Social Media Policy

Victoria's Secret operates social media profiles on Facebook and Instagram (hereinafter referred to as the “Fan Pages"), where we regularly post and share content, promotions and offers. By using our Fan Pages, you can interact with us by leaving likes, comments, or sending messages. The information you provide to us through these channels about yourself may constitute personal data. This social media policy describes how we process personal data collected through accounts on the following social networks (hereinafter referred to as the "Social Networks"):

• FACEBOOK: facebook.com
• INSTAGRAM: victoriassecretcyprus

We process your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Law of Cyprus.

 01 | Data Protection Officer or Data Protection Administrator

The authorized person or administrator for the protection of your personal data is SF1 CLIPS[MT1.1][MD1.2][MT1.3], s.r.o., with its registered office at Pribinova 4, 811 09 Bratislava, Slovakia (hereinafter referred to as the "Administrator").

You can contact the Data Protection Administrator via the following email address: info@victoriassecret.cy

Note: The owner of the Cyprus website is the Slovakian company, SF1 CLIPS, s.r.o. Bratislava, which acts as the Data Protection Administrator.

 02 | Social networks used

We process personal data through the following Social Networks:

• FACEBOOK: facebook.com
• INSTAGRAM: victoriassecretcyprus

 03 | Purpose and legal basis of data processing

We process your personal data in a consistent manner and on the basis of:

1. The legal basis for the processing of data shall be Article 6 (1)(f) General Data Protection Regulation (GDPR).



• - Manage and maintain our social media accounts, and notify users about promotions, products and events.
• - Maintaining community and responding to comments/messages.
• - Analysis of social media statistics (participation, traffic).
• - Filing or defending legal claims.

2. Consent (Article 6 (1)(a) GDPR)



• - When you voluntarily share your information via messages, comments, or other interactions on our social networks.

3. Legal obligation



• - To comply with applicable Cyprus or EU legislation regarding data processing, recordkeeping, and reporting.

 04 | Categories of data processed

Our social networks such as Facebook, Instagram and TikTok, we may process:



• - Account name or ID (usually your username or display name).
• - Profile picture and other photos (if visible).
• - Comments, messages, reactions (likes, followers).
• - Account visitor statistics (through cookies and platform tools).

 05 | Data recipients

Access to your data may be provided:



• - Internal staff / employees of SF1 Clips s.r.o. and their associated teams involved in social media management, including:
• - The Clips DK team in Serbia, which carries out data processing activities in accordance with contractual protections;
• - Victoria’s Secret US (U.S.) team that manages administrative functions for social media accounts.
• - Service providers (e.g. marketing/marketing and IT providers).
• - Providers of social media platforms (Meta/Facebook, Instagram, TikTok).

Note: Social media platform providers process data in accordance with their policies and act as independent controllers. Please review their privacy policies.



When processing your data, we may use data processors - natural or legal persons who handle personal data on our behalf, following our instructions. Data processors do not use your data for their own purposes; they act exclusively for the controller.



If processors are not already listed above, these are in particular the following categories of processors:



• - IT service providers (sending e-mails and newsletters),
• - Call center providers (answering customer questions).




We also transfer personal data to third parties or processors based in countries outside the European Economic Area ("EEA"). Before any transfer, we ensure that:



• - The recipient has an adequate level of data protection, as recognized by the European Commission (Article 45 GDPR), or
• - You have given explicit consent for the transfer, or
• - We have implemented Standard Contractual Clauses (SCCs) approved by the European Commission (Article 46 GDPR) and, if needed, additional protective measures through a Transfer Impact Assessment.

For transfers to the USA, we rely on the EU-US Data Privacy Framework (DPF) if the recipient participates and holds a valid certification, ensuring an adequate level of protection.



This ensures that your personal data remains protected, even when processed or transferred internationally.



 06 | Data retention period and deletion

SF1 CLIPS stores personal data only for as long as this is necessary for the purposes specified in the data protection information (privacy policy), in particular to fulfil our contractual and legal obligations. If necessary, we may also store your personal data for other purposes, if and for as long as further storage for certain purposes is permitted by law.



We process and store your data:



• As long as our account exists or until you withdraw your consent or your consent (processing based on consent). If we process data on the basis of your consent, you have the right to withdraw your consent at any time. Your revocation does not change the lawfulness of the data processing that was carried out on the basis of consent or consents prior to the withdrawal.




You can exercise your right to object at: info@victoriassecret.cy



• For as long as it takes to reply to your message.
• Until the expiration of the statute of limitations for any claims related to your interaction.
• If you delete your account as a customer or user account, we will delete all your stored personal data. If complete deletion is not possible or necessary for legal reasons, we will block this data. Blocking is carried out, for example, if storage obligations are in force under commercial or tax law. In the case of tax audits and inspections, we are obliged to retain this data for up to ten years, even if there is no legal obligation to store it, we may waive immediate deletion in certain cases permitted by law. This applies, for example, if the data in question may still be required for the further processing of the contract or for the legal exercise of rights or legal defence (e.g. in the event of complaints). The appropriate criterion for the duration of the blocking is therefore the relevant statutory limitation periods, after which the data is then deleted.




 07 | Your rights

You have the right to:



• Access your data, correct it (inaccurate data), complete incomplete data, or restrict it (in particular, you can request information about the purposes of processing, categories of personal data, categories of recipients to whom your data have been or will be disclosed, the planned retention period, the origin of your data if it was not collected directly from you, etc.)
• You delete your data stored by us if the applicable requirements are met and, in particular, if we do not have to comply with statutory or contractual retention periods or other legal obligations or rights to further retention.
• Restrict the processing of your data if you contest the accuracy of the data (for a period that allows us to verify the accuracy of the personal data), if the processing is unlawful, but you oppose the deletion of the data, if we no longer need the data, but you need it to assert, exercise or defend it in the event of legal claims, or you have objected to the processing in accordance with Article 21 of the General Data Protection Regulation (GDPR) (until it is still clear, whether our legitimate reasons outweigh yours).
• Data portability in accordance with Article 20 GDPR, i.e. the right to use point a) in the event of processing based on your consent Article 6(1) of GDPR or for the implementation of the contract Article 6 (1)(b) of GDPR. In accordance with the General Data Protection Regulation (GDPR), which is implemented through the use of automated processes, you receive the data we hold about you in a common, machine-readable format or to request its transfer to another controller.
• Withdraw your consent/consent at any time.
• You object to the processing of data (in particular for marketing/marketing purposes).
• File a complaint with the Cyprus Data Protection Commissioner, Information Commissioner of the Republic of Cyprus, e-mail:commissioner@dataprotection.gov.cy via the online form: https://www.dataprotection.gov.cy
  
  

*To exercise your rights, please contact us using the contact details provided in the introduction.



 08 | Information about the data source and other information

• We receive your personal data directly from your interaction with our social media accounts and from your public profile.
• The provision of data is voluntary.
• Personal data will not be subject to automated decision-making, including profiling.

 09 | Changes to social media policy

The Social Media Policy is subject to change, and we will notify you at least 7 days in advance of significant changes.



If you have any questions about our social media policy, please contact us: info@victoriassecret.cy



_________________________



 

Last update: 01.12.2025.