GDPR Privacy Information

Our Approach to Data Protection

At Xaranovioris, we recognize the importance of protecting personal information and handling it responsibly. This GDPR Privacy Information explains how personal data may be collected, used, stored, disclosed, and protected when you interact with our online furniture and home goods store.

The General Data Protection Regulation (GDPR) applies only when its territorial and material requirements are met. This notice describes the principles and procedures we follow when GDPR applies to our processing activities. It does not represent that every interaction with our website is necessarily governed by GDPR.

When This Notice Applies

This notice may apply to individuals in the European Economic Area (EEA) or other locations covered by GDPR when our processing activities fall within the regulation's scope.

Depending on how you interact with us, we may process personal data relating to:

• Orders, purchases, payments, delivery arrangements, and transaction records.

• Contact details, including your name, email address, telephone number, and shipping or billing address.

• Customer service communications, requests, complaints, and related correspondence.

• Website usage, device information, and technical records used to operate and secure our website.

• Preferences and consent records where relevant to your interactions with our services.

We seek to collect only the information reasonably necessary for the relevant purpose. Payment information may be handled by payment service providers, and we do not claim to store complete payment card details unless our actual systems and practices support that statement.

Why We Process Personal Data

We process personal data for defined purposes and, where GDPR applies, rely on an appropriate legal basis for each relevant activity.

Order fulfillment and contractual obligations

We use necessary information to process purchases, arrange delivery, communicate order updates, respond to order-related requests, and administer returns or refunds.

Legal and regulatory obligations

Certain records may be retained or disclosed when required by applicable tax, accounting, consumer protection, or other legal requirements.

Website operation and security

Technical information may be used to maintain website functionality, troubleshoot errors, protect accounts and transactions, detect suspicious activity, and help prevent fraud or misuse.

Customer support and legitimate interests

We may use relevant information to respond to inquiries, resolve disputes, improve service operations, and protect our legitimate business interests, provided those interests do not override applicable individual rights and freedoms.

Consent-based processing

Where consent is the appropriate legal basis, we will seek it before carrying out the relevant processing. You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

Legal Bases for Processing

Depending on the circumstances, our processing may rely on one or more of the following GDPR legal bases:

• Contract: Processing necessary to perform a contract with you or take steps at your request before entering into a contract.

• Legal obligation: Processing necessary to comply with a legal requirement.

• Legitimate interests: Processing necessary for a legitimate interest pursued by us or a third party, where your rights and freedoms do not override that interest.

• Consent: Processing authorized by your freely given, specific, informed, and unambiguous consent where required.

• Vital interests or public interest: These bases may be used only where the applicable legal conditions are satisfied.

The appropriate legal basis depends on the particular purpose and circumstances of the processing.

Sharing and Disclosure of Personal Data

We may disclose personal data to service providers when reasonably necessary to operate our store and fulfill your requests. These providers may include payment processors, shipping and delivery services such as UPS, website hosting and technical support providers, customer service providers, and security or fraud-prevention services.

We may also disclose information when required by law, in response to valid legal processes, or when reasonably necessary to protect rights, safety, and property.

Where GDPR requires a written data processing agreement or other safeguards for a service provider, we will take appropriate steps to establish those safeguards. We do not authorize service providers to use personal data for purposes inconsistent with the applicable arrangements and legal requirements.

International Data Transfers

Our store operates from the United States. If personal data subject to GDPR is transferred outside the European Economic Area to a country that has not received an applicable adequacy decision, we will use an appropriate transfer mechanism where required by law. Depending on the circumstances, this may include Standard Contractual Clauses and any supplementary measures required by the relevant transfer assessment.

The availability and suitability of a transfer mechanism depend on the destination, recipient, type of data, and applicable legal requirements. We do not represent that every destination has an adequacy decision or that every transfer uses a particular safeguard without verifying the relevant arrangement.

How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, taking into account legal obligations, transaction administration, dispute resolution, security, and the establishment or defense of legal claims.

For example, order and accounting records may need to be retained for legally required periods. Customer service communications and technical records may be kept for periods appropriate to their operational purpose.

When information is no longer required, we will take reasonable steps to delete it, anonymize it, or otherwise handle it in accordance with applicable law. Retention periods may vary depending on the type of information and the circumstances.

Your Rights Under GDPR

If GDPR applies to our processing of your personal data, you may have the following rights, subject to the conditions and exceptions set out in the regulation:

Right of access: Request confirmation of whether we process your personal data and obtain access to that data and relevant information about the processing.

Right to rectification: Ask us to correct inaccurate personal data or complete incomplete information.

Right to erasure: Request deletion of personal data where the legal requirements for erasure are met.

Right to restriction: Request that certain processing be restricted in circumstances specified by GDPR.

Right to data portability: Receive certain personal data you have provided in a structured, commonly used, machine-readable format and, where legally applicable, request transmission to another controller.

Right to object: Object to processing based on legitimate interests or public interest on grounds relating to your particular situation, subject to applicable legal conditions. You have an unconditional right to object to direct marketing processing where GDPR provides that right.

Right to withdraw consent: Withdraw consent where processing is based on consent. This does not invalidate processing carried out lawfully before withdrawal.

Rights relating to automated decisions: Where applicable, request the protections provided by GDPR concerning decisions based solely on automated processing that produce legal or similarly significant effects.

These rights are not absolute in every circumstance. We may need to retain or process certain information to comply with legal obligations, establish or defend legal claims, or satisfy other lawful exceptions.

How to Submit a Privacy Request

To submit a request concerning your personal data, contact us using the details below. Please describe the right you wish to exercise and provide enough information for us to understand and assess your request.

We may ask for reasonable additional information to verify your identity and protect personal data from unauthorized disclosure. We will not request more information than is reasonably necessary for verification.

Where GDPR applies, we generally respond without undue delay and within one month of receiving a valid request. Where permitted by GDPR, this period may be extended by up to 2 additional months for complex or numerous requests. If an extension is necessary, we will inform you within the initial one-month period and explain the reason.

Requests are handled in accordance with applicable law. We will not unlawfully discriminate against you for exercising a privacy right.

Complaints to a Supervisory Authority

If GDPR applies to your personal data, you may have the right to lodge a complaint with a competent data protection supervisory authority, particularly in the EU or EEA country where you habitually reside, work, or where an alleged infringement occurred.

You may also contact us first so we can review your concern. Contacting us does not remove any right you may have to complain to a supervisory authority.

Data Security

We use reasonable administrative, technical, and organizational measures intended to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

No method of transmitting or storing information can be guaranteed to be completely secure. We therefore cannot promise absolute security, but we take reasonable steps appropriate to the nature of the information and the risks involved.

Changes to This Notice

We may update this notice to reflect changes in our data handling practices, services, or applicable legal requirements. The updated version will state its revision date. Where required by law, we will provide additional notice or obtain consent before making relevant changes to processing activities.

Contact Information

For questions about this notice or to exercise a privacy right, contact us:

Email: service@xaranovioris.com

Phone: +1 (423) 627-8493

Mailing address: 1635 Virginia Ave, Morristown, TN 37814, United States

Customer service hours: Monday through Friday, 9:00 AM–6:00 PM Eastern Time (ET)