Privacy policy
How we look after the data of everyone who shops, joins the crew or follows the wall.
Last updated: 3 October 2026 · Applies to: customers, members and visitors · Questions: privacy@graffitixchange.com
The short version
We use your data to make, deliver and support your order, run your Xchange Card and, if you agree, tell you about new drops. We never sell your personal data, and artists never see it. Email privacy@graffitixchange.com to use any of your rights.
1. Who we are
Graffiti Xchange is the controller of your personal data. Our privacy contact is privacy@graffitixchange.com.
2. Who this policy covers
Customers, website visitors, Xchange Card members, people on our mailing list or WhatsApp Channel, people who contact us, and people who follow or message us on social media. Artists receive our separate Artist Privacy Notice.
3. The data we collect
| Type | Examples |
|---|---|
| Identity and contact | Name, email, phone, delivery and billing address |
| Orders | What you bought, order history, returns. Our payment providers process your card, and we never see or store your full card number |
| Membership | Login details, Xchanger number, card class, community level, city, the artist behind your first piece, size preferences, and your birthday (day and month only) if you give it |
| Marketing preferences | Whether you agreed to email, SMS or WhatsApp messages, and how you interact with them |
| Communications | Emails, chats, social messages and call notes |
| Content you share | Photos, videos and reviews you share with us or tag us in |
| Technical | IP address, device and browser, pages viewed and cookie data, as set out in our Cookie Policy |
We do not ask for sensitive information such as health, religion or ethnicity. Please do not send it to us.
4. Where we get your data
- From you, when you order, sign up, enter a promotion or contact us.
- Automatically, through cookies when you use our website.
- From partners, such as payment providers, delivery companies and social platforms when you interact with our pages.
5. How we use your data and our lawful basis
| What we do | Lawful basis |
|---|---|
| Take, print, deliver and support your order, including sending it to our print partners | Contract |
| Run your account, issue and post your Xchange Card, and manage membership | Contract |
| Handle cancellations, returns, refunds and complaints | Contract and legal obligation |
| Keep financial and tax records | Legal obligation |
| Prevent fraud and keep our store secure | Legitimate interests: protecting our business and customers |
| Understand how our store is used and improve it | Legitimate interests, and consent where cookies require it |
| Personalise membership, such as your level, artist updates and birthday messages | Legitimate interests: giving members a relevant experience |
| Send marketing by email, SMS or WhatsApp | Consent, or the soft opt in described in section 6 |
| Show you ads on social platforms | Consent, through our cookie banner |
| Feature content you tag us in | Consent, which we ask for before reposting |
Automated decisions. Your card class and Xchanger number are assigned automatically, in the order first orders are confirmed. This has no legal or similarly significant effect on you, and we make no other automated decisions about you. You can still ask a person to review your number or class.
6. Marketing
We send marketing only if you agree, or if you bought from us and did not opt out when we gave you the chance, and only about similar products. That second route is called the soft opt in. Every message includes a simple way to unsubscribe, and you can also email privacy@graffitixchange.com.
WhatsApp. Following our WhatsApp Channel does not show your phone number to us or to other followers. Our private WhatsApp Community groups, open to selected members from November 2026, work differently: other members of a group can see your phone number and profile. We will remind you of this before you join, and you can leave at any time.
7. Who we share data with
- Shopify, which hosts our store.
- Printify and its print providers, which print and send your order and receive your name, address and order details.
- Payment providers, such as Shopify Payments and PayPal.
- Delivery companies, which receive your name, address and contact details.
- Klaviyo, our email and SMS platform.
- Meta, TikTok and Google, through cookies you accept and when you interact with our pages.
- Our card production and mailing provider, which receives your name, Xchanger number, class and address to post your card.
- Professional advisers, insurers, HMRC and other authorities where the law requires.
- Our partner businesses, including Needles Hub, and any buyer of our business, who must protect your data in line with this policy.
Artists never receive your personal data. Royalty statements show sales totals only. We never sell your personal data.
8. International transfers
Some providers store or access data outside the UK, for example in the European Economic Area, Canada or the United States, including Shopify, Printify and Klaviyo. We protect it using UK adequacy regulations, the UK Extension to the EU US Data Privacy Framework for certified organisations, or approved contract terms such as the UK International Data Transfer Agreement. Email privacy@graffitixchange.com for details.
9. How long we keep your data
| Data | How long |
|---|---|
| Orders, payments and tax | 6 years from the end of the financial year, as tax law requires |
| Customer account | Until you close it, or after 3 years of no activity |
| Xchanger number record | While your account is open, we keep your number, name and class. After it closes, we keep only the number and class, never your name, because numbers are never reissued |
| Marketing preferences | Until you unsubscribe. We keep a suppression record so we respect your choice |
| Customer service messages | 2 years after the enquiry closes |
| Content you share | Until you ask us to remove it |
| Cookie data | As set out in our Cookie Policy |
We then delete or anonymise data securely.
10. Keeping your data safe
We use trusted providers with strong security, limit access to people who need it, use secure connections and require our partners to protect your data. If a breach is likely to put you at high risk, we will tell you without undue delay.
11. Your rights
You have the right to:
- Access a copy of your personal data.
- Correct data that is wrong or incomplete.
- Delete your data in certain circumstances.
- Restrict how we use it in certain circumstances.
- Receive your data in a portable format, or have it sent to another organisation.
- Object to uses based on legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, where we rely on it.
- Ask a person to review any automated decision.
Email privacy@graffitixchange.com. We may need to confirm your identity. We respond within one month, or within three months for complex requests, and will tell you if we need longer. There is normally no charge.
12. Complaints
If you are unhappy with how we use your data, contact privacy@graffitixchange.com first. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
13. If you are in Nigeria
The Nigeria Data Protection Act 2023 gives you rights similar to those in section 11. Use them by emailing privacy@graffitixchange.com. You may also complain to the Nigeria Data Protection Commission. When we transfer data between Nigeria and the UK, we use the safeguards that law requires.
14. Children
Our store is not intended for children under 16, and we do not knowingly collect their data for marketing. Our WhatsApp Community and artist programme are for people aged 18 and over. If you think a child has given us their data, email privacy@graffitixchange.com and we will delete it.
15. Content, press and other enquiries
To ask us to remove a photo or post of you, email privacy@graffitixchange.com. Press and partnership enquiries go to media@graffitixchange.com. Intellectual property complaints go to legal@graffitixchange.com.
16. Other websites
Our site links to social media and other websites. Their privacy practices are their own, so please read their policies.
17. Changes to this policy
We may update this policy. The latest version is always on this page with its date. If changes are significant, we will tell you by email or on our website.
Talk to us
| support@graffitixchange.com | Orders, delivery, cancellations, returns |
| privacy@graffitixchange.com | Your data, rights requests, cookies |
| legal@graffitixchange.com | Legal and intellectual property matters |
| media@graffitixchange.com | Press and partnerships |
| artist@graffitixchange.com | Artist applications and signed artists |
Version 1.0 · 3 October 2026