Privacy Policy.

1. Who is responsible for your information?

LARA MEDIA GROUP LTD, company number 13952247, is the controller of personal information used to operate The VOU and deliver purchases made from us.

Registered office: 167-169 Great Portland Street, London W1W 5PF, United Kingdom.

Operating and contact office: 4 Maddox Street, International House, Floor 6, London W1S 1QP, United Kingdom.

Privacy contact: [email protected]. You can use this address to ask about your information, exercise a data-protection right or make a privacy complaint. You can also contact us by post at our operating and contact office.

2. The information we use

• Contact and account details: your name, email address, account information and any telephone number or postal address that is needed for the interaction or purchase.
• Orders and payments: the purchase, amount, payment status and references needed to process the order, provide support and keep accounting records. Payment-card information is handled by our payment processor, Stripe; we do not store full card details ourselves.
• Messages and preferences: enquiries, customer-support correspondence, newsletter permission and marketing choices.
• Styling-service information: photographs, measurements, clothing preferences and the personal context you choose to provide for the agreed service, together with the resulting styling reports.
• Quiz information: responses, results and any related history recorded by the quiz or account feature you use. The collection or saving method can differ between quiz features; see the information supplied with that feature.
• Website and security information: information such as IP address, device and browser details, request logs and activity needed to operate or protect the website. Optional analytics can record information about website use where you allow it.

We obtain information directly from you and from the systems that deliver the website, process payments and record the interaction. Please do not include unrelated sensitive information in an enquiry or send full payment-card details by email. Where a form marks a field as required, it is needed to handle that request; optional fields need not be completed.

Quizzes can calculate indicative styling results automatically from your answers. This is separate from the human-delivered personal styling service. The verified-email face-shape quiz saves answers and result history to provide the result you request and keep that history together under your verified email address. Verification confirms access to the mailbox, not your legal identity, and requesting a result does not subscribe you to marketing emails.

3. Photographs, sensitive information and human styling

Your styling photographs, measurements and reports are stored using Google Cloud Storage and Amazon S3, with primary storage configured in UK regions. Authorised human stylists, including subcontractors working for LARA/The VOU, use the information needed to carry out your service. LARA remains responsible for the service and its use of your information.

We do not send customer styling photographs, measurements or reports to AI tools for analysis or automated styling. Your styling service is performed by people.

Photographs and measurements are personal information, but are not automatically special-category biometric information merely because they show your face or body. They may nevertheless reveal protected information, such as health or racial or ethnic origin. Where the agreed styling service requires us to process special-category information, we rely on your explicit consent in addition to the applicable ordinary lawful basis.

We explain the information needed and seek the necessary consent before collecting it. You can withdraw that consent by contacting us. Withdrawal does not affect earlier lawful processing, but may prevent us from completing a part of the service that genuinely requires that information; we will explain the options rather than treat withdrawal as an automatic loss of consumer rights.

If photographs include another person, provide them only where you are entitled to do so. Contact us before providing a child's information so that the purpose, appropriate permissions and necessary safeguards can be established.

4. Why we use information and our lawful bases

• To arrange and fulfil a purchase or requested styling service: necessary information is used to take steps at your request before a contract and to perform the contract. Special-category processing for a styling service also requires the explicit consent described above.
• To process payment and maintain accounting records: contract performance for payment and legal obligation for records required by tax or accounting law.
• To respond to enquiries and provide support: contract performance where the request concerns your purchase; otherwise our legitimate interest in responding to people who contact us and resolving questions.
• To provide requested quiz results and history: our legitimate interests in delivering the quiz feature you request, keeping its result history together and protecting access through mailbox verification. This is separate from permission for promotional emails.
• To operate and protect the website and accounts: our legitimate interests in providing a reliable service, protecting access, preventing fraud and misuse, and investigating technical or security problems. Those interests must be balanced against your rights.
• To send the newsletter: your permission. You can unsubscribe or withdraw consent without having to close an account or stop using other services.
• To use optional website analytics: your analytics consent under our current privacy controls.
• To handle complaints, rights requests and legal obligations: legal obligation where the law requires the activity; our legitimate interests in resolving disputes and establishing, exercising or defending legal claims where appropriate.

We use information for the stated purpose and only the amount necessary for it. Where we rely on legitimate interests, you can ask about the interest and object on grounds relating to your situation. The right to object to direct marketing is not subject to that balancing exercise.

Information needed to perform a contract or meet a legal obligation cannot always be deleted simply by withdrawing marketing or analytics consent. We will explain any applicable requirement when responding to your request.

5. Who receives information?

We do not sell your personal information. Access or disclosure is limited to what is needed for the purpose. Recipients can include:

• Our authorised staff and subcontracted human stylists carrying out your service.
• Google Cloud Storage and Amazon S3 for customer styling files and reports.
• Stripe for payments and associated payment-security processing.
• Our website hosting, security, form-delivery and IT providers. The website uses Hostinger hosting and Cloudflare security and delivery features, including Turnstile on relevant forms.
• Mailchimp for the newsletter service where you subscribe.
• Google Analytics for optional website analytics where permitted by your privacy choice, and the translation provider used when you select a translated version of the site.
• Delivery and fulfilment providers where needed to deliver physical goods you purchase.
• Professional advisers or public authorities where necessary for legal, accounting, regulatory or claims-related purposes.

