GDPR Statement

1. Scope

This GDPR Statement applies to individuals located in the European Union or the United Kingdom who use Lovelio or whose personal data is processed through the platform, including job applicants. It supplements our Privacy Statement, which applies to all users of the platform globally.

2. Data controller and processor

The role of Lovelio Pty Ltd under GDPR is context-dependent:

Platform users (businesses): Lovelio Pty Ltd acts as the data controller in respect of the personal data of business users who register for Lovelio, including names, email addresses, billing information, and usage data.

Job applicants: Where employers use Lovelio to manage recruitment, the employer is the data controller for applicant personal data, and Lovelio Pty Ltd acts as the data processor on their behalf. Applicants should direct data subject requests to the relevant employer in the first instance.

3. Lawful bases for processing

Under GDPR, all processing of personal data must be founded on a lawful basis. The following table sets out the relevant processing activities, the data involved, and the applicable lawful basis:

4. Data retention

Personal data is retained only for as long as is necessary for the purposes for which it was collected, or as required by applicable law:

• Account data is retained for the duration of the account relationship and for a reasonable period thereafter to address any outstanding matters.
• Financial and transactional records are retained for the period required under applicable tax legislation, typically seven years.
• Analytics data is retained in anonymised or aggregated form following the expiry of the relevant retention period.
• You may request erasure of your personal data at any time, subject to applicable legal obligations.

5. International data transfers

Lovelio is a global platform and personal data may be transferred to and processed in jurisdictions outside the European Economic Area (EEA) or the United Kingdom. Such transfers may occur in connection with the following:

• Cloud infrastructure providers hosting the platform.
• Our payment processing provider.
• Our transactional email delivery provider.
• Our web analytics provider.

For all international transfers, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms under UK GDPR, to ensure that your personal data is afforded a level of protection equivalent to that required under applicable data protection law.

6. Your rights under GDPR

As a data subject under GDPR or UK GDPR, you are entitled to exercise the following rights:

Right of access: Request a copy of the personal data we hold about you.

Right to rectification: Request correction of inaccurate or incomplete personal data.

Right to erasure: Request deletion of your personal data, subject to applicable legal obligations.

Right to restrict processing: Request that we limit the processing of your data in certain circumstances.

Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format.

Right to object: Object to processing based on legitimate interests, including for direct marketing purposes.

Right to withdraw consent: Withdraw consent at any time where processing is carried out on the basis of consent.

Rights regarding automated decisions: Request human review of any decision made solely by automated processing that significantly affects you.

To exercise any of the above rights, please contact us at hello@lovelio.ai. We will respond within 30 days of receipt. We may be required to verify your identity before processing your request.

7. Data processing agreements

Where a business uses Lovelio to process personal data on behalf of employees, candidates, or other individuals, Lovelio Pty Ltd acts as a data processor under GDPR. You, as the employer, are required to have a Data Processing Agreement (DPA) in place with us.

To request a DPA, please contact us at hello@lovelio.ai.

8. Cookies and tracking

We use cookies and similar technologies for authentication, analytics, and platform functionality. In accordance with UK and EU ePrivacy requirements, non-essential cookies are only placed where you have provided your consent via the cookie preference mechanism on the platform.

Cookie preferences may be managed at any time through the platform's cookie banner or through your browser settings.

9. AI and automated processing

Lovelio employs proprietary AI technology to assist users in generating job advertisement drafts. Such processing is based solely on content provided by the user, such as role descriptions and requirements, and does not involve the processing of applicant personal data. All AI-generated content is subject to human review prior to publication. No automated decisions with legal or similarly significant effects are made in respect of job applicants without human involvement.

10. Complaints

If you consider that we have not handled your personal data in accordance with applicable law, we encourage you to contact us in the first instance at hello@lovelio.ai so that we may seek to resolve the matter.

If you remain dissatisfied following our response, you have the right to lodge a complaint with the relevant supervisory authority:

EU users: Your national Data Protection Authority (DPA). A full list of EU supervisory authorities is available at edpb.europa.eu.

UK users: The Information Commissioner's Office (ICO) at ico.org.uk.

11. Amendments

This GDPR Statement will be reviewed and updated as necessary to reflect changes in our processing activities or applicable law. Material changes will be communicated by email or via an in-platform notice prior to taking effect.

12. Contact

For GDPR-related queries, rights requests, or to obtain a Data Processing Agreement, please contact:

Lovelio Pty Ltd

Email: hello@lovelio.ai