Privacy Policy

2.1 From what sources do we get your personal data?

We obtain your personal data from the following sources:
• Directly from you: for example, if you submit your personal data when you purchase something from us or contact us;
• Directly or indirectly through your activity on Xlash: when you use Xlash, we automatically collect technical information about your use of Xlash; and
• From third parties: we may receive information about you from third parties to whom you have previously provided your personal data, if those third parties have a legal basis for disclosing your personal data to us (for example, for payment processing purposes).
2.2 What personal data do we collect?

We comply with data minimisation principles. This means that we collect only a minimal amount of personal data that is necessary for your use of Xlash. We use your personal data for limited, specified and legitimate purposes explicitly mentioned in this Privacy Policy. In general, your personal data is used for the purposes of providing you with access to Xlash, maintaining and improving Xlash, processing your orders, replying to your enquiries, and pursuing our legitimate interests. We do not re-purpose your personal data. This means that we do not use it for any purposes that are different from the purposes for which your personal data was provided. Below, you can find an overview of the types of personal data that we collect, the pur-poses for which we use it, and the legal bases on which we rely when processing it.

• Orders. When you place an order, we collect your first name, last name, city, region, address, email address, and telephone number. We use this information to send you transactional receipts, deliver you your orders, contact you, if necessary, and maintain our business records. The legal bases on which we rely are ‘performing a contract with you’ and ’pursuing our legitimate interests’ (i.e., to administer Xlash). We will store this data for as long as required by the applicable law (at least 7 years) or until you delete your user account, whichever later.

• Payments. When you make a payment, our payment processors Klarna and PayPal collect your personal data, such as first name, last name, billing and delivery addresses, and payment details (e.g., credit card or PayPal details). Please note that the types of personal data that you need to submit depend on the payment processor chosen by you. We do not have access to your full payment data; only a part of your personal data is made available to us by the payment processors. Your payment data is used to process payments and maintain our accounting records. The legal bases on which we rely are ‘performing our contractual obligations’ and ‘pur-suing our legitimate interests’ (i.e., to administer our business). We store such data for the time period prescribed by law (at least 7 years).

• Enquiries. When you contact us by email, we collect your name, email address, and any infor-mation that you decide to disclose in your message. When you contact us by using the ‘Contact Us’ functionality, we collect your first name, last name, email address, phone number, and any information that you decide to include in your message. When you contact us as a business through the ‘Contact Us’ functionality, we collect your email address, business type, business name, website (optional), VAT registration number, mobile phone number, invoicing email, buyers name, shipping address, country, and any other information that you decide to provide us in your message. We use such data to respond to your enquiries and provide you with the requested information. The legal bases on which we rely are ‘pursuing our legitimate interests’ (i.e., to maintain and grow Xlash) and ‘your consent’ (for optional personal data). We will store this data until you stop communicating with us.

• Cookies. When you browse Xlash, we or our third-party analytics service provider (as explained in below) collect your location and cookie-related data. We use such information to analyse the technical aspects of your use of Xlash, prevent fraud and abuse, and ensure the security of Xlash. For more information on our use of cookies, please refer to our Cookie Policy. The legal bases on which we rely are ‘pursuing our legitimate interests’ (i.e., to analyse our content and protect Xlash) and ‘your consent’. We will store this data as long as analytics records are necessary for our activities or you withdraw your consent (if you have provided one).

• Reviews. When you leave a review about the products purchased by you, we collect your name and any information that you decide to provide in your review. We use the said data to feature your review on Xlash. The legal basis on which we rely is ‘your consent’. We will store this data until you ask us to delete your review.

2.2 Do we collect sensitive data?

We do not collect or use any special categories of personal data (“sensitive data”) from you, unless you decide, at your own discretion, to provide such data to us. Sensitive data refers to your health, religious and political beliefs, racial origins, membership of a professional or trade association, or sexual orientation.

2.3 What happens if you refuse to provide your personal data?

If you decide not to provide us with your personal data when we ask for it, we may not be able to perform the requested opera-tion (for example, process your order) and you may not be able to use the full functionality of Xlash, receive the requested information, or get our response. Please notify us immediately if you think that any personal data that we collect is excessive or not necessary for its intended purpose.

2.4 Do we collect analytics data?

Yes. When you browse Xlash, we collect or have access to certain technical analytics data collected from you. Such data includes the following information:
• Your activity on Xlash (time of visit, pages visited, products viewed, time spent on each page, clicks, scroll depth, interaction with widgets);
• URL addresses from which you access Xlash;
• Your browser type and version;
• Your operating system;
• Your device details;
• Information about your orders;
• Your other online behaviour; and
• Cookies-related data, as explained in our Cookie Policy.

2.5 For what purposes do we use analytics data?

We use your analytics data to analyse what kind of users access and use Xlash, measure your engagement with Xlash, see which products are interesting to you, improve our content, develop new products and services, and investigate and prevent security issues and abuse. In most cases, such analytics data is non-personal and it does not allow us to identify you as a natural person. However, some of such data like your IP address may be considered personal data and we will make sure that we have the necessary legal basis for pro-cessing such data. When we process your analytics data that is personal data, we rely on the ‘legiti-mate interest’ (i.e., to analyse and improve Xlash) and ‘your consent’ bases.

2.6 Do we keep your feedback?

If you contact us, we may keep records of any questions, com-plaints, recommendations, or compliments made by you and the response. Where possible, we will de-identify your personal data (i.e., we will remove all personal data that is not necessary for keep-ing such records).

2.7 What happens if we aggregate or de-identify your data?

In case your non-personal data is combined with certain elements of your personal data in a way that allows us to identify you as an individual, we will handle such aggregated data as personal data. If your personal data is de-identified in a way that it can no longer be associated with an identified or identifiable natural per-son, it will not be considered personal data and we may use it for any legitimate purpose.

2.8 When will you receive our commercial communication?

We send you our commercial communication only if (i) you opt-in for our newsletter, (ii) subscribe for a newsletter by giving us your email address, or (iii) purchase something from us and we want to inform you about our similar products. In such cases, you will receive information about our new products, features of Xlash, and special offers. The legal bases on which we rely are ‘your consent’ or ‘pursuing our legitimate interests’ (i.e., to grow Xlash). At any time, you can opt-out from receiving our commercial communication free of charge by clicking on the “unsubscribe” link included in our newsletters or by contacting us directly.

2.9 When will you receive our transactional notices?

If we have your email address and it is necessary to do so, we may send you important informational messages, such as order updates, payment receipts, invoices, shipping information, and other technical or administrative emails. Please note that such messages are sent on an “if-needed” basis and they do not fall within the scope of commercial communication that may require your prior consent. You cannot opt-out from service-related notices.