1. About this Privacy Policy
This Privacy Policy applies when you use our website, create an account, place an order, contact us or interact with our services.
For UK data protection purposes, X London Group Ltd is the controller of the personal information described in this Privacy Policy.
2. Contact details for privacy matters
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, contact us at hello@snusvillage.com or write to X London Group Ltd, 339 Oxford Street, London, England, W1S 1SQ.
3. Personal information we collect
- Account, identity and contact details, including name, date of birth, billing address, delivery address, email address, phone number, login details and customer reference details.
- Order and transaction information, including order history, products ordered, basket contents, payment status, delivery tracking, returns, refunds, customer service messages and complaint records.
- Age verification information required to verify age and identity through Didit, including verification result, identity document information, liveness or biometric check results, audit logs and compliance evidence where needed.
- Payment information processed through SumUp. We do not store full card numbers on our website.
- Delivery information shared with Royal Mail where needed to deliver your order.
- Technical and usage information including IP address, browser type, device type, operating system, pages viewed, referring pages, approximate location, cookie identifiers and session data.
- Marketing information, where you subscribe or where the law allows.
4. How we use personal information
- To operate the website, manage accounts and provide customer service.
- To process orders, take payment through SumUp, dispatch orders and manage delivery through Royal Mail.
- To verify age and identity through Didit and prevent underage sales.
- To prevent fraud, misuse, unauthorised payments and unlawful activity.
- To handle returns, refunds, complaints, disputes and product issues.
- To send order confirmations, service messages, delivery updates and customer support replies.
- To comply with legal, tax, accounting, age-restriction and regulatory obligations.
- To improve our website, products, customer experience, security and business operations.
- To send marketing where permitted by law and in line with your preferences.
5. Lawful bases for processing
We process information where necessary for contract performance, legal obligations, legitimate business interests and consent where required.
Legitimate interests may include fraud prevention, website security, customer support, record-keeping, service improvement and protection of our legal position.
You can withdraw consent for certain marketing communications and non-essential cookies at any time.
6. Age verification through Didit
We use Didit to help confirm that customers are aged 18 or over. Didit may process information directly as part of the verification flow and may have its own privacy information explaining how it handles personal data.
We may receive and store the verification outcome and limited audit information needed to prove that a check was completed, failed or requires review.
If verification is incomplete or fails, we may refuse access, cancel an order, request further information or suspend an account.
7. Payments through SumUp
Payments are processed through SumUp. SumUp may collect and process payment information, transaction information, fraud-prevention information and related technical data as necessary to process payments and comply with financial laws.
We receive payment confirmation, transaction references and payment status information. We do not store full payment card details on our website.
8. Delivery through Royal Mail
We share information with Royal Mail where necessary to dispatch, track, deliver, investigate or resolve delivery issues. This may include your name, delivery address, contact details, order reference, tracking details and any delivery instructions.
9. Marketing
We may send marketing emails or messages where you have opted in or where the law allows us to contact existing customers about similar products and services.
You can unsubscribe at any time using the unsubscribe link in our messages or by contacting hello@snusvillage.com. We do not sell personal information to advertisers.
10. Cookies and similar technologies
Our website may use cookies and similar technologies to keep the site working, remember basket and login details, understand site performance, improve user experience, support security and, where permitted, support marketing or analytics.
You can manage cookies through your browser settings and through any cookie controls made available on our website.
11. Sharing personal information
We may share personal information with trusted service providers and third parties where necessary, including Didit, SumUp, Royal Mail, website hosting providers, IT and security providers, analytics providers, email/SMS providers, fraud-prevention services, professional advisers, insurers, regulators, courts, law enforcement and public authorities where required.
We require service providers to handle personal information appropriately and only for authorised purposes.
12. International transfers
Some providers may process personal information outside the UK. Where this happens, we will take appropriate steps designed to protect the information, such as using UK-approved contractual safeguards, adequacy arrangements or other lawful transfer mechanisms where required.
13. How long we keep information
We keep personal information only for as long as necessary for the purposes described in this Privacy Policy, including to fulfil orders, provide support, comply with legal obligations, resolve disputes, prevent fraud and protect our legal position.
- Order, tax and accounting records may be kept for up to 6 years or longer if required by law.
- Customer service and complaint records may be kept for as long as needed to resolve the issue and protect our legal position.
- Age verification records are kept only as long as necessary for compliance, audit, fraud prevention and legal defence.
- Marketing records are kept until you unsubscribe, withdraw consent or the information is no longer needed.
- Technical logs and analytics records are kept according to operational and security needs.
14. Security
We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. No website, payment system or online service can be guaranteed to be completely secure, but we work to keep our systems and providers secure.
15. Your data protection rights
Under UK data protection law, you may have rights to access your personal information, request correction, request deletion, restrict processing, object to processing, request data portability, withdraw consent and complain to the Information Commissioner's Office.
These rights do not always apply in every situation. To exercise your rights, contact hello@snusvillage.com. We may need to verify your identity before responding.
16. Children
Our website and products are not intended for anyone under 18. We do not knowingly sell to under-18s. If we believe a person under 18 has used our website, created an account or placed an order, we may delete relevant information, cancel the order and take steps to prevent further access.
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The latest version will be published on our website with the effective date.