Privacy policy

Last updated: October 27, 2025

Privacy Policy

Effective date: 27 October 2025
Who we are: JacuX of 37 West Street, Marlow, Buckinghamshire, ENG, SL7 2LS, United Kingdom ("JacuX", "we", "us").
Contact: info@jacux.com
Scope: This policy explains how we collect, use, disclose and protect personal information when you visit our website, shop with us in‑store, contact us, or otherwise use our services (the Services). Our online store is hosted by Shopify.

Important: This policy is designed to be clear and readable. It contains a Global Core that applies to everyone, plus Country/Region Supplements with extra information and rights for residents of the UK & Ireland, the United States, Canada, Australia, and New Zealand.

1) Personal information we collect

We collect information that identifies or can be reasonably linked to you. The types of personal information we may collect include:

  • Identity & contact – name, email, telephone, billing and delivery addresses.

  • Account – login/email, password, preferences and settings.

  • Orders & transactions – items viewed or purchased, cart activity, returns/exchanges, payment status and history.

  • Payment – payment method and status. (Full card details are processed by our payment provider(s); we do not store complete card numbers.)

  • Communications – emails, messages, and notes from calls with our customer service.

  • Device & usage – IP address, device/browser type, pages viewed, time on page, referring URLs, approximate location and cookie IDs. See Cookies below.

  • User content – product reviews, photos, or other content you submit or tag us in (where permitted).

  • In‑store – purchase information; CCTV at our premises for security (signs are displayed on site).

2) Where we get your information

  • Directly from you – when you browse, place an order, create an account, contact us, or sign up for marketing.

  • Automatically – via cookies, pixels and similar technologies when you use the Services.

  • From service providers – e.g., payments, delivery, analytics, email, and customer support platforms acting on our instructions.

  • From partners or social platforms – where you interact with our content or integrations.

3) How and why we use your information (purposes & legal bases)

We only use your information where permitted by law, to:

  • Provide the Services and fulfil your order (take payment, deliver products, manage returns, provide customer support).
    Legal bases (UK/EU/EEA): Contract; Legal obligation for invoicing/tax.

  • Operate, secure and improve our website and operations (troubleshooting, analytics, testing, fraud prevention).
    Legal bases (UK/EU/EEA): Legitimate interests (running and protecting our business) balanced against your rights.

  • Personalise your experience (remember preferences, recommend products).
    Legal bases (UK/EU/EEA): Legitimate interests; Consent where required (e.g., for non‑essential cookies).

  • Send service messages (order and policy updates).
    Legal bases (UK/EU/EEA): Contract / Legal obligation.

  • Direct marketing by email/SMS/post and online adverts. We use consent where required by law and the soft opt‑in for existing customers where permitted. You can opt out at any time.
    Legal bases (UK/EU/EEA): Consent or Legitimate interests (soft opt‑in); see regional supplements for specific rules.

  • Comply with laws and enforce our terms (tax, reporting, responding to lawful requests, preventing fraud).
    Legal bases (UK/EU/EEA): Legal obligation; Legitimate interests.

4) Shopify and other providers

Our store runs on Shopify. For most store operations, we are the data controller and Shopify acts as our processor under its Data Processing Addendum. For certain enhanced/aggregated services, Shopify may act as an independent controller (see Shopify’s privacy materials). We also use trusted providers for payments, delivery, marketing, analytics and IT/security—each only processes your data to provide their service to us and must keep it secure.

5) Cookies, analytics & similar technologies

  • We use essential cookies to make the site work (e.g., basket, checkout, security).

  • We use optional cookies (analytics, performance and advertising/retargeting) only where the law requires consent.

  • You can manage or withdraw your consent at any time via our cookie banner or the preference centre. Browser settings may also allow you to delete or block cookies.

  • See the Country/Region Supplements for local rules and your choices, and ask us for our current cookie list if you’d like the full table.

6) Who we share information with

We share information with the following categories of recipients for the purposes above:

  • Shopify (store platform/hosting);

  • Payment providers (e.g., Shopify Payments/PayPal/Stripe) for secure payments;

  • Couriers/fulfilment partners to deliver your order;

  • Email & communications tools (e.g., Klaviyo/Mailchimp/SMS) where you have opted in or we rely on soft opt‑in;

  • Analytics & advertising partners (e.g., Google, Meta) where you have consented to non‑essential cookies;

  • Professional advisers (accountants, auditors, insurers, lawyers);

  • Authorities where required by law.

