Privacy policy

Last updated: 23 October 2026

This Privacy Policy explains how Firexo Limited (“Firexo”, “we”, “us” or “our”) collects, uses and shares your personal data when you visit https://shop.firexo.com  (the “Site”), place an order or contact us.

1. Who we are

Firexo Limited is the controller responsible for the personal data processed in connection with our online store.

Company name: Firexo Limited
Registered office: 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF, United Kingdom
VAT number: GB325020357
Privacy contact email: Claire.breith@firexo.com

We process personal data in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, as amended. Our use of cookies and electronic marketing is also subject to the Privacy and Electronic Communications Regulations (“PECR”).

2. Personal data we collect

Depending on how you interact with us, we collect the following categories of personal data:

Contact and account information: your name, email address, telephone number, billing and delivery addresses, and account information if you create a customer account.

Order and transaction information: products purchased, order history, payment status, transaction references, delivery details, and information relating to returns, refunds or cancellations.

Payment information: information needed to process your payment through our payment providers. Card details are handled by the relevant payment provider. The information available to us depends on the payment method used and may include limited card information and transaction confirmations.

Customer service information: messages, enquiries, complaints and any information or attachments you provide when contacting us.

Device and usage information: your IP address, browser and device information, pages viewed, referring pages, interactions with the Site and cookie identifiers, subject to applicable cookie requirements.

Marketing preferences: your subscription choices, consent records and requests to stop receiving marketing.

We collect information directly from you, automatically through your use of the Site, and from service providers such as Shopify, payment providers and delivery companies. Information received from these providers may include payment confirmations, fraud indicators and delivery updates.

3. How we use your data and our lawful bases

We use your personal data only where we have an appropriate lawful basis.

Processing and fulfilling orders

We use your contact, order and transaction information to accept orders, process payments, arrange delivery, send order updates and manage returns or refunds.

Our lawful basis is the performance of our contract with you, or taking steps at your request before entering into a contract.

Customer enquiries and support

We use information you provide to answer questions and resolve issues. Depending on the enquiry, this is necessary to perform our contract with you or for our legitimate interests in providing customer support and managing our business.

Security and fraud prevention

We use relevant transaction, device and account information to protect the Site, detect suspicious activity, prevent fraud and investigate misuse.

Our lawful basis is our legitimate interests in protecting our customers, systems and business, and compliance with legal obligations where applicable.

Accounting, tax and legal requirements

We use and retain relevant records to meet accounting, tax, regulatory and other legal requirements.

Our lawful basis is compliance with our legal obligations.

Website performance and analytics

We use technical and usage information to operate, troubleshoot and improve the Site and understand how visitors use it.

Our lawful basis is our legitimate interests in maintaining and improving our store where permitted by law, or your consent where required. Cookies and similar technologies are subject to the separate requirements explained below.

Marketing

We use your contact information and preferences to send marketing where you have consented or where applicable law permits us to do so.

Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, these are our interests in promoting our own products to customers in accordance with applicable marketing rules.

Legal claims

We may use relevant records to establish, exercise or defend legal claims. Our lawful basis is our legitimate interests in protecting our legal rights.

Where we rely on legitimate interests, we consider the impact on your rights and freedoms.

Providing personal data for marketing is optional. If you do not provide information necessary to process an order, payment or delivery, we may be unable to fulfil your purchase.

4. Who we share your data with

We share personal data where necessary with:

  • Shopify, which provides the platform hosting and operating our online store;

  • payment providers, to process payments, refunds and payment disputes;

  • delivery and fulfilment providers, to prepare, dispatch and deliver orders;

  • IT and website service providers, to support hosting, security, maintenance and store functionality;

  • analytics and marketing providers, where used and permitted by your preferences and applicable law;

  • professional advisers, including accountants, auditors, insurers and legal advisers;

  • public authorities and regulators, where disclosure is required by law or otherwise lawfully justified.

We share only the information relevant to the purpose concerned.

Service providers may process information on our behalf or, for certain activities, act as independent controllers under their own privacy notices.

For information about Shopify’s processing, please see:
https://www.shopify.com/legal/privacy

5. International transfers

Our service providers operate internationally. Your personal data may therefore be processed outside the United Kingdom, including in the European Economic Area, Canada and the United States.

Where a transfer is subject to UK international transfer restrictions, we ensure that an appropriate legal mechanism applies. Depending on the recipient and destination, this may include UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.

You can contact us to request further information about the safeguards relevant to your data, including a copy where applicable, subject to necessary redactions.

