XTRA Privacy Policy

Last updated: 15 October 2026

1. Who We Are

XTRA is operated by XTRA TECH LIMITED ("XTRA", "we", "us" or "our"), the controller responsible for personal data used to operate www.xtra.ltd and our related customer services.

Business Registration No.: 79099640
Registered office: Room 101A, 1/F, Genplas Industrial Building, 56 Hoi Yuen Road, Kwun Tong, Kowloon, Hong Kong
Privacy and customer support: support@xtra.ltd

This policy explains what data we use, why, who receives it, how long it is needed and your choices. Browsing the store or reading this policy does not itself constitute consent to optional tracking or marketing.

2. Personal Data We Collect and Its Sources

• Contact and delivery information: name, email, telephone number, billing and shipping addresses.
• Orders and transactions: products, order identifiers, amounts, payment and delivery status, returns, refunds and related correspondence. Payment providers process credentials for your selected payment method; we use transaction information to administer orders.
• Accounts and preferences: account identifiers, contact details, marketing and privacy choices.
• Support and forms: messages, attachments and information you provide through email, forms or chat.
• Reviews: reviewer details, ratings, comments, submitted photos or videos and information used to associate reviews with purchases.
• Shipping and tracking: tracking numbers, carrier, delivery events and contact details needed to fulfil or track an order.
• Device and usage information: IP address, browser and device information, approximate location derived from IP, cookie and other online identifiers, referring pages and shopping events such as page views, product views, cart activity, checkout and purchases.

Sources include you, your use of our website, Shopify, payment processors, review and tracking services, carriers, and the analytics or advertising services described below. Not every category is collected for every interaction. Please do not include unnecessary private information in public reviews or support messages.

3. Purposes and Legal Bases

Where the EU/EEA GDPR or UK GDPR applies, the relevant bases are:

• Contract and requested pre-contract steps: processing orders, payments, delivery, returns and related account services.
• Legitimate interests: proportionate fraud prevention, security, customer assistance, administering customer feedback and establishing, exercising or defending legal claims. These interests are subject to your rights and the required balancing assessment. Support necessary to fulfil an order also relies on contract.
• Consent where required: optional analytics, advertising technologies, personalised advertising and promotional messages. An existing-customer marketing exception may apply only where its legal conditions and opt-out requirements are met.
• Legal obligation: records and disclosures required by applicable EU, Member State or UK law. Obligations arising solely under other laws are assessed separately, including whether legitimate interests provide an appropriate GDPR basis.

If information necessary to process an order is not provided, we may be unable to fulfil it. Optional advertising or marketing consent is not a condition of purchase. Contact us about the legitimate interests applicable to your information or to object.

4. Services and Recipients

Relevant personal data is shared with services supporting the functions you use:

• Shopify: store hosting, checkout, orders, customer accounts, forms, chat, analytics and privacy controls. Shopify Network Intelligence is enabled; Shopify combines relevant customer data with data from other merchants to support services including advertising and personalisation, as described in its notices. Shopify may act as a processor for merchant services and as an independent controller for its own processing. See Shopify's Consumer Privacy Policy and Shopify's Privacy Portal.
• Judge.me: reviews, purchase verification and related review activity. A submitted display name, rating, review and media may be published. Avoid including private information in review content.
• Track123: shipment lookup and delivery updates using relevant order, tracking and matching contact information. Carriers and fulfilment partners receive details needed for delivery.
• Google / Google Analytics 4 / Google & YouTube: site and shopping-event analytics, advertising measurement and relevant channel services. Depending on the integration and your choices, technical identifiers, shopping events and related order information may be processed through browser and server connections.
• Meta / Facebook & Instagram: advertising measurement, campaign performance and audiences using pixels and the connected sales channel, including browser and server event connections. Relevant identifiers, browsing or shopping events and matching information may be processed, subject to applicable law and choices.
• Reddit: a connected advertising pixel measures page visits and shopping events. Its configuration can send event identifiers, product or transaction information and, where available to the integration, email, telephone number and customer or browser identifiers for matching and attribution.
• Klaviyo: email and SMS marketing, audience management and event-based measurement through its connected integration, which includes browser and server connections. Data can include contact details, marketing choices and browsing or transaction events. Receiving marketing remains subject to applicable consent and opt-out rules.
• Shopify Collabs: affiliate and creator referral attribution and related commission administration.
• PageFly, EasyGift and Pop Convert: storefront presentation, cart promotions and pop-up or sign-up features. Relevant usage, cart or submitted contact information can be processed when those features are used.

Other recipients include the payment service you select, shipping and fulfilment providers, professional advisers and authorities where necessary and legally permitted. Relevant information may be disclosed in a lawful business transfer, subject to appropriate protections. Providers may be processors or independent controllers depending on their role; their own privacy notices explain processing they control. A provider's notice does not replace this policy.

5. Cookies, Advertising and Marketing Choices

Cookies, pixels and similar technologies support cart, checkout, security and remembering choices, as well as optional analytics and advertising. Where consent is legally required, optional technologies require your prior consent. You may refuse or withdraw optional consent.

Use the cookie banner's Manage preferences controls where displayed. For applicable sale, sharing or targeted-advertising opt-outs, use our data-sharing opt-out page. You can also email support@xtra.ltd to request assistance or withdraw a choice.