Processors acting on our behalf must have appropriate contractual data-protection obligations and use information for the agreed service. Some providers, including payment providers for their own legal and fraud-prevention functions, may also act as independent controllers. Their own privacy information explains that processing.

6. Storage locations and international access

The primary storage configuration for customer styling photographs, measurements and reports is in the UK, as described above. This does not mean that every website provider, support operation or subcontractor is located in the UK, or that no other information can be processed abroad.

Where a restricted transfer outside the UK occurs, the applicable UK transfer rules must be met. Depending on the recipient and destination, the mechanism may be UK adequacy regulations or appropriate safeguards, such as the International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, with the required assessment and additional measures where necessary.

You can ask us for information about the recipient locations and transfer arrangements applicable to your data, including how to obtain a copy of relevant safeguards. UK storage alone is not treated as a substitute for those requirements.

7. Keeping information secure

We use technical and organisational measures appropriate to the information and the risk, including restricted access and the security controls of the services used to store and transmit it. The website uses HTTPS to protect information in transit. People handling customer styling information must use it only for the authorised work.

No service can promise absolute security. If a personal-data breach occurs, we must assess it, take appropriate action and make any notification to the ICO or affected people that the law requires. Contact us promptly if you believe your account or information has been accessed without permission.

8. How long information is kept

• Customer styling records: for the service and 12 months after its completion to handle follow-up questions, after which the styling records are securely deleted under our service-record process.
• Accounting and transaction records: for the period required by the applicable tax and accounting rules. Company accounting records normally need to be retained for six years from the end of the relevant company financial year, with longer periods in specified circumstances. This is not a general requirement to retain all styling photographs for six years.
• Newsletter details: while you remain subscribed. After you opt out, we may retain the minimum record necessary to respect the opt-out and avoid sending marketing again.
• Accounts, saved quiz history and other website records: according to the purpose of the feature, whether you still use it, any request you make and any record that must be retained for legal or security reasons. Contact us to ask about your own records or request deletion.
• Enquiries, complaints and claims: for as long as necessary to handle the matter and any relevant legal obligation or claim. The nature of the issue, applicable limitation period and need for evidence determine the appropriate period.

These categories have different purposes. A legal obligation to retain a transaction record does not justify keeping unrelated sensitive material. Any necessary exception to a normal deletion period must be limited, documented and explained where applicable.

For the verified-email face-shape quiz, pending answers expire after 24 hours and each completed quiz history is kept for 12 months. These records are separate from purchased styling-service records. Other quiz features must explain their own collection and storage where it differs.

9. Your data-protection rights

Depending on the information and lawful basis, you can request access, correction, erasure, restriction or portability, and object to certain processing. You can withdraw consent where we rely on it. These rights have legal conditions and exceptions; they are not all available in every situation.

Send requests to [email protected]. We may need proportionate information to verify your identity before disclosing or changing a record. Do not send identity documents unless we explain why they are needed.

We normally respond without undue delay and within one month, subject to the identity-verification, clarification and other rules that apply. The law may allow up to two further months for complex or multiple requests; we will explain an extension within the applicable period. A fee or refusal is permitted only in the circumstances allowed by law, such as a manifestly unfounded or excessive request. A fee may apply to additional copies.

10. Privacy complaints

You can complain about our use of your personal information by emailing [email protected], using our contact form, or writing to our operating and contact office. Explain the concern and the outcome you would like; please provide only information relevant to the complaint.

We must acknowledge a data-protection complaint within 30 days, investigate appropriately, keep you informed as appropriate and communicate the outcome without undue delay. This complaints acknowledgement period is different from the deadline for responding to a data-rights request.

You also have the right to complain to the Information Commissioner's Office, the UK data-protection regulator. Our complaints procedure does not prevent you from exercising that right.

11. Cookies and your choices

Cookies and similar technologies can support accounts, baskets, security and other site functions. Our current privacy controls distinguish essential operation from optional analytics. Advertising tracking stays disabled, including when you allow analytics.

• Essential operation: cookies or storage necessary for a function you request, such as sign-in, basket operation, security or remembering your privacy choice.
• Optional analytics: measurement of website use where you allow analytics. You can refuse it and continue using the website.
• Privacy-choice cookie: our vou_consent cookie remembers your analytics choice for 180 days, after which the choice can be requested again.

Use Privacy settings on this page or in the footer to allow or refuse analytics, or change a previous choice. Withdrawing consent does not affect earlier lawful processing. Browser controls also let you remove or block cookies; blocking essential ones can affect features you ask the site to provide.

The verified-email face-shape quiz uses the first-party __Host-vou_face_continue cookie to continue the requested quiz safely. Its pending-answer period is 24 hours; it is distinct from the 180-day analytics-choice cookie.

Third-party pages reached through external links have their own privacy practices. Where a feature would introduce additional non-essential storage or tracking not covered by the current choice, the applicable information and consent requirements must be met rather than inferred from acceptance of general terms.

12. Updates and further information

We review this notice when our processing changes. A new use of personal information must have an appropriate lawful basis, and we must provide any notice or obtain any new consent required before using it that way. The current policy date identifies the published version; it does not retrospectively authorise a new purpose.

Contact [email protected] if you need this information in a more accessible form or want clarification about a particular feature, purchase or record.