Privacy policy

Privacy Policy

Last updated: September 12, 2026

1. Who We Are

This website (exytz.com) is operated by Kostiantyn Stanchenko, a self-employed individual entrepreneur ("Autónomo") registered in Spain, NIF / Registry code: Z2012778F, EU VAT number / Local tax number: ESZ2012778F, registered business address: AV CONDES DE SOTO AMENO 54, Es:1 Pl:04 Pt:DR, 03005 ALICANTE/ALACANT (ALICANTE), Spain ("we," "us," "our").

We are the data controller responsible for the personal data described in this policy. Because we are established in Spain, the EU General Data Protection Regulation (GDPR) applies to our processing of personal data as a matter of our own location, in addition to any other laws described below that apply because of where you are located.

We sell our products exclusively to customers in the United States, Canada, Australia, New Zealand, and the United Kingdom. This policy explains what personal data we collect from visitors and customers in those countries, why, and what rights you have.

2. Personal Data We Collect

Data you give us directly:

  • Name, email address, billing/shipping details, and phone number provided at checkout
  • Payment details (processed directly by our payment processor(s) — we do not store full card numbers ourselves)
  • Information you provide during onboarding (e.g., on a live Zoom call), in support emails, or through contact forms
  • Any account credentials if you create an account on the store

Data collected automatically:

  • IP address, browser type, device type, operating system
  • Pages visited, time on site, referring URL, clickstream data
  • Cookies and similar technologies (see Section 5)

Data from third parties:

  • Confirmation and fraud-check data from our payment processor
  • Ad interaction data from Google Ads (see Section 5) when you arrive via one of our ads

3. How We Use Your Data and Our Legal Basis

Purpose Legal basis (GDPR/UK GDPR)
Process your order and deliver the digital asset (Transfer) Performance of a contract
Provide onboarding, support, and respond to enquiries Performance of a contract / legitimate interest
Fraud prevention and payment verification Legitimate interest / legal obligation
Send order confirmations and service updates Performance of a contract
Marketing emails about new listings or offers Consent (where required) or legitimate interest, with an opt-out in every email
Advertising and conversion tracking (Google Ads) Consent (via cookie banner, where required)
Complying with tax, accounting, and legal obligations Legal obligation

We do not sell your personal data to third parties for their own marketing purposes.

4. Who We Share Data With

  • Shopify — our e-commerce platform provider, which processes order, customer, and payment-related data on our behalf as a data processor.
  • Payment processors (e.g., Shopify Payments, PayPal, or other processors made available at checkout) — to process your payment.
  • Our fulfillment/supplier partners — receive the minimum order and shipping data needed to fulfill physical products where applicable to a specific asset's ongoing operations after Transfer (this does not apply to the Transfer itself, which involves no physical shipping to you).
  • Google (Google Ads, Google Analytics) — for advertising, conversion tracking, and site analytics. Where we use Enhanced Conversions, your email address is cryptographically hashed before being shared with Google for ad-matching purposes.
  • Video conferencing provider (e.g., Zoom) — if you attend a live onboarding call.
  • Professional advisors and authorities — where necessary to comply with law, exercise legal rights, or respond to a lawful request.

We require these providers to protect your data and use it only for the purposes we specify, to the extent required by applicable law.

5. Cookies and Tracking

We use cookies and similar technologies for:

  • Essential store functionality (cart, checkout, security)
  • Analytics (e.g., Google Analytics) to understand site usage
  • Advertising and remarketing (e.g., Google Ads) to measure and improve ad performance

Where required by law (including for visitors in the UK and, if applicable, the EU), we will request your consent before setting non-essential cookies via a cookie banner. You can control cookies through your browser settings at any time; blocking some cookies may affect site functionality.

6. International Data Transfers

As we are established in Spain and use service providers such as Shopify and Google that may process data outside the European Economic Area (including in the United States), such transfers are carried out under appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism, as implemented by our providers.

7. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this policy, including to comply with accounting, tax, and legal obligations (which under Spanish law generally require retaining commercial records for up to 6 years). Marketing data is retained until you unsubscribe or object, plus a reasonable period to record that request.

8. Your Rights

If you are in the European Union, United Kingdom, or wherever GDPR/UK GDPR rights are available to you as a matter of our obligations as controller, you have the right to: access your data; request correction or deletion; restrict or object to processing; request data portability; and withdraw consent at any time where processing is based on consent. You may lodge a complaint with the Spanish data protection authority (Agencia Española de Protección de Datos, www.aepd.es) or, for UK-related processing, the UK Information Commissioner's Office (ICO, ico.org.uk).

If you are a California resident (or a resident of another U.S. state with a comprehensive privacy law), you may have the right to know what personal data we hold about you, request deletion or correction, and opt out of the "sale" or "sharing" of personal data (we do not sell personal data for monetary consideration; certain advertising cookie sharing may be considered "sharing" under some state laws, and you may opt out via our cookie settings or by contacting us). We will not discriminate against you for exercising these rights.

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law give you the right to access personal information we hold about you and to challenge its accuracy.

If you are in Australia, the Australian Privacy Principles (APPs) under the Privacy Act 1988 give you the right to access and correct your personal information, and to complain to us or to the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your data.

If you are in New Zealand, the Privacy Act 2020 gives you the right to access and correct personal information we hold, and to complain to the Office of the Privacy Commissioner if unresolved with us directly.

To exercise any of these rights, contact us using the details in Section 11. We may need to verify your identity before actioning a request.

9. Children's Privacy

Our products are business assets intended for adults operating a business. We do not knowingly collect personal data from anyone under the age of 18, and our services are not directed to children.

10. Data Security

We use reasonable technical and organizational measures (including relying on the security infrastructure of Shopify and our payment processors) to protect personal data against unauthorized access, loss, or misuse. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. How to Contact Us

For any question about this policy or to exercise your rights, contact us at:

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and, where required by law, we will notify you by additional means (e.g., email or a notice on the site).