Privacy Policy

HomePrivacy Policy

XOR Solutions Limited

Effective date: 27 May 2025

1. Who We Are – Data Controller

This Privacy Policy (“Policy”) explains how XOR SOLUTIONS LIMITED (“XOR”, “we”, “us”) collects, uses, shares and safeguards personal data when you visit https://art-galaxy.com or purchase downloadable AI-prompt files (“Digital Content”).
XOR SOLUTIONS LIMITED is a company incorporated in England & Wales (Company No. 15744696) with its registered office at Flat 44 Ennerdale House, 121 Hamlets Way, London E3 4TY, United Kingdom.
For GDPR / UK-GDPR purposes, we are the data controller.

2. Personal Data We Process

CategoryTypical itemsSourceLawful basis (Art. 6 UK-GDPR)
Identity & ContactName, e-mail, postal address, phoneCheckout, contact form (captures name, e-mail, message)Contract; Legitimate Interest
AccountUsername, hashed password, purchase historyRegistration / checkoutContract
TransactionOrder ID, amount, currency, payment token (last 4 digits), VAT infoPSPs (e.g. Stripe / PayPal)Contract; Legal Obligation
TechnicalIP address, browser, OS, device ID, time zoneSite logs, security toolsLegitimate Interest
Usage / AnalyticsPage views, clickstream, cart activity, referrer URLWooCommerce & WordPress analytics codeConsent (non-essential cookies); Legitimate Interest
Marketing PreferencesConsent status, mailing-list interactionsNewsletter sign-upConsent

We do not intentionally collect special-category data or data on children under 16.

3. How We Collect Data

  • Directly from you – when you create an account, complete checkout, submit a contact form or sign up to marketing.
  • Automatically – via cookies, pixels and similar technologies (see Section 6).
  • From third-party providers – our payment processors relay limited transaction metadata; analytics vendors provide aggregated usage metrics.

4. Purposes & Lawful Bases

PurposeLegal basis
Fulfil orders, provide downloads, issue invoicesContract (Art. 6 (1)(b))
Respond to enquiries and support ticketsContract; Legitimate Interest
Prevent fraud, secure the Site, maintain backupsLegitimate Interest (IT security)
Comply with tax, accounting and sanctions regulationsLegal Obligation (Art. 6 (1)(c))
Send product updates & marketingConsent (opt-in; Art. 6 (1)(a))
Improve products, user experience and analyticsLegitimate Interest; Consent for non-essential cookies

Where we rely on legitimate interests, we balance our interests against your rights and freedoms.

5. Sharing & Disclosure

We share personal data only with:

  • Payment service providers to process transactions.
  • Hosting & IT vendors (EU-based servers; WordPress / WooCommerce stack).
  • Analytics providers (e.g. Google Analytics) for aggregated site metrics.
  • Professional advisers (lawyers, accountants, auditors).
  • Regulators or law-enforcement when legally required.

All processors are bound by contracts that meet Art. 28 UK-GDPR standards.

6. Cookies & Similar Technologies

We use essential cookies for core functionality and optional cookies for analytics and marketing. A granular consent banner is displayed on first visit. Full details are set out in our Cookie Policy. You may withdraw consent at any time via the banner settings.

7. International Transfers

Some vendors are located outside the UK/EEA (e.g. US-based analytics providers). Where transfers occur we rely on:

  • Adequacy decisions (e.g. EU–US Data Privacy Framework), or
  • Standard Contractual Clauses (SCCs) with supplementary measures.

8. Data Security

We implement proportionate technical and organisational measures, including:

  • TLS encryption in transit;
  • Regular patching of WordPress core and plugins;
  • Role-based access controls;
  • Off-site encrypted backups;
  • PCI-DSS-compliant payment processing (card data never touches our servers).

9. Retention Periods

Data setRetention rule
Order & invoice records6 years from the end of the financial year (HMRC requirements)
Customer accountActive while account exists; deleted within 30 days of closure
Marketing consent logsUntil consent withdrawn + 2 years for audit
Contact-form correspondence12 months from final response
Analytics data26 months (Google Analytics default)

We may anonymise data for statistical purposes beyond these periods.

10. Your Rights

Under UK-GDPR / GDPR you may:

  • Access your data;
  • Correct inaccurate data;
  • Erase data (“right to be forgotten”);
  • Restrict or object to processing;
  • Port data to another provider;
  • Withdraw consent at any time (marketing & cookies);
  • Lodge a complaint with the Information Commissioner’s Office (ICO) or your local EU supervisory authority.

Requests are free of charge and can be made via the contact details below.

11. Children

The Site is not directed at children under 16. We do not knowingly collect their data; if we learn that we have, we will delete it promptly.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be highlighted on the Site and, where feasible, notified by e-mail.

13. Contact & Data Protection Officer

For any privacy questions or to exercise your rights, contact:

Data Protection Officer
XOR SOLUTIONS LIMITED
E-mail: privacy@art-galaxy.com
Postal: Flat 44 Ennerdale House, 121 Hamlets Way, London E3 4TY, UK

If you remain dissatisfied, you may complain to the ICO (www.ico.org.uk).

Version 1.0 – 27 May 2025
Supersedes any privacy notices previously displayed on art-galaxy.com or its predecessor templates.

Your Shopping cart

Close