We do not sell personal information in the ordinary sense. In some jurisdictions, certain online advertising or data sharing may count as a “sale” or “share”—see the United States supplement for opt‑out rights.

7) International transfers

We are UK‑based and use providers around the world. Where your information is transferred outside your country (for example, from the UK/EEA to the US), we rely on adequacy decisions (where available) or approved transfer safeguards (such as Standard Contractual Clauses and—if applicable—the UK addendum). We also assess vendors’ security and require appropriate contractual protections.

8) How long we keep information

We keep your information only as long as necessary for the purposes in this policy, for example: orders & tax records – up to 7 years; customer support – around 24 months; marketing – until you opt out or consent expires. We then delete or anonymise it.

9) Security

We use organisational and technical measures appropriate to our size and the nature of the data (access controls, encryption in transit, staff training, regular platform updates). No system is 100% secure.

10) Children

Our Services aren’t intended for children and we don’t knowingly collect data from anyone under 13. If a child has provided information, please contact us and we’ll delete it.

11) Automated decision‑making

We do not make decisions with legal or similarly significant effects solely by automated means. We may use limited profiling (e.g., segmenting customers by purchase history) to tailor offers—you can object at any time (see Your rights).

12) Your rights – global summary

Your privacy rights depend on where you live. Generally, you can request access, correction, deletion, and portability of your personal information, object to or restrict certain processing (including direct marketing), and withdraw consent where that’s our legal basis. See the supplements below for country‑specific rights and how to exercise them.

To make a request, email info@jacux.com. We may need to verify your identity before acting on your request. Where allowed, you may authorise an agent to act for you.

Country/Region Supplements

A) United Kingdom & Ireland (UK GDPR / DPA 2018 / PECR; EU GDPR & ePrivacy)

Controller: JacuX (details above).
Legal bases: We rely on Contract, Legitimate interests, Consent, and Legal obligation as set out in Section 3.
Direct marketing & cookies: We will only send electronic marketing with your consent or under the soft opt‑in for our existing customers about similar products (you can refuse at collection and in every message). Non‑essential cookies (including analytics/ads) require consent.
Your rights: to be informed; access; rectification; erasure; restriction; portability; objection (including to direct marketing); and rights related to automated decision‑making.
Complaints: UK residents may complain to the Information Commissioner’s Office (ICO). Ireland residents may complain to the Data Protection Commission (DPC). Contact details are available on their websites.

EU/UK representatives: If the law requires us to appoint an EU or UK representative, we will publish their contact details here.

B) United States (including California)

Depending on your state, you may have rights under state privacy laws (e.g., California, Colorado, Connecticut, Utah, Virginia), including the right to know/access, delete, correct, and to opt out of:

  • “Sale” or “Sharing” of personal information;

  • Targeted advertising;

  • Profiling that produces legal or similarly significant effects.

We do not collect sensitive personal information for inferring characteristics. If we ever use sensitive information, you may have the right to limit its use.

You (or your authorised agent) can exercise US state rights via info@jacux.com. If we deny your request, you may have a right to appeal—we’ll explain how. We will not discriminate against you for exercising your rights.

C) Canada (PIPEDA; CASL)

We handle personal information in accordance with PIPEDA where it applies. You have rights to access and correct your information, and to withdraw consent (subject to legal/contractual restrictions and reasonable notice). For commercial electronic messages, we follow CASL: we use consent (express or implied as defined by law), identify ourselves in messages, and include unsubscribe mechanisms.

Complaints can be made to us (see contact above) or to the Office of the Privacy Commissioner of Canada.

D) Australia (Privacy Act 1988; Australian Privacy Principles)

We manage personal information under the Australian Privacy Principles (APPs). You may request access to and correction of your personal information. For commercial electronic messages, we comply with the Spam Act 2003 (including consent and unsubscribe requirements). You may complain to the Office of the Australian Information Commissioner (OAIC) if you’re not satisfied with our response.

E) New Zealand (Privacy Act 2020)

We follow the Information Privacy Principles under the Privacy Act 2020. You have rights to access and correct your information. For commercial electronic messages, we comply with the Unsolicited Electronic Messages Act 2007 (consent and unsubscribe requirements). You may complain to the Office of the Privacy Commissioner if needed.

13) Changes to this policy

We may update this policy from time to time. We’ll post the latest version here and adjust the Effective date above. If changes are significant, we’ll provide additional notice where required by law.

14) How to contact us

Questions, requests or complaints about privacy?
Email: info@jacux.com
Post: JacuX, 37 West Street, Marlow, Buckinghamshire, ENG, SL7 2LS, United Kingdom