Advertising disclosures can be treated as a sale or sharing under some privacy laws even without payment for the data. You can use browser controls to block or delete cookies; blocking essential cookies may affect store functions. Use the unsubscribe link in promotional emails to stop those messages. Necessary order, security and service messages may continue.

6. Retention: How Long Data Is Needed

Retention depends on the purpose, the relationship, applicable record-keeping duties and any unresolved issue. There is no single retention period for every type of data. The following periods or criteria apply:

• Required business, invoice and accounting records: Hong Kong business records must generally be kept for at least seven years after the relevant transaction. This applies to necessary business records, not automatically to all browsing, marketing or support data.
• Account information: for the account relationship and, after closure, only to the extent needed for outstanding orders, required records, fraud prevention or legal claims.
• Support, warranty and shipment records: while resolving the matter and for the period needed to administer applicable warranty or consumer rights, document the outcome or address a related claim. Information forming part of required transaction records follows the relevant record-keeping period.
• Public reviews and submitted media: while published and relevant to the product or customer feedback purpose, subject to valid deletion or anonymisation requests and any lawful exception.
• Marketing contacts: while the applicable consent or other lawful marketing basis remains valid. After an opt-out, only the limited information needed to respect the opt-out or meet another lawful requirement remains necessary.
• Analytics and advertising information: according to the relevant service's configured retention, purpose and privacy controls. Provider periods differ; a cookie's expiry is separate from server-side event retention. Contact us for information about the retention applicable to a particular service or request.
• Security, consent and rights-request records: for the period necessary to investigate incidents, demonstrate compliance, respect choices or establish, exercise or defend claims, taking account of applicable limitation periods.

When identifiable data is no longer needed for a lawful purpose, it should be deleted or irreversibly anonymised. Required records, a specific legal hold or an unresolved claim can justify retaining limited relevant information for longer. Deletion requests are assessed against these requirements and communicated to relevant processors where required. Providers acting independently may have separate legal retention duties. Contact us for the period or criteria applicable to your information.

7. International Processing

We operate from Hong Kong. Shopify identifies the store's customer-data hosting location as the United States. Our providers may process information in other countries, including outside the EU/EEA or UK; applicable protections and government-access rules can differ.

Transfers subject to the GDPR or UK GDPR require an applicable legal transfer mechanism, such as an adequacy decision or appropriate contractual safeguards and any necessary supplementary measures. Contact support@xtra.ltd for information about destinations, recipients and the safeguards applicable to your information, including how to obtain relevant safeguards with lawful redactions.

8. EU/EEA and UK Data Protection Rights

Where the relevant data protection law applies, and subject to its conditions, you may:

• Access your personal data and obtain a copy.
• Correct inaccurate or incomplete data.
• Request erasure or restriction of processing.
• Request data portability for data you provided where automated processing relies on consent or contract.
• Object to legitimate-interest processing for reasons relating to your situation, subject to lawful overriding grounds or legal claims.
• Object at any time to direct marketing, including related profiling.
• Withdraw consent without affecting earlier lawful processing.
• Obtain applicable safeguards against solely automated decisions with legal or similarly significant effects, including human intervention and an opportunity to contest a decision where the law provides.

Email support@xtra.ltd to make a request. Proportionate identity verification may be necessary. We respond without undue delay and within one month. Where legally permitted due to complexity or the number of requests, this may be extended by two further months, with an explanation within the first month. Requests are normally free; lawful exceptions apply to manifestly unfounded or excessive requests.

You may complain directly to a competent supervisory authority and seek a judicial remedy. In the EU/EEA, this can include the authority where you live, work or where the alleged infringement occurred; see the EDPB authority directory. In the UK, you can contact the Information Commissioner's Office.

9. Other Local Rights

Depending on applicable law, including relevant US state laws, you may have rights to know, access, correct or delete data, obtain a copy, or opt out of sale, sharing or targeted advertising. Use the opt-out page above or contact us. Where authorised-agent or appeal rights apply, requests can be made through the same email. We will not unlawfully discriminate against you for exercising privacy rights.

Customers in Hong Kong or Australia may also contact us about access, correction or a privacy complaint under applicable local law. These rights are subject to the scope and conditions of the relevant legislation.

10. Security, Children and External Services

No website, payment system or transmission method can guarantee absolute security. Do not send passwords or full payment credentials through email, forms or chat. Please report suspected misuse of your information to us.

Products have age and safety restrictions; a product recommendation is not permission for a child to submit personal data or enter a contract independently. A parent or guardian who believes a child has supplied personal data without an appropriate lawful basis or required authorisation should contact us so we can assess and address it.

Links and embedded content from external services are subject to their own notices. Using or loading embedded content can involve technical information being sent to that provider, subject to applicable consent requirements.

11. Changes and Contact

We may update this policy when our practices or legal requirements change. The date above identifies the current version. Any notice or renewed consent required for a new purpose must be provided as required by law.

For questions, complaints or rights requests, email support@xtra.ltd or write to XTRA TECH LIMITED, Room 101A, 1/F, Genplas Industrial Building, 56 Hoi Yuen Road, Kwun Tong, Kowloon, Hong Kong.