Controller: Xylaris OÜ

Registry code: 17292969

Address: Tallinn, Haabersti linnaosa, Kotlepi tn 7

Email: info@xylaris.eu

For privacy-related questions, requests, or concerns, please contact Xylaris at info@xylaris.eu.

Xylaris may collect and process the personal data needed to operate the online store, process orders, provide customer support, arrange delivery, and handle returns or warranty claims.

This may include:

• Name
• Email address
• Phone number
• Billing address
• Delivery address
• Company details, where applicable
• Order details
• Payment status and transaction reference information
• Customer account information
• Delivery and tracking information
• Return, refund, warranty, and support request information
• Product serial numbers, where needed for warranty or service handling
• Customer messages and communication history
• IP address
• Device, browser, and website usage information
• Cookie and consent preferences
• Security and technical log data

Xylaris does not intentionally collect more personal data than is necessary for operating the store, fulfilling orders, supporting customers, and complying with legal obligations.

Xylaris collects personal data when you:

• Visit the Xylaris website
• Create or use a customer account
• Place an order
• Enter billing or delivery details
• Contact us by email or through a contact form
• Request a return, refund, repair, or warranty claim
• Subscribe to marketing communications, if available
• Accept, reject, or manage cookies
• Use the website in a way that generates technical or security logs

Some personal data is provided directly by you. Other data may be generated automatically through website use, cookies, server logs, or technical tools.

Xylaris uses personal data for the following purposes:

• To operate the online store
• To create and manage customer accounts
• To process and confirm orders
• To process payments
• To arrange delivery
• To communicate with customers about orders
• To provide customer support
• To handle returns, refunds, defective products, and warranty claims
• To detect, prevent, and investigate fraud, abuse, or security issues
• To comply with accounting, tax, consumer protection, and legal obligations
• To improve the website, store structure, and customer experience
• To send marketing communications, where permitted
• To manage cookie preferences and website analytics, where applicable

Xylaris processes personal data under the following legal bases:

Performance of a contract. We process data to fulfil orders, process payments, arrange delivery, provide customer support, and handle returns, refunds, and warranty claims.

Legal obligation. We process and retain certain data to comply with accounting, tax, consumer protection, warranty, dispute resolution, and other legal obligations.

Legitimate interest. We may process data to protect the website, prevent fraud, improve the store, respond to customer requests, secure our systems, and manage business operations.

Consent. We rely on consent for certain optional activities, such as non-essential cookies, analytics tools, or marketing communications where required.

Customers may withdraw consent where processing is based on consent.

When you place an order, Xylaris processes the personal data required to complete the purchase. This may include your name, contact details, billing address, delivery address, order contents, payment status, and related order information.

Payment information may be processed by external payment service providers. Xylaris does not store full card details unless explicitly stated by the relevant payment provider and permitted by law.

Payment providers may process personal data according to their own privacy policies and legal obligations.

To deliver orders, Xylaris may share necessary personal data with delivery, logistics, supplier, distributor, fulfilment, or courier partners.

This may include:

• Customer name
• Delivery address
• Phone number
• Email address
• Order reference
• Delivery instructions
• Shipment and tracking data

Some products may be shipped directly from a supplier, distributor, or fulfilment partner to the customer. Xylaris remains the customer’s contact point for orders made through the Xylaris online store.

Customers are responsible for providing correct and complete delivery information.

When you request a return, refund, repair, replacement, warranty claim, or customer support, Xylaris may process the information needed to review and handle the request.

This may include:

• Order number
• Product details
• Product serial number
• Photos or videos of the product or packaging
• Description of the issue
• Delivery documents
• Communication history
• Warranty or service documentation
• Technical diagnostic information, where relevant

Where needed, Xylaris may share this information with suppliers, distributors, manufacturers, authorized service centers, couriers, or other service partners involved in resolving the issue.

The Xylaris website may use cookies and similar technologies to operate the website, remember preferences, improve performance, support security, and understand website usage.