Information about Shopify’s international data transfers is available at:
https://help.shopify.com/en/manual/privacy-and-security/privacy/international-data-transfers

6. Cookies and similar technologies

We use cookies and similar technologies to operate the Site, remember relevant preferences and, where enabled, understand website usage or support marketing.

These technologies may include:

  • Essential cookies, needed for functions such as the shopping basket, checkout, security and remembering privacy choices.

  • Preference cookies, which remember choices and personalise certain website functions.

  • Analytics cookies, which help measure how visitors use the Site.

  • Marketing cookies and pixels, which may measure advertising performance or support personalised advertising where such tools are enabled.

We obtain consent before using cookies or similar technologies where the law requires it. Essential technologies may operate without consent. Any other exemption is used only where its legal conditions are met.

Where consent is requested, you can accept or reject optional categories and change your choices through the Site’s cookie controls. Withdrawing consent does not affect processing carried out before withdrawal.

Information about the technologies enabled on the Site, including their providers, purposes and durations, is provided through our cookie information and preference controls.

You can also manage cookies through your browser. Blocking essential cookies may prevent parts of the Site, including checkout, from working correctly.

7. Marketing communications

We send marketing emails or text messages to individuals where they have consented, or where the existing-customer exception under applicable law permits this.

Where we use that exception, we market only our own similar products or services, obtain contact details during a sale or negotiations for a sale, and provide an opportunity to opt out both when collecting the details and in every subsequent marketing message.

You can stop marketing at any time by using the unsubscribe option in a message or contacting us.

Opting out of marketing does not stop essential communications about your orders, deliveries, refunds or product safety.

8. How long we keep your data

We retain personal data only for as long as necessary for the purpose for which it was collected, including applicable legal and record-keeping requirements.

We determine retention periods by considering:

  • accounting and tax record-keeping requirements;

  • the time needed to fulfil orders and manage returns, warranties and complaints;

  • applicable limitation periods for legal claims;

  • security and fraud-prevention needs;

  • whether an account or customer relationship remains active;

  • your consent, objections and marketing preferences.

We keep customer enquiries for the time needed to resolve them and address relevant follow-up issues. Where an enquiry relates to a transaction or legal dispute, it may be retained with the associated records.

When you unsubscribe, we may retain a minimal suppression record to ensure that we respect your choice.

Cookie durations depend on the technology concerned and are described in the relevant cookie information.

When personal data is no longer needed, we delete it securely or anonymise it. A request for deletion does not require us to remove records that we must lawfully retain.

9. Your rights

Depending on the circumstances and applicable law, you may have the right to:

  • access your personal data and receive a copy;

  • correct inaccurate or incomplete information;

  • request deletion;

  • request restriction of processing;

  • receive certain information in a portable format;

  • object to processing based on legitimate interests;

  • withdraw consent at any time;

  • request applicable safeguards in relation to significant decisions made solely by automated processing.

You have the right to object to the use of your personal data for direct marketing at any time.

These rights are subject to legal conditions and exceptions. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

To exercise your rights, contact us using the details in section 1. We may request proportionate information to verify your identity. We normally respond within one month, subject to any lawful extension or adjustment to that period. Requests are normally free of charge.

10. Fraud screening and automated processing

Shopify and payment providers may use automated tools to identify suspicious transactions and support payment security. These tools may assess transaction details, device information and indicators of potentially fraudulent activity.

If your order or payment is declined and you believe this is incorrect, contact us so that we can investigate and, where relevant, refer the matter to the payment provider.

Where a decision is made solely by automated processing and has a legal or similarly significant effect, we will provide the information and safeguards required by applicable law, including access to human intervention where required.

11. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Access is limited to people and service providers who need the information for their work. No online service or transmission method can be guaranteed completely secure.

12. Children’s privacy

Our store is intended for a general adult audience and is not directed at children. We do not knowingly collect children’s personal data for marketing or profiling.

If you believe a child has provided personal data to us, please contact us so that we can investigate and take appropriate action.

13. Complaints

If you have concerns about how we handle your personal data, please contact:

Firexo Limited
167-169 Great Portland Street, 5th Floor
London, England, W1W 5PF
United Kingdom

Email: Claire.breith@firexo.com

You also have the right to complain to the UK Information Commissioner’s Office (“ICO”). You do not have to contact us before raising a complaint with the ICO.

Information about making a complaint is available at:
https://ico.org.uk/make-a-complaint/

14. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our services, data processing or legal requirements.

The latest version will be published on this page with an updated date. Where required, we will also notify you directly or request fresh consent.