Social Media Usage Policy

Social Media Policy

Victoria's Secret has Facebook and Instagram social media profiles ("Fan Pages") where we regularly post and share content and offers. By using our Fan Pages, you can contact us, for example, by logging in to our Facebook page, leaving your reaction (likes, comments) or sending us a message. The information you provide to us about yourself may constitute personal data. This social media policy describes how we process personal data collected through accounts on Social Networks (as hereinafter defined).

We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of data, and repealing Directive 95/46/EC (the "GDPR"), and the Data Protection Act, Chapter 586 of the laws of Malta.

01 | Controller & Data Protection Officer

The controller of your personal data is SF1 CLIPS, s.r.o., with its registered office at Pribinova 4, 811 09 Bratislava, Slovakia (hereinafter referred to as the "Controller"). .

You can contact the Controller’s Data Protection Officer via the following email address: info@victoriassecret.mt

02 | Social Networks

We process personal data through the following social networks (the "Social Networks"):

FACEBOOK: facebook.com
INSTAGRAM: victoriassecretmalta

03 | Purpose and legal basis of data processing

We process your personal data in a consistent manner and on the basis of:

Legitimate Interest (Article 6(1)(f) GDPR):

- Manage our Fan Pages and notify you about promotions, products and events. .
- Maintaining community and responding to comments/messages.
- Analysis of statistics (participation, traffic).
- Filing or defending legal claims.

2. Consent (Article 6(1)(a) GDPR):

- When you voluntarily share your information in a message or comment.

3. Legal obligation (Article 6(1)(c) GDPR):

- In accordance with the applicable Maltese or EU legislation.

04 | Categories of data processed

For Facebook, Instagram , we can process:

- Account name or ID (usually your username or display name).
- Profile picture and other photos (if visible).
- Comments, messages, reactions (likes, followers).
- Account visitor statistics (through cookies and platform tools).

05 | Data recipients

Access to your data may be provided to:

- Internal staff / employees of the Controller and their associated teams involved in social media management, including:
- The Clips DK team in Serbia, which carries out data processing activities in accordance with data processing agreements entered into between the Controller and [official name of Clips DK];
- VS US (U.S.) team that manages administrative functions for social media accounts.
- Service providers (e.g. marketing and IT service providers).
- Social media platform providers (Meta/Facebook, Instagram, TikTok).

Note: Social media platform providers process data in accordance with their policies and act as independent controllers. Please review their privacy policies.

06 | Data Retention Period and Deletion

We store personal data only for as long as necessary for the purposes specified in the Privacy Policy, in particular to fulfil our contractual and legal obligations. If necessary, we may also store your personal data for other purposes, if and for as long as further storage for certain purposes is permitted by law.

We process and store your data:

- While our account exists or until you withdraw consent. If we process data based on your consent, you have the right to withdraw your consent at any time. Your revocation does not change the lawfulness of processing based on consent prior to its withdrawal.
- You can exercise your right to object at: info@victoriassecret.mt
- For the time needed to reply to messages.
- Until expiration of statutory prescriptive periods for any claims.
- If you delete your account, we will delete stored personal data. If complete deletion is not possible or necessary for legal reasons, we will anonymise this data. Anonymisation is carried out, for example, if storage obligations are in force under commercial or tax law or if the data in question may still be required for further processing of the contract or for the legal exercise of rights or legal defence (e.g. in the event of complaints). For example in the case of financial data, we are obliged to retain this data for up to ten years. The appropriate criterion for the duration of the retention is therefore the relevant statutory prescriptive periods, after which the data is then deleted.

07 | Your rights

You have the right to:

- Access, correct, complete or restrict your personal data (in particular, you can request information about the purposes of processing, categories of personal data, categories of recipients to whom your data have been or will be disclosed, the planned retention period, the origin of your data if it was not collected directly from you, etc.)
- Erasure (where lawful).
- Withdrawal of consent at any time.
- Objection to processing (in particular for marketing purposes).
- File a complaint with the Information and Data Protection Commissioner, at Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta or via e-mail on: idpc.info@idpc.org.mt or via the online form on the website: https://register.idpc.org.mt/report-breach/complaint/
- To exercise your rights, please contact us using the contact details provided in this policy.

08 | Information about the data source and other information

We receive your personal data directly from you through your interaction with our social media account and from your public profile.
The provision of data is voluntary.

9 | Changes to social media policy

This policy is subject to change. We will notify you at least 7 days in advance of implementation of any changes.
If you have any questions about our Social Media Policy, please contact us: info@victoriassecret.mt

Last update: 12.05.2025.