PRIVACY POLICY
1. INTRODUCTION
1.1. XNON CLOTHING LTD (trading as "XNON") is committed to protecting and respecting your privacy.
1.2. We are the data controller responsible for your personal data. We are registered in England and Wales with Company Registration Number: [TO BE INSERTED]. Our registered office is at Betts Mews, Gallions Reach, London E16 2XT, United Kingdom.
1.3. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit our website xnonlondon.com ("Website") or interact with us, in compliance with the UK General Data Protection Regulation (UK GDPR) as incorporated by the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
1.4. For any privacy-related queries, please contact us at contact@xnonlondon.com.
2. INFORMATION WE COLLECT
We may collect and process the following categories of personal data:
2.1. Information you provide directly:
- Identity Data: First name, last name.
- Contact Data: Email address, telephone number, billing address, delivery address.
- Financial Data: Payment card details (processed securely by our third-party payment processor; we do not store your full card details).
- Transaction Data: Details of products you have purchased, order history, returns, and refunds.
- Communications Data: Records of correspondence if you contact us (by email, telephone, or social media).
- Job Application Data: If you apply for a role via our Careers page, your CV, portfolio, and contact details.
2.2. Information we collect automatically:
- Technical Data: Internet Protocol (IP) address, browser type and version, operating system, device type, screen resolution, and time zone setting.
- Usage Data: Pages visited, links clicked, time spent on pages, referring URL, and browsing patterns on the Website.
- Cookie Data: Data collected via cookies and similar technologies (see Section 7 below).
3. HOW WE USE YOUR PERSONAL DATA
We process your personal data only where we have a lawful basis to do so under Article 6 of the UK GDPR. The table below sets out our purposes and the corresponding lawful basis:
| PURPOSE / ACTIVITY | LAWFUL BASIS (ARTICLE 6 UK GDPR) |
|---|---|
| Processing and fulfilling your orders, including delivery | Performance of a contract (Art. 6(1)(b)) |
| Managing payments, cancellations, and refunds | Performance of a contract (Art. 6(1)(b)) |
| Sending order confirmations and dispatch updates | Performance of a contract (Art. 6(1)(b)) |
| Responding to customer enquiries and support requests | Legitimate interests (Art. 6(1)(f)) — to ensure customer service |
| Sending promotional email newsletters and campaign updates | Consent (Art. 6(1)(a)) — opt-in only |
| Marketing to existing customers about similar products | Legitimate interests (Art. 6(1)(f)) — PECR Reg 22(3) soft opt-in |
| Fraud prevention and website security monitoring | Legitimate interests (Art. 6(1)(f)) — protecting our business |
| Website optimisation and user experience analytics | Legitimate interests (Art. 6(1)(f)) |
| Complying with statutory accounting and tax obligations (HMRC) | Legal obligation (Art. 6(1)(c)) |
| Assessing candidates for advertised career positions | Pre-contractual steps (Art. 6(1)(b)) / Legitimate interests (Art. 6(1)(f)) |
4. WHO WE SHARE YOUR DATA WITH
4.1. We may share your personal data with the following categories of third-party recipients, solely for the purposes described above:
- Payment processors (e.g. Stripe, Apple Pay, PayPal) — to securely process checkout transactions.
- Logistics and courier partners (e.g. Royal Mail, DPD) — to deliver physical apparel orders.
- Hosting and infrastructure providers — who host our servers, database, and content delivery networks.
- Analytics providers (e.g. Google Analytics) — to analyse aggregated website traffic (anonymised where possible).
- Email communications providers — to deliver order confirmations and opted-in newsletters.
- Professional advisers & authorities — solicitors, accountants, HMRC, and the ICO where legally required.
4.2. We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.
5. INTERNATIONAL DATA TRANSFERS
5.1. Where service providers process data outside the United Kingdom, we ensure appropriate safeguards are maintained in compliance with UK GDPR, including UK International Data Transfer Agreements (IDTA) or ICO-approved Standard Contractual Clauses.
6. DATA RETENTION
6.1. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including statutory legal and accounting retention periods:
| DATA CATEGORY | RETENTION PERIOD | PURPOSE |
|---|---|---|
| Order & financial records | 7 years from transaction date | Compliance with HMRC statutory tax regulations |
| Customer enquiry correspondence | 3 years from last contact | Resolving inquiries and defending potential claims |
| Marketing subscription data | Until consent is withdrawn (unsubscribe) | Delivering requested newsletters |
| Job applicant CVs and submissions | 6 months after recruitment conclusion | Recruitment review and candidate records |
| Website analytics records | 26 months | Aggregated traffic performance analysis |
7. COOKIES AND TRACKING TECHNOLOGIES
7.1. Cookies are small text files placed on your device. We categorise cookies into:
- Strictly Necessary: Essential for website navigation and security (no consent required under PECR).
- Performance & Analytics: Help us understand visitor usage and improve performance (consent required).
- Marketing: Used to track advertisement effectiveness (consent required).
7.2. You can modify your browser settings at any time to reject non-essential cookies.
8. YOUR LEGAL RIGHTS
8.1. Under Chapter 3 of the UK GDPR, you have the following statutory rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you (Subject Access Request).
- Right to rectification: Request correction of inaccurate or incomplete personal records.
- Right to erasure: Request deletion of your personal data where retention is no longer justified ("right to be forgotten").
- Right to restriction: Request that we suspend processing your data under certain conditions.
- Right to data portability: Request transfer of your data to yourself or a third party in a structured format.
- Right to object: Object to processing based on legitimate interests, or at any time for direct marketing.
8.2. To exercise any of these rights, please email us at contact@xnonlondon.com. We will respond within one calendar month without charge.
9. RIGHT TO COMPLAIN TO THE REGULATOR
9.1. You have the right to lodge a complaint with the UK supervisory authority for data protection:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: https://ico.org.uk
Helpline: 0303 123 1113
10. DATA SECURITY
10.1. We implement technical and organisational measures to safeguard your personal information, including SSL/TLS encryption, restricted access protocols, and secure PCI DSS-compliant payment gateways.
11. CHILDREN'S PRIVACY
11.1. Our Website is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13.
12. MARKETING COMMUNICATIONS
12.1. We only send marketing communications with your affirmative consent or where permitted by PECR soft opt-in. Every marketing email includes an immediate unsubscribe mechanism.
13. POLICY UPDATES
13.1. We may update this Privacy Policy periodically. Significant changes will be announced on this page with an updated revision date.
14. CONTACT US
For any questions regarding this Privacy Policy or data handling practices:
XNON CLOTHING LTD (trading as XNON)
Betts Mews, Gallions Reach, London E16 2XT, United Kingdom
Email: contact@xnonlondon.com
Telephone: +44 7799 858675