Processing of Personal Data of Clients and Website Visitors

Effective date: 07.11.2026

1. GENERAL PROVISIONS

1.1. Data Controller. The data controller is Anna Afanasyeva, a sole proprietor (Einzelunternehmerin), address: Seitenstettengasse 5/37, 1010 Vienna, Austria. Diva Marriage Agency is the trade name/brand under which the Controller provides services; it is not a separate legal entity. For questions concerning the processing of personal data and the exercise of data subject rights, please contact: agency@diva-marriage.com.

1.2. Applicable legislation. The Controller processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), the Austrian Data Protection Act (Datenschutzgesetz, DSG), and other applicable legal provisions.

1.3. Scope. This Policy applies to data collected when visiting diva-marriage.com and divamarriage.com, contacting the Controller, registering in the dating database, and receiving matchmaking services. In this Policy, the term “Controller”, where used for convenience, refers to the activities of the Controller under the trade name Diva Marriage Agency and not to a separate legal entity. This Policy describes the processing of data of male clients and website visitors within the scope of the relevant interactions.

1.4. Minors. The Controller’s services are intended exclusively for adults. The Controller does not intend to collect personal data of minors. If the Controller becomes aware that a minor’s data has been provided without an appropriate legal basis, the Controller will take the necessary measures in accordance with applicable law.

1.5. Processing principles. The Controller processes data lawfully, fairly and transparently; collects it for specified and lawful purposes; limits the amount of data to what is necessary; keeps it accurate; retains it no longer than necessary; and ensures appropriate confidentiality and security.

2. CATEGORIES OF DATA THAT MAY BE PROCESSED

2.1. Data provided by the client. Depending on the stage of interaction and the services selected, the Controller may process the client’s first and last name, date of birth or confirmation of legal adulthood, country and city of residence, citizenship, contact details (email address, telephone number, messenger account), marital status, information about education, occupation, height, interests, dating goals and other information voluntarily provided by the client for the preparation of a profile and matchmaking services.

2.2. Photographs. The Controller may process the client’s photographs where they are necessary for preparing a profile or providing the services.

2.3. Identity verification documents. For identity verification, the Controller may ask the client to provide an image of an identity document or part of such a document. Where possible, the client should obscure the document number, machine-readable zone, signature and other information not required for verification. The Controller seeks to obtain only the minimum information necessary, such as the client’s first name, last name and date of birth, where sufficient to verify identity. Documents provided solely for verification are not intended to be viewed by potential partners and are not displayed in the dating profile.

2.4. Website data and technical information. The Controller’s website is created and maintained using the Wix platform. When the website is visited, Wix and technical systems associated with the website may process technical information such as IP address, date and time of the request, page URL, browser and device data, error logs, and information necessary for website security and proper operation. The specific data collected depends on Wix features, website settings and connected applications. Wix may act as a processor on behalf of the Controller in accordance with applicable data processing terms.

2.5. Correspondence and enquiries. The Controller may process the content of enquiries, contact details and attachments received by email, through WhatsApp, Telegram, website forms and other agreed communication channels, to the extent necessary to respond to an enquiry, verify information, enter into and perform a contract, and provide services. If the client uses WhatsApp or Telegram, the relevant platforms also process data in accordance with their own terms and privacy policies.

2.6. Special categories of personal data. The Controller does not seek to collect special categories of personal data listed in Article 9 GDPR, including data concerning health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic and biometric data, or data concerning sex life or sexual orientation. If such data is genuinely necessary for a specific purpose and its processing is permitted by law, the Controller processes it only where an applicable condition under Article 9 GDPR and an appropriate legal basis are present. Clients should not provide such information unless necessary.

3. PURPOSES AND LEGAL BASES FOR PROCESSING

3.1. Provision of services. Data is processed to respond to client enquiries, conduct initial communications and interviews, register clients in the database, verify identity and the accuracy of the information provided, prepare profiles, identify potential partners, arrange introductions, communicate with the client, provide technical and customer support, and perform a contract or take pre-contractual steps at the client’s request.

3.2. Security and prevention of misuse. Data may be processed to protect clients and the Controller, review suspicious enquiries, prevent fraud, ensure system security and handle complaints. Depending on the circumstances, the legal basis may be the Controller’s legitimate interests, provided that such interests are not overridden by the client’s rights and freedoms.

3.3. Legal obligations and protection of rights. Certain data may be retained and used to comply with legal obligations, maintain legally required records, resolve disputes, and establish, exercise or defend legal claims.

3.4. Consent. Where consent is required for a particular processing activity, the Controller will request it separately and in clear terms. Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. After withdrawal, processing may continue only where another applicable legal basis exists.

3.5. Marketing communications. Advertising and marketing communications are sent only where the necessary legal basis exists and, where required by law, with the client’s prior consent. The client may opt out of marketing communications at any time using the method indicated in the communication or by contacting agency@diva-marriage.com.

