its storage period and the exercise of your rights against Stripe are governed by Stripe's privacy policy (stripe.com/privacy).
The transmission to Stripe takes place on the basis of Article 6(1)(b) GDPR insofar as it is necessary for the execution of the payment, and on the basis of Article 6(1)(f) GDPR for fraud detection. The legitimate interest lies in preventing payment defaults and misuse.
3.3 Bookkeeping and retention
Description and scope of processing. Amount, date, tax, voucher number and payment reference are kept as an accounting voucher. The accounting voucher does not contain any content of the test.
Purpose of processing. Compliance with retention obligations under commercial and tax law.
Legal basis. Article 6(1)(c) GDPR in conjunction with Section 147 AO (German Fiscal Code) and Section 257 HGB (German Commercial Code).
Storage period. Accounting vouchers eight years, commercial and business letters received and sent six years. The period begins at the end of the calendar year in which the accounting voucher was created or the commercial or business letter was received or sent. The retention is extended insofar as and for as long as the documents are relevant for taxes for which the assessment period has not yet expired.
3.4 Withdrawal
Description and scope of processing. A withdrawal can be declared using the withdrawal function at lovlov.co/withdraw. The information identifying the contract, namely the receipt code from the order confirmation or the email address provided at purchase, the name of the declaring person if they so wish, the email address for the acknowledgement of receipt, the content, the date and the time of the declaration and the allocation to the order are processed. Providing the name is voluntary. The email address for the acknowledgement of receipt can be provided or confirmed. For the allocation, the receipt code or email address provided is compared with the order details under Section 3.1. Queries about the allocation are sent only to the email address provided at purchase. A withdrawal can also be declared by email to hello@lovlov.co or by other means. In the case of a withdrawal by email, the sender address and the content of the message are also processed. To protect the withdrawal function against misuse, attempts are counted for no longer than one hour by means of an irreversible value of the IP address.
Purpose of processing. Receipt, acknowledgement, allocation and handling of the withdrawal and proof of its receipt.
Legal basis. Article 6(1)(c) GDPR in conjunction with Sections 355 to 357 and 356a BGB (German Civil Code). For the retention of the declaration of withdrawal as a business letter, Article 6(1)(c) GDPR in conjunction with Section 257 HGB and Section 147 AO. For proof of receipt and the defence against claims, Article 6(1)(f) GDPR; the legitimate interest lies in the establishment, exercise or defence of legal claims. For protection against misuse, Article 6(1)(f) GDPR; the legitimate interest lies in the security of the withdrawal function.
Storage period. Declarations of withdrawal, together with the information provided with them, are retained in encrypted form as commercial or business letters for six years from the end of the calendar year of their receipt. Section 3.3 applies to an extension of the statutory retention. Declarations that cannot be allocated and are not subject to any statutory retention obligation are stored for three years from the end of the calendar year of their receipt as proof of receipt and for legal defence.
4. Recipients of personal data
The following recipients act as processors; Stripe is in addition an independent controller (Section 3.2).
| Recipient | Function | Place of processing | Basis for transfers to third countries |
|---|---|---|---|
| Stripe Payments Europe, Limited, Dublin, Ireland | Payment processing; also an independent controller (Section 3.2) | Ireland | standard contractual clauses (transfers within the Stripe group) |
| Hosting service provider | Hosting and delivery | Germany; logs and protection against overload attacks also in the USA | adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses |
| Database service provider | Database | Germany | standard contractual clauses |
| Key management service provider | Management of encryption keys | Germany | no transfer |
| Email delivery service provider | Sending emails | Ireland; metadata also in the United States | standard contractual clauses |
| Email service provider | Email mailbox | European Union; transfer to the United States possible | adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses |
| Accounting and tax advisory service providers | Accounting | Germany | no transfer |
In addition, data is transmitted to tax authorities where we are legally obliged to do so.
5. Transfers to third countries
When certain service providers are used, personal data may be transferred to servers in third countries outside the European Union, in particular to the United States. For the United States, an adequacy decision under Article 45(3) GDPR has applied since 11 July 2023 to providers certified under the EU-US Data Privacy Framework. Where a provider is not certified, the transfer is based on appropriate safeguards under Article 46(2)(c) GDPR (standard contractual clauses of the European Commission). The basis applicable to each recipient is set out in Section 4. You can request a copy of the standard contractual clauses at hello@lovlov.co.
Please note that a transfer to the United States involves risks despite an adequacy decision or standard contractual clauses. Providers of electronic communication services established in the United States are subject to surveillance by US intelligence services under 50 U.S. Code § 1881a (“FISA 702”) and may be obliged to make personal data available to US authorities. Under the CLOUD Act (18 U.S.C. § 2713), US security authorities are also entitled to access data of European companies whose parent companies are established in the United States.
6. Your rights
If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights against the controller:
Right of access (Article 15 GDPR). You have the right to obtain confirmation as to whether personal data concerning you is being processed. Where this is the case, you have the right to access this data and the following information: the purposes of processing; the categories of personal data; the recipients or categories of recipients; the envisaged storage period or the criteria used to determine it; the existence of the rights to rectification, erasure, restriction or objection; the right to lodge a complaint with the competent supervisory authority; where applicable, the source of the data; where applicable, the existence of automated decision-making including profiling; where applicable, the transfer to a third country.
Right to rectification (Article 16 GDPR). If your personal data is inaccurate or incomplete, you can request its rectification or completion without undue delay.
Right to restriction of processing (Article 18 GDPR). You can request the restriction of processing if you contest the accuracy of the data, for the period of verification; if the processing is unlawful and you request restriction instead of erasure; if we no longer need the data but you require it for the establishment, exercise or defence of legal claims; or if you have objected, pending verification whether our legitimate grounds override yours.
Right to erasure (Article 17 GDPR). You can request the erasure of your personal data without undue delay if the data is no longer necessary for the purposes for which it was collected; if you withdraw your consent and there is no other legal ground; if you have objected and there are no overriding legitimate grounds; if the data has been processed unlawfully; or if erasure is required to comply with a legal obligation. This does not apply to the extent that processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
Right to data portability (Article 20 GDPR). Where the processing is based on consent or a contract and carried out by automated means, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format or, where technically feasible, to have it transmitted to another controller.
Right to withdraw consent (Article 7(3) GDPR). You can withdraw consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
An informal message to hello@lovlov.co is sufficient to exercise your rights.
Right to object (Article 21 GDPR). You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR. Please send your objection to hello@lovlov.co.
7. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR (Article 77 GDPR). The supervisory authority competent for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59-61
10555 Berlin
Germany
www.datenschutz-berlin.de
8. Automated decision-making
No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.
Die verbindliche deutsche Fassung: Datenschutzhinweis auf Deutsch. Bei Abweichungen geht sie vor.