Privacy Policy
VELUTTA LTD Last updated: July 17, 20261. Who We Are
This Privacy Policy explains how VELUTTA LTD (“Velutta”, “we”, “us”), a company incorporated in England and Wales with its registered office at 71-75 Shelton Street, London WC2H 9JQ, United Kingdom, collects, uses, shares, and protects personal data when you visit or use https://velutta.com. VELUTTA LTD is the data controller for the processing described in this Policy. Contact for all privacy matters: support@velutta.com (subject line: “Privacy Request”). We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018 (“UK GDPR”) and, where applicable to users in the European Economic Area, the EU GDPR. Sensitive context notice: Velutta is an adult entertainment platform. Your use of this website — including your account, viewing history, and purchases — may reveal information relating to your sex life or sexual orientation, which is special category data under Article 9 UK GDPR. We treat all user data with a correspondingly high standard of confidentiality and process it only as described in this Policy, on the basis of your explicit consent where required.2. What Data We Collect
a) Data you provide:- Account data: email address, username, password (stored hashed)
- Purchase data: subscription tier, transaction history. Payment card details are collected and processed directly by our payment processors; we do not store full card numbers.
- Communications: messages you send to support, complaints, and rights requests
- Age verification data: where required by law, confirmation of your age via our age assurance provider (see Section 6). We receive only the verification result (over/under 18), not your identity documents, unless stated otherwise at the point of collection.
- Technical data: IP address, browser type and version, device type, operating system, language settings
- Usage data: pages visited, content viewed, session duration, referral source
- Cookies and similar technologies (see Section 7)
3. Purposes and Legal Bases
| Purpose | Legal basis (Art. 6 UK GDPR) |
|---|---|
| Creating and managing your account; providing access to content | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and subscriptions | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax/accounting |
| Age verification | Legal obligation (Art. 6(1)(c)), including under the UK Online Safety Act 2023 |
| Processing data revealing your sex life or sexual orientation (e.g. viewing history linked to your account) | Explicit consent (Art. 9(2)(a)), given when you create an account and confirmed in your settings |
| Service improvement and aggregate analytics | Legitimate interests (Art. 6(1)(f)); consent for non-essential cookies |
| Marketing emails | Consent (Art. 6(1)(a)); you may withdraw at any time via the unsubscribe link |
| Fraud prevention, security, abuse prevention | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims; responding to lawful requests | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
4. Sharing of Data
We do not sell or rent personal data. We share data only with:- Payment processors — to process transactions; they act as independent controllers or processors under their own compliance frameworks. Transaction descriptors on your bank statement use a discreet billing name.
- Hosting, infrastructure, CDN, and IT security providers — under data processing agreements (Art. 28 UK GDPR).
- Age assurance providers — solely to verify age; we receive only the result.
- Analytics providers — only with your cookie consent; IP addresses are truncated or pseudonymised where technically feasible.
- Professional advisers, courts, regulators, and law enforcement — where disclosure is required by law, valid legal process, or necessary to establish, exercise, or defend legal claims.
5. International Transfers
Our servers and some service providers may be located outside the UK/EEA. Where personal data is transferred internationally, we use safeguards recognised under UK GDPR: UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or EU Standard Contractual Clauses, together with supplementary measures where appropriate. You may request details of the safeguards applicable to a specific transfer.6. Age Restriction and Age Assurance
This website is strictly for adults aged 18 or over. Where required by applicable law (including the UK Online Safety Act 2023), access to explicit content is gated behind age assurance performed by a specialist third-party provider. Age assurance is designed to be privacy-preserving: the provider confirms only whether you are over 18 and does not share your identity documents or biometric source data with us. Age verification results are stored only as long as necessary to evidence compliance. If we become aware that we hold data relating to a person under 18, we will delete it.7. Cookies
We use:- Strictly necessary cookies (login, session, security, age-gate status) — no consent required;
- Analytics and performance cookies — only with your consent;
- No third-party advertising or cross-site tracking cookies.
8. Your Rights
Under UK GDPR you have the right to:- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data (Art. 17), including deletion of your account and viewing history
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interests, and to direct marketing at any time (Art. 21)
- Withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7(3))
- Complain to the Information Commissioner’s Office (ico.org.uk) or, in the EEA, your local supervisory authority
9. Retention
We keep personal data only as long as necessary:- Account data: for the life of the account, then deleted or anonymised within 30 days of account closure, except where retention is legally required
- Transaction records: 6 years (UK tax and accounting law)
- Age verification results: for the period required to evidence regulatory compliance
- Support communications and rights requests: up to 3 years after resolution
- Security logs: up to 12 months
- Data relating to legal disputes: until the dispute and applicable limitation periods have concluded