3.6. Legal bases. Depending on the specific purpose, processing is based on Article 6 GDPR: the necessity of processing for the performance of a contract or for taking pre-contractual steps at the client’s request; consent; compliance with a legal obligation; or the legitimate interests of the Controller or a third party, provided that such interests are not overridden by the client’s rights and freedoms. The Controller determines the legal basis for each actual processing operation and does not use consent as a universal legal basis for all operations.

4. PROFILE AND ACCESS TO DATA IN THE DATING DATABASE

4.1. Profile preparation. To provide the services, the Controller may prepare a profile or presentation summary of the client on the divamarriage.com website. The profile may include information provided by the client for dating purposes and photographs intended to be shown to potential partners.

4.2. Closed database. Access to profiles is granted only to registered members of the dating database who have been given the relevant access rights, and solely for the purposes of viewing potential partners and arranging introductions. Profiles are not intended to be freely accessible to all visitors to the internet. The Controller takes reasonable measures to restrict access but cannot completely eliminate the risk that a recipient may copy or further distribute information.

4.3. Separation of materials. Documents provided solely for identity verification, contact details, internal correspondence and video presentations are not included in the profile accessible to potential partners, unless the client has been separately informed otherwise and there is an appropriate legal basis for such processing.

4.4. Display on the Controller’s websites. Data provided through one of the Controller’s websites may be used to display a profile on another website operated by the Controller where this is necessary for the provision of services and complies with this Policy and the applicable legal basis.

4.5. Client responsibility for information provided. The client must provide accurate information about themselves and must not provide data relating to other persons without an appropriate legal basis. Clients are advised not to include excessive information or information unrelated to dating in their profiles.

5. WHO MAY RECEIVE PERSONAL DATA

5.1. Members of the dating database. To the extent necessary to provide the services, information from the profile intended for dating purposes may be made available to potential partners, subject to access settings and the purposes of processing.

5.2. Service providers. The Controller uses the Wix platform to operate the website. Wix may process personal data of website visitors and registered users to the extent necessary to provide website services. Data may also be processed by providers of email, WhatsApp, Telegram, file storage systems, payment services and other digital tools, where these are actually used by the Controller. The Controller reviews applicable contractual terms and data protection safeguards, including data processing terms with Wix, where required by the GDPR.

5.3. Public authorities and other recipients. Data may be disclosed to public authorities, courts or other recipients where required by applicable law or necessary to establish, exercise or defend legal claims.

5.4. No sale of data. The Controller does not sell clients’ personal data. Data is disclosed only for the purposes described in this Policy, on an appropriate legal basis and to the minimum extent necessary.

5.5. Independent third-party services. If the client independently uses third-party services or contacts the Controller through them, the relevant provider may process data as an independent controller in accordance with its own privacy policy. The Controller does not control all independent processing activities of such providers, but this does not limit the Controller’s liability as provided by law.

6. INTERNATIONAL DATA TRANSFERS

6.1. As members of the dating database, digital service providers and potential partners may be located within or outside the European Economic Area (EEA), granting access to a profile or using platforms such as Wix, WhatsApp and Telegram may involve the transfer of data to, or access to data from, another country. The actual countries and transfer mechanisms depend on the specific service and its settings.

6.2. Where a transfer of personal data outside the EEA falls within Chapter V GDPR, the Controller ensures that an applicable transfer mechanism and the safeguards required by law are in place, such as a European Commission adequacy decision or standard contractual clauses, where applicable.

6.3. Making a profile available to a potential partner does not mean that all of the client’s information is accessible to that person. The Controller restricts access to data intended for the profile. Identity verification documents and internal video presentations are not intended to be made available in this way.

7. RETENTION PERIODS AND DELETION

7.1. General principle. Personal data is retained no longer than necessary for the purposes for which it was collected, taking into account the nature of the data, the purpose of processing, legal requirements and the need to protect legal claims.

7.2. Questionnaires and profiles. The questionnaire and profile are retained while the client participates in the dating database and receives services. After participation ends, the profile is hidden from potential partners and the data is deleted unless further retention is required by law or for the defence of legal claims.

7.3. Photographs. Photographs are retained for as long as they are necessary to prepare the profile and provide the services. After participation ends, they are deleted from the systems used by the Controller unless further retention is required by law or for the defence of legal claims.

7.4. Identity verification documents. Documents provided for identity verification are retained only for the period necessary to verify and serve the client. After the client relationship ends, they are deleted unless further retention is required by law, for the performance of contractual obligations or for the defence of legal claims.

7.5. Correspondence and materials. Correspondence and attachments are retained for the period necessary to handle enquiries, registration, identity verification, provision of services and compliance with legal obligations. Materials no longer needed for these purposes are deleted where there is no legal basis for further retention.

7.6. Technical logs and accounting records. Retention periods for server logs, accounting records and other legally required documents are determined by the actual settings of the services and applicable statutory retention periods. The Controller must determine specific periods taking into account the systems actually used and mandatory retention periods.

7.7. Deletion and backups. Deletion is carried out within a reasonable period, taking into account the systems used and backup procedures. Data may temporarily remain in backups until they are routinely overwritten, provided that the backups are protected and the data is not used for purposes other than system recovery and security.