Cookies may include:

• Essential cookies required for the website and checkout to function
• Preference cookies used to remember settings
• Analytics cookies used to understand website usage
• Security cookies used to protect the website

Non-essential cookies are used only where permitted by law and, where required, based on consent.

Customers can manage cookie preferences through the cookie banner or browser settings, where available.

Xylaris may use analytics tools to understand how visitors use the website, which pages are visited, how the store performs, and how the shopping experience can be improved.

Analytics may involve technical information such as device type, browser, approximate location, pages visited, referral source, and interaction data.

Where required, analytics tools are used based on consent.

Xylaris may send marketing emails, product updates, offers, or newsletters only where permitted by law.

Customers may unsubscribe from marketing communications at any time by using the unsubscribe link in the email or by contacting Xylaris at info@xylaris.eu.

Transactional emails related to orders, delivery, returns, refunds, warranty claims, account activity, or customer service are not marketing emails and may still be sent where necessary.

Xylaris may share personal data with trusted service providers and partners where necessary for the purposes described in this Privacy Policy.

These may include:

• Hosting and website service providers
• WordPress, WooCommerce, and related store technology providers
• Payment service providers
• Banks and financial service providers
• Suppliers, distributors, and fulfilment partners
• Couriers and delivery companies
• Manufacturers and authorized service centers
• Email and communication service providers
• Analytics and cookie technology providers
• Accounting, tax, legal, and compliance advisors
• Public authorities, where legally required

Xylaris does not sell customer personal data.

Some service providers used by Xylaris may process personal data outside Estonia or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, Xylaris will rely on appropriate safeguards where required by law, such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

Xylaris keeps personal data only for as long as necessary for the purposes for which it was collected.

Retention periods may depend on:

• The duration of the customer relationship
• Order fulfilment needs
• Accounting and tax obligations
• Consumer protection obligations
• Warranty and return handling
• Legal claims and dispute resolution
• Security and fraud prevention needs
• Consent withdrawal or account deletion requests

Order and accounting records may be retained for the period required by applicable accounting, tax, and legal obligations.

When personal data is no longer needed, Xylaris will delete, anonymize, or securely restrict it where appropriate.

Xylaris uses technical and organizational measures to protect personal data against unauthorized access, misuse, loss, alteration, or disclosure.

These measures may include access controls, secure systems, encrypted connections, account security, software updates, backups, monitoring, and restricted access to customer information.

No online system can be guaranteed to be completely secure, but Xylaris works to protect personal data in a reasonable and appropriate manner.

Under applicable data protection law, customers may have the right to:

• Request access to their personal data
• Request correction of inaccurate data
• Request deletion of personal data
• Request restriction of processing
• Object to certain processing
• Request data portability
• Withdraw consent where processing is based on consent
• Object to direct marketing
• Lodge a complaint with a supervisory authority

To exercise these rights, contact Xylaris at:

info@xylaris.eu

We may need to verify your identity before responding to a privacy request.

Some rights may be limited by legal obligations, accounting requirements, warranty obligations, fraud prevention needs, or other lawful reasons.

Xylaris does not intentionally use personal data for automated decision-making that produces legal or similarly significant effects on customers.

If this changes, this Privacy Policy will be updated.

The Xylaris online store is not directed at children.

Xylaris does not knowingly collect personal data from children without appropriate legal basis or parental authorization where required.

If you believe a child has provided personal data to Xylaris, please contact us at info@xylaris.eu.

The Xylaris website may contain links to third-party websites, services, manufacturer pages, payment providers, or other external resources.

Xylaris is not responsible for the privacy practices, content, or security of third-party websites. Customers should review the privacy policies of those third parties separately.

Xylaris may update this Privacy Policy from time to time.

The updated version will be published on this page with a new “Last updated” date.

If changes are significant, Xylaris may provide additional notice where appropriate.

For privacy questions, requests, or concerns, contact:

Xylaris OÜ

Email: info@xylaris.eu

Address: Tallinn, Haabersti linnaosa, Kotlepi tn 7

You also have the right to contact the Estonian Data Protection Inspectorate if you believe your personal data has been processed unlawfully.