xiau

Privacy Policy
Xiau Etsy Shop
Shop URL: https://www.etsy.com/shop/xiau
Last Updated: 18 February 2026

1. Introduction
Welcome to Xiau ("we", "our", or "us"), an Etsy shop located at https://www.etsy.com/shop/xiau. We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you interact with our shop on Etsy.
This policy is compliant with the General Data Protection Regulation (GDPR) for buyers in the European Union, as well as applicable data protection laws in other jurisdictions.
2. Data Controller
Xiau is the data controller responsible for your personal data collected through our Etsy shop. By purchasing from or contacting us via Etsy, you acknowledge this Privacy Policy.
For any privacy-related enquiries, please contact us through Etsy Messaging at: https://www.etsy.com/shop/xiau
3. What Personal Data We Collect
When you place an order or contact us through Etsy, we may receive and process the following personal data:
• Your name and username
• Delivery address (including country, city, postal code)
• Email address (provided via Etsy's messaging system)
• Payment information (processed exclusively by Etsy – we do not have access to your full payment details)
• Transaction and order details
• Messages and communications sent to us via Etsy Conversations
• Any additional information you voluntarily provide us (e.g., personalisation requests, gift messages)

Please note: Etsy may collect additional data on our behalf as part of its platform. Please refer to Etsy's own Privacy Policy at https://www.etsy.com/legal/privacy for full details.
4. How We Use Your Personal Data
We use your personal data only for the following legitimate purposes:
• To process and fulfil your orders, including packaging and dispatch
• To communicate with you about your order, including shipping updates and queries
• To comply with our legal obligations (e.g., tax records, consumer law)
• To resolve disputes or issues related to a transaction
• To provide customer support

We do not use your personal data for unsolicited marketing messages or share it with third parties for advertising purposes. This is strictly prohibited under Etsy's Seller Policy and our own commitment to your privacy.
5. Legal Basis for Processing (EU/EEA Buyers)
If you are located in the European Union or European Economic Area, we rely on the following legal bases for processing your personal data:
• Contractual necessity: Processing is necessary to fulfil a purchase contract with you (Article 6(1)(b) GDPR).
• Legal obligation: Processing is required to comply with applicable legal obligations, such as tax and accounting requirements (Article 6(1)(c) GDPR).
• Legitimate interests: Processing may be necessary to manage customer service and handle disputes (Article 6(1)(f) GDPR), provided these interests are not overridden by your rights.
6. Sharing of Personal Data
We do not sell or rent your personal data. We may share your data only with the following parties, and only to the extent necessary:
• Etsy Inc.: As our selling platform, Etsy processes your data in accordance with its own Privacy Policy.
• Postal and courier services: Your name and delivery address will be shared with the relevant delivery carrier to fulfil your order (e.g., Royal Mail, Evri, DPD, or international postal services as appropriate).
• Legal authorities: We may disclose your data if required to do so by law or in response to valid legal requests.

We do not share your personal data with any other third parties without your explicit consent.
7. International Data Transfers
If you are based in the EU/EEA and we dispatch your order internationally, your data (specifically your name and delivery address) may be transferred to countries outside the EU/EEA, including the United Kingdom, solely for the purpose of delivering your order.
Such transfers are conducted only with appropriate safeguards and in compliance with GDPR requirements. The UK is recognised as providing an adequate level of data protection by the European Commission.
8. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law:
• Order and transaction records are retained for up to 7 years for tax and accounting compliance purposes.
• Communications and messages via Etsy Conversations are retained as long as your Etsy account is active and/or as required to resolve disputes.

When your data is no longer needed, it will be securely deleted or anonymised.
9. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure ('right to be forgotten'): You may request deletion of your data, subject to any legal retention obligations.
• Right to restriction of processing: You may request that we limit how we use your data.
• Right to data portability: You may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests.
• Rights related to automated decision-making: We do not carry out any automated decision-making or profiling.

To exercise any of these rights, please contact us via Etsy Messaging. We will respond within 30 days. If you believe your rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority in your country (e.g., the ICO in the UK at https://ico.org.uk, or your local EU data protection authority).
10. Data Security
We take the security of your personal data seriously. While we rely on Etsy's platform infrastructure for the majority of data security, we take all reasonable steps within our control to protect your data from unauthorised access, disclosure, alteration, or destruction.
Please be aware that no method of transmission over the internet is 100% secure. If you have concerns about the security of your data, please contact us immediately.
11. Cookies
Our Etsy shop itself does not directly use cookies. However, Etsy's platform may use cookies when you browse our shop. Please refer to Etsy's Cookie Policy at https://www.etsy.com/legal/cookies for full details.
12. Children's Privacy
Our shop is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately so we can delete it.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will indicate the date of the most recent update at the top of this document. We encourage you to review this policy periodically.
14. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us through Etsy Messaging:
https://www.etsy.com/shop/xiau
We are committed to resolving any privacy concerns promptly and transparently.