8. CLIENT RIGHTS

8.1. Subject to the conditions and limits set out in the GDPR and Austrian law, the client has the right to: obtain confirmation as to whether their personal data is being processed and access that data; receive information about the purposes, categories of data, recipients and retention periods; request rectification of inaccurate data; request erasure of data; request restriction of processing; receive the data they have provided in a structured, commonly used and machine-readable format and, where technically feasible and applicable, transmit it to another controller; object to processing based on legitimate interests on grounds relating to their particular situation; object to direct marketing; withdraw consent where processing is based on consent; and not be subject to a decision based solely on automated processing, including profiling, where this right applies.

8.2. Limitations on rights. These rights are not absolute. The Controller may continue to retain or process data where this is necessary to comply with a legal obligation, establish, exercise or defend legal claims, or where another statutory exception applies.

8.3. How to exercise your rights. To submit a request, please email agency@diva-marriage.com and describe your request. Where necessary, the Controller may request additional information to verify the requester’s identity, but must not collect more data than is necessary for that verification.

8.4. Response period. The Controller responds to requests without undue delay and, as a rule, within one month of receipt. In cases provided for by the GDPR, this period may be extended by a further two months, taking into account the complexity and number of requests. The requester will be informed of the extension and the reasons for it within the first month.

8.5. Complaint to a supervisory authority. The client has the right to lodge a complaint with the competent data protection supervisory authority, in particular the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, Austria; email: dsb@dsb.gv.at; website: https://www.dsb.gv.at/. Depending on the circumstances, the client may also contact the supervisory authority in the country of their habitual residence, place of work or the place of the alleged infringement.

9. COOKIES AND WEBSITE TECHNICAL DATA

9.1. Technical data and logs. The Wix platform and related technical systems may automatically process or record information necessary to provide the website, authenticate registered users, protect against misuse, diagnose errors and ensure security. Such information may include IP address, date and time of the request, requested page, browser and device type, operating system and technical logs. The actual data collected and retention period depend on the features and settings of Wix used.

9.2. Wix cookies and similar technologies. The Wix-based website may use cookies and similar technologies for basic website operation, security, session management and recognition of registered users. Wix indicates that websites may use necessary cookies, while additional cookies may be introduced through applications and third-party integrations. The specific list of cookies depends on the actual website configuration and should be checked in Wix settings and in the browser. Technically necessary technologies may be used to provide a function explicitly requested by the user; optional analytics, advertising and functional technologies are used only where there is an appropriate legal basis and prior consent where required by law.

9.3. Banner and consent management. The Controller uses or must configure the Privacy & Cookies / Cookie Banner tools available in Wix so that visitors can receive information about optional cookies and manage their consent. Where consent is required, optional cookies and related scripts must not be activated before consent is obtained. Users may also manage cookies through their browser settings; disabling certain cookies may affect login or other website functions.

9.4. Analytics and advertising. As of the publication date of this version, the Controller does not use Meta Pixel or Google Analytics / Google tag on the website for advertising tracking or web analytics. The Controller may connect these tools in the future. If such tools are connected, the Controller will update this Policy, specifying the purposes and categories of data processed, relevant recipients and consent settings. Such tools will be activated only in accordance with applicable law and the user’s consent settings, where prior consent is required.

9.5. Changes to configuration. When new applications, analytics tools, pixels, embedded videos, external fonts, payment tools or other services are connected, the Controller reviews their impact on data processing, updates this Policy where necessary and configures cookie consent in accordance with the technologies actually used.

10. SECURITY MEASURES AND CONFIDENTIALITY

10.1. The Controller implements appropriate organisational and technical measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The specific measures are determined taking into account the nature and volume of the data, the risks and the capabilities of the systems used.

10.2. Access to personal data is granted only to persons and service providers who need it for the relevant functions and who are bound by confidentiality obligations and, where applicable, contractual data protection obligations.

10.3. The transmission of data over the internet and by email cannot be guaranteed to be secure against all risks. Clients are advised not to send excessive information and, where possible, to obscure fields in document copies that are not required for identity verification.

11. CHANGES AND CONTACT INFORMATION

11.1. The Controller may update this Policy when services, data processing procedures or applicable law change. The new version will be published on the website and will apply from the date specified in it.

11.2. The current version of the Policy is available at: https://divamarriage.com/policy. Before publication, the Controller must ensure that the link leads directly to the current Privacy Policy.

11.3. For all questions concerning the processing of personal data, please contact agency@diva-marriage.com.

11.4. This Policy supplements the public offer and other documents governing the Controller’s provision of services. The GDPR, the Austrian DSG and other applicable legal provisions govern the processing of personal data; contractual documents do not override rights granted to data subjects by law.

12. INFORMATION ABOUT THIRD-PARTY SERVICES

12.1. Information about privacy and data processing by Wix: https://www.wix.com/about/privacy

12.2. Wix Data Processing Agreement for users of Wix websites: https://support.wix.com/en/article/wixs-data-processing-agreement-for-wix-users

12.3. WhatsApp Privacy Policy for users in the European Region: https://www.whatsapp.com/legal/privacy-policy-eea

12.4. Telegram Privacy Policy: https://telegram.org/privacy