Privacy Policy

Last updated: 16 March 2025

This Privacy Policy describes how Xarlenoxchelea (“we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use our website https://xarlenoxchelea.world (the “Site”) and our services. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

1. Data controller

The data controller responsible for your personal data is:

Xarlenoxchelea
4 Shepherd Market
London W1J 7QB
United Kingdom

Email: managers@xarlenoxchelea.world
Phone: +44 207 493 2309

2. Personal data we collect

We may collect and process the following categories of personal data:

• Identity data: name, title.
• Contact data: email address, telephone number, postal address.
• Technical data: IP address, browser type and version, time zone, device type, operating system, and other technology on the devices you use to access the Site.
• Usage data: information about how you use the Site, including pages visited, time spent, and navigation paths.
• Communication data: messages you send to us via contact forms, email, or other channels.
• Consent and preference data: your preferences regarding marketing, cookies, and communication.

3. Legal basis and purposes of processing

We process your personal data only where we have a lawful basis under UK GDPR:

• Contract: to perform our contract with you (e.g. processing orders, delivering products, responding to enquiries).
• Legitimate interests: to operate and improve the Site, prevent fraud, ensure security, and defend legal claims, where our interests are not overridden by your rights.
• Consent: where you have given clear consent for a specific purpose (e.g. marketing emails, non-essential cookies).
• Legal obligation: where processing is necessary to comply with applicable law (e.g. tax, consumer rights).

Purposes include: providing our products and services; processing orders and payments; communicating with you; improving the Site and user experience; ensuring security and preventing misuse; complying with legal obligations; and, where you have consented, sending marketing communications.

4. How we collect your data

We collect data:

• Directly from you when you fill in forms on the Site (e.g. order form, contact form), when you contact us by email or phone, or when you subscribe to communications.
• Automatically when you use the Site (e.g. technical and usage data via cookies and similar technologies, as described in our Cookie Policy).
• From third parties only where we have a lawful basis (e.g. payment or delivery providers to fulfil orders).

5. Data retention

We keep your personal data only for as long as necessary for the purposes for which it was collected and to comply with legal, accounting, or reporting requirements.

• Order and customer data: typically 6 years after the last transaction for legal and accounting purposes.
• Enquiry and contact form data: until the enquiry is resolved and for a reasonable period thereafter (e.g. 2 years) unless you become a customer.
• Marketing and consent records: until you withdraw consent or object, then we retain only the record that you have opted out.
• Technical and access logs: as set out in our Cookie Policy, generally not more than 24 months for analytics where applicable.
• Legal and regulatory: as required by UK law (e.g. HMRC, consumer law).

After the retention period, we securely delete or anonymise your data so it can no longer identify you.

6. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Use of HTTPS and encryption for data in transit.
• Access controls and staff training on data protection.
• Secure storage and limited retention in line with this policy.
• Procedures to handle suspected data breaches and to notify the ICO and affected individuals where required by law.

While we strive to protect your data, no method of transmission or storage over the internet is completely secure; you provide data at your own risk.

7. Sharing and international transfers

We may share your data with:

• Service providers who act on our instructions (e.g. hosting, payment processing, delivery, email services), under contracts that require them to protect your data and use it only for the purposes we specify.
• Professional advisers (e.g. lawyers, accountants) where necessary for our legitimate interests or legal obligations.
• Regulators, law enforcement, or other bodies when required by law or to protect our rights.

We do not sell your personal data. If we transfer data outside the United Kingdom, we ensure appropriate safeguards (e.g. UK adequacy decisions, standard contractual clauses) in line with UK data protection law.

8. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: to receive a copy of your data and information about how we process it.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to have your data deleted in certain circumstances (e.g. where it is no longer necessary, or you withdraw consent where consent was the basis).
• Right to restrict processing: to limit how we use your data in certain situations.
• Right to data portability: to receive your data in a structured, machine-readable format where the processing is based on consent or contract and is carried out by automated means.
• Right to object: to object to processing based on legitimate interests or to direct marketing.
• Right to withdraw consent: where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint: with the Information Commissioner’s Office (ICO), the UK supervisory authority: ico.org.uk.

To exercise any of these rights, contact us at managers@xarlenoxchelea.world or at the address above. We will respond within one month, subject to complexity and number of requests.

9. Children

Our Site and services are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe we have collected data relating to a child, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will be revised. We encourage you to review this page periodically. Where changes are material, we may notify you by email or a notice on the Site where appropriate.

11. Contact

For any questions about this Privacy Policy or our data practices, contact the data controller:

Xarlenoxchelea
4 Shepherd Market, London W1J 7QB, United Kingdom
Email: managers@xarlenoxchelea.world
Phone: +44 207 493 2309