On this page
Who we are
Vexon Group LTD, trading as vxolt, is the data controller for the personal data collected through this website. Company number 16879644. Registered office: 15 Seaside Road, Eastbourne, United Kingdom, BN21 3PP. Information Commissioner's Office registration: [ICO NUMBER]. For anything about your data, email us.
What we collect, and why
*To take and deliver your order:* your name, email address, delivery and billing addresses, phone number if you give one, what you bought and what you paid. Legal basis: performing our contract with you.
*To take payment:* payment is handled by our payment provider. Your card details go directly to them and never reach our servers; we hold only a reference to the transaction and the last four digits of the card.
*To keep your account:* your sign-in details, order history, saved addresses and preferences. Legal basis: our contract with you.
*To answer you:* the messages you send us and our replies. Legal basis: our legitimate interest in running the shop and yours in getting an answer.
*To send marketing email:* only if you opt in. You can unsubscribe from every message with one click, or in your account.
*To understand how the site is used:* anonymous analytics about pages, searches and checkouts, tied to a random identifier rather than to you, and only if you accept analytics cookies.
*To prevent fraud and abuse:* the internet address a request comes from, used to rate-limit sign-in attempts and checkout, and kept for a short time.
We do not sell personal data, and we do not use it for automated decisions with legal or similar effects on you.
Who processes it for us
Data leaves us only to the providers we need to run the shop, each under a contract that limits what they may do with it: our payment provider(s) (Stripe, and PayPal where offered) for payments; the carrier named in your dispatch email, who receives your name, address and phone number to deliver; our email delivery provider (Amazon Web Services) for order and account emails; our hosting and storage providers, on whose infrastructure the site and its media run; and Cloudflare, which sits in front of the site to keep it fast and protect it. Where a provider processes data outside the UK, transfers are covered by the UK's adequacy decisions or the International Data Transfer Agreement.
How long we keep it
Order records for six years after the order, because tax law requires it. Your account for as long as you keep it. Marketing consent until you withdraw it, after which we keep only the record that you did. Messages for two years. Anonymous analytics for 13 months.
Your rights
You can ask for a copy of the personal data we hold, ask us to correct it, ask us to delete it, object to our use of it, or ask us to stop marketing to you. Export and deletion can be requested from your account or by emailing us; we act within one month. Some data survives deletion because the law requires it — the order and tax records above — and we keep only the minimum needed for that. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Cookies
See the Cookie policy for what we set and how to change your choice.
Changes
If we change this policy in a way that matters, we say so on this page with the date. Last updated: 14 September 2026.