Privacy policy

Last updated: 29 October 2026

This notice explains what personal data we process when you visit axigallery.com, buy a piece, sign up to our newsletter or write to us, why we do so and what rights you have. It is written under the UK GDPR and the Data Protection Act 2018 and under Regulation (EU) 2016/679 (the "EU GDPR").

1. Who we are

The controller is EXPENSIVE CHIODO LTD, a private limited company registered in England and Wales under number 16882749, registered office 82A James Carter Road, Mildenhall, Bury Saint Edmunds IP28 7DE, United Kingdom, trading as AXI Gallery. For any privacy question, or to exercise your rights, email info@axigallery.com or call +44 7882 738942.

2. What data we collect

  • Orders: name, delivery and billing address, email, telephone, pieces purchased, amounts, payment method (we never see or store full card numbers), messages about your order, returns and cancellations.
  • Customer account: if you create one, your email, name, saved addresses and order history. You sign in with a code sent by email.
  • Newsletter: email, language and country, the date of your consent and, in aggregate form, email opens and clicks.
  • Contact and cancellation: the details you enter in the "Contact" and "Cancel your contract here" forms (name, email, telephone, order number, pieces, message) and the date and time you sent them.
  • Shipment tracking: the tracking number you enter on the "Track your piece" page.
  • Browsing and cookies: IP address, device and browser type, pages viewed, items added to the bag, how you reached us and your cookie choices (see section 8).

The data needed for an order is marked at checkout: without it we cannot complete the sale. Everything else is optional.

3. Why we use it and our lawful basis

  • Handling orders, payments, delivery, returns, cancellations and your statutory rights: performance of our contract with you (Art. 6(1)(b) GDPR).
  • Running your account: performance of a contract, at your request.
  • Answering your messages: steps taken at your request before or under a contract, and our legitimate interest in helping you (Art. 6(1)(b) and (f)).
  • Meeting tax, accounting and customs obligations and keeping a record of cancellations: legal obligation (Art. 6(1)(c)).
  • Preventing fraud and protecting the website: legitimate interests (Art. 6(1)(f)).
  • Newsletter and offers by email: your consent (Art. 6(1)(a)), which you can withdraw at any time using the link at the bottom of every email.
  • Website statistics: in the UK, for statistics used only to improve the website, our legitimate interests, and you can object from the cookie banner; in the EU, your consent to statistics cookies.
  • Advertising on Meta (Facebook and Instagram) and campaign measurement: only with your consent to marketing cookies (Art. 6(1)(a)).
  • Defending our legal rights in a dispute: legitimate interests (Art. 6(1)(f)).

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Fraud checks on payments are carried out by the payment provider and, where in doubt, reviewed by a person.

4. Who we share it with

Your data is handled by our small team and by the providers below, each only as far as their service requires:

  • Shopify (Shopify International Limited, Ireland, and group companies), which hosts our shop, checkout and accounts: our processor. For some of its own features, such as Shop Pay, Shopify acts as an independent controller under its Consumer Privacy Policy.
  • Payment providers: Shopify Payments (with Stripe), Shop Pay, Apple Pay, Google Pay and the other methods shown at checkout. They process payment data as independent controllers under their own notices.
  • Express couriers that deliver or collect your piece (named in your shipping email) and, for UK deliveries, customs brokers: name, address, telephone, email and parcel contents.
  • 17TRACK, the tracking service built into the "Track your piece" page: it receives the tracking number you enter and technical data about your connection.
  • Shopify Email, to send service emails and, if you sign up, our newsletter.
  • Shopify Analytics, for visitor statistics.
  • Microsoft Clarity (Microsoft Ireland Operations Ltd): only if you accept statistics cookies, it records anonymously how you browse the website (clicks, scrolling, pages viewed) and creates heatmaps, so that we can see where the website is unclear and improve it. Text you type into fields is masked and checkout is not recorded. Microsoft processes the data under its own privacy statement.
  • Meta Platforms Ireland Ltd, through the WeTracked app that connects the Meta pixel to our shop (being set up): only if you accept marketing cookies, it receives information about pages viewed, items added to the bag and purchases, so that we can measure and improve our ads. Meta and we are joint controllers for collecting this data; Meta then processes it under its own privacy policy.
  • Advisers and authorities: accountants, lawyers and insurers bound by confidentiality, and public authorities where the law requires.

We do not sell your personal data, and we do not pass it to third parties for their own marketing.

5. International transfers

We are based in the United Kingdom, which the European Commission recognises as providing adequate protection. Some providers, such as Shopify, Meta, Microsoft, payment providers and 17TRACK, may also process data in other countries, including Canada and the United States. In those cases transfers rely on adequacy decisions (for example the UK Extension to the EU-US Data Privacy Framework, for certified companies) or on the International Data Transfer Addendum and the European Commission's Standard Contractual Clauses. You can ask us for more details at info@axigallery.com.

6. How long we keep it

  • Orders, invoices and cancellation records: as long as tax and accounting law requires, usually 6 years from the end of the financial year in the UK, and up to 10 years where Italian law requires.
  • Customer account: while it stays open; if you delete it, we keep only the order data we are legally required to keep.
  • Newsletter: until you unsubscribe; we then keep only a record of your consent and its withdrawal.
  • Customer service messages: up to 24 months after our last exchange, unless needed for an order or a dispute.
  • Cookies: for the period shown in the banner; marketing cookies for no more than 13 months.

If a dispute is ongoing, we keep the data needed until it is resolved.

7. Security

Our shop runs over an encrypted connection (HTTPS) and payments are handled by PCI DSS certified providers. Access to data is limited to the people who need it. No system is completely secure: if a breach affecting you occurs, we will inform you as the law requires.

On your first visit a banner asks which cookies you accept. You can accept all, reject all just as easily, or choose by category:

  • Necessary: run the bag, checkout, account and security, and remember your cookie choices. No consent needed.
  • Preferences: remember your language and country.
  • Statistics: tell us, in aggregate form, how the website is used (Shopify Analytics and Microsoft Clarity).
  • Marketing: the Meta pixel, enabled through WeTracked, to measure our ads and show you relevant ones.

Non-essential cookies are only set after you give consent. You can change your mind at any time from the "Cookie preferences" link at the bottom of every page, or by deleting cookies in your browser settings. Rejecting non-essential cookies does not stop you from buying.

9. Your rights

At any time, free of charge, you can ask us to:

  • give you access to your data and a copy of it;
  • correct or complete it;
  • erase it, except where we must keep it by law;
  • restrict its processing;
  • provide it in a machine-readable format or send it to another controller (portability);
  • stop processing based on our legitimate interests and, always, direct marketing;
  • withdraw your consent, without affecting processing already carried out.

Email info@axigallery.com: we reply within one month. We may ask you to confirm your identity, for example by writing from the email used for your order.

10. Complaints

If you think we are not handling your data lawfully, please tell us; you can also complain to a supervisory authority at any time:

  • in the United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk;
  • in Italy: Garante per la protezione dei dati personali, garanteprivacy.it;
  • in Spain: Agencia Española de Protección de Datos (AEPD), aepd.es;
  • elsewhere in the European Union: the authority of the country where you live or work, listed on the EDPB website.

11. Children

Our shop is intended for adults. We do not knowingly collect data from anyone under 18: if you believe a child has given us their data, please contact us and we will delete it.

12. Changes

We may update this notice when our services or the law change. The current version is always on this page with the date of the last update; if the changes are significant, we will also let you know by email or on the website.