Skip to content
Free UK delivery from €89 · 2-year guarantee · Damaged in transit? We send a new one

Privacy policy

Last updated: 20 October 2026.

1. Introduction

NEXUS SYNERGY - FZCO, which operates toveandco.com under the TOVE & CO brand, is committed to protecting the privacy of its users. This policy explains how we collect, use, store and protect your personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR, Regulation (EU) 2016/679) where it applies, and other applicable laws.

2. Data controller

  • Entity: NEXUS SYNERGY - FZCO
  • Address: IFZA Business Park, Dubai Silicon Oasis, Dubai, UAE
  • Email: hello@toveandco.com
  • UK representative (Article 27 UK GDPR): [To be completed: name and UK address of the representative]

3. Data we collect

3.1 Identification data: Surname, first name, email address, telephone number (optional), delivery and billing addresses, name of a gift recipient and the message attached.

3.2 Transaction data: Order details, purchase history, amounts, VAT country. Card details are processed directly by our payment providers (Stripe) and are never stored on our servers.

3.3 Browsing data: IP address, browser type, pages visited, length of visit. Your basket and delivery country are saved in your browser's local storage and only sent to us when you place an order (see the cookie policy).

3.4 Communication data: The content of your exchanges with our customer service (emails, contact and cancellation forms), and reviews left after delivery.

4. Purposes of processing

  • Fulfilling orders: Processing, preparation, delivery, invoicing and tracking
  • Customer relationship: Answering your requests, guarantee claims, returns, complaints
  • Marketing: Sending a monthly email, with your consent
  • Improving our services: Statistical analysis of visits to the website
  • Legal obligations: Keeping invoices and accounting and tax records (VAT by country)
  • Security: Preventing fraud and protecting the website

5. Lawful bases for processing

  • Performance of a contract: Processing your orders (Article 6(1)(b) UK GDPR)
  • Consent: Marketing, non-essential cookies (Article 6(1)(a))
  • Legitimate interests: Improving our services, preventing fraud (Article 6(1)(f))
  • Legal obligation: Accounting and tax records (Article 6(1)(c))

6. How long we keep your data

  • Customer data: 3 years after your last interaction with us
  • Order data and invoices: 10 years (accounting and tax obligations)
  • Browsing data: 13 months maximum
  • Marketing data: 3 years after the last contact, or until you withdraw your consent

7. Who receives your data

  • Our payment providers: Stripe (cards, Apple Pay, Google Pay)
  • Our logistics partners and carriers (name, address, telephone number, for delivery)
  • Our technical providers: Cloudflare (website), Hostinger (order data, European Union), Resend (transactional emails)
  • Where applicable, the review platform, to send you an invitation after delivery
  • Our audience measurement tools, with your consent where it is required

We never sell your personal data to third parties.

8. International transfers

Some of your data may be transferred outside the United Kingdom, in particular to the United Arab Emirates (registered office), to the European Union (order data hosting) and to the United States (technical providers). Transfers to the European Union are covered by UK adequacy regulations. Other transfers are protected by the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, by the UK Extension to the EU-U.S. Data Privacy Framework, or by other appropriate safeguards under the UK GDPR.

9. Your rights

Under the UK GDPR, you have the right of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw your consent at any time. To exercise them, contact us at hello@toveandco.com; we reply within one month. If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection authority, at ico.org.uk or on 0303 123 1113.

10. Security

We use appropriate technical and organisational measures to protect your data: TLS encryption, restricted access to data, regular backups and security updates.

11. Changes

We may update this policy. If we make a significant change, we will tell you by email or with a clear notice on the website.