Privacy policy

Privacy Policy

Last updated: September 27, 2025

Y-0-X operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Y-0-X is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase through the Services, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy.

1. Personal Information We Collect

“Personal information” means information that identifies or can reasonably be linked to you. This does not include anonymous or de-identified information.

We may collect or process the following categories of personal information, depending on your interactions with us and as permitted or required by law:

  • Contact details: name, billing/shipping address, phone number, email.

  • Financial details: payment card information, transaction details.

  • Account information: username, password, preferences, settings.

  • Transaction information: items viewed, added to cart, purchased, returned, exchanged.

  • Communications: messages, customer service inquiries.

  • Device information: IP address, browser type, operating system, identifiers.

  • Usage information: how you browse or interact with the Services.

We do not intentionally collect special category data (such as health, religion, ethnicity, or biometrics).

2. Sources of Personal Information

We collect personal information from:

  • Directly from you: when you create an account, make a purchase, contact us.

  • Automatically: when you use our Services (via cookies, device, and usage tracking).

  • From service providers: such as Shopify, payment processors, shipping partners.

  • From third parties/partners: such as marketing or advertising networks.

3. How We Use Personal Information

We use personal information for:

  • Providing and improving Services: fulfilling orders, processing payments, arranging shipping, managing accounts, facilitating returns, tailoring your shopping experience.

  • Marketing and advertising: sending promotional communications (with your consent where required), showing you relevant adverts online.

  • Security and fraud prevention: authenticating users, preventing fraud, ensuring safe transactions.

  • Communications: responding to inquiries, customer service.

  • Legal compliance: complying with applicable law, tax obligations, responding to lawful requests from authorities.

4. Lawful Bases for Processing (UK & EU GDPR)

Where UK or EU GDPR applies, we rely on the following legal bases:

Purpose Legal Basis
Processing and fulfilling orders Contract (Article 6(1)(b))
Marketing and advertising Consent (Article 6(1)(a)) or Legitimate Interests (Article 6(1)(f))
Account management and communications Contract (Article 6(1)(b)) or Legitimate Interests (Article 6(1)(f))
Security and fraud prevention Legitimate Interests (Article 6(1)(f))
Legal compliance (tax, recordkeeping, regulatory) Legal Obligation (Article 6(1)(c))

5. How We Disclose Personal Information

We may share your personal information with:

  • Shopify: to operate and improve the Services.

  • Service providers: IT hosting, payment processors, shipping and fulfilment partners, customer service providers.

  • Business and marketing partners: for targeted advertising, with your consent or as permitted by law.

  • Affiliates or corporate group members.

  • Legal or regulatory bodies: where required by law, legal proceedings, or to enforce our Terms.

  • Business transfers: such as mergers, acquisitions, or insolvency.

6. Relationship with Shopify

Our Services are hosted by Shopify. Shopify processes personal information to operate the platform and may also process it independently for analytics, fraud prevention, and advertising.

For details, see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

7. Cookies and Similar Technologies

We use cookies, pixels, and similar technologies to:

  • enable core site functionality,

  • analyse usage,

  • deliver personalised advertising.

By law, certain cookies (non-essential) require your consent. When you first visit our website, you will be presented with a cookie banner giving you the option to accept or manage cookie preferences.

For details, see our Cookie Policy [LINK].

8. Children’s Data

Our Services are not directed at children under 18. We do not knowingly collect data from minors. If you believe we hold information about a child, please contact us to delete it.

9. Security and Retention

We take appropriate security measures, but no system is 100% secure. Please protect your account credentials.

We retain personal information only as long as necessary:

  • Orders and transaction data: 6 years (for legal/tax obligations).

  • Marketing communications: until you withdraw consent or unsubscribe.

  • Account data: until your account is closed, plus a reasonable period.

10. Your Rights

Depending on where you live, you may have rights to:

  • Access/Know the personal data we hold.

  • Correct inaccuracies.

  • Delete your data.

  • Portability – receive your data in a portable format.

  • Opt out of targeted advertising or the “sale”/“sharing” of data.

  • Object or restrict processing (UK/EU only).

  • Withdraw consent (where processing is based on consent).

You may exercise these rights by contacting us at we@y-o-x.com. We may verify your identity before responding.

If you are in the UK, you also have the right to complain to the Information Commissioner’s Office (ICO):

If you are in the EU, you can contact your local Data Protection Authority: List of DPAs.

11. International Transfers

We may transfer, store, and process personal information outside your country (including to Canada, the US, and other countries where Shopify operates).

Where we transfer UK/EU data internationally, we rely on:

  • Adequacy decisions by the UK/EU, or

  • Standard Contractual Clauses (SCCs) or UK equivalents approved by regulators.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you as required by law. Please check this page for the latest version.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

Y-0-X
Email: we@y-o-x.com
Address:  4th Floor, 100 Fenchurch Street, London, EC3M 5JD, England
Company Registration Number: 16012843
VAT Number (if applicable): N/A

For the purposes of UK and EU data protection law, Y-0-X is the data controller of your personal information.