PRIVACY POLICY

Twenty Two Tuning LTD

This Privacy Policy describes how Twenty Two Tuning LTD (“we”, “us”, or “our”) operating at xxiituning.com (the “Site”) collects, uses, and discloses your Personal Information when you visit, make a purchase from, or interact with the Site and our customer support services. We are committed to protecting your privacy and handling your data transparently and responsibly.

Collecting Personal Information

When you visit the Site, we collect certain information about your device, your interaction with the Site, and information necessary to process your purchases. We may also collect additional information if you contact us for customer support. In this Privacy Policy, we refer to any information that can uniquely identify an individual as “Personal Information”.

Device Information

•       Examples of Personal Information collected: web browser version, IP address, time zone, cookie information, what sites or products you view, search terms, and how you interact with the Site.

•       Purpose of collection: to load the Site accurately for you, to perform analytics on Site usage to optimise our Site, and to deliver relevant advertising.

•       Source of collection: collected automatically when you access our Site using cookies, log files, web beacons, tags, or pixels.

•       Disclosed to: Shopify, Google Analytics, Google Ads, Meta (Facebook/Instagram), TikTok, Klaviyo.

Order Information

•       Examples of Personal Information collected: name, billing address, shipping address, payment information, email address, and phone number.

•       Purpose of collection: to provide products or services to you, fulfil our contract, process your payment, arrange shipping, provide invoices and order confirmations, communicate with you, screen orders for potential risk or fraud, and — where you have consented — provide you with marketing relating to our products or services.

•       Source of collection: collected from you.

•       Disclosed to: Shopify, PayPal, Amazon Pay, Klaviyo.

Customer Support Information

•       Examples of Personal Information collected: name, email address, order number, and any additional information you provide in your support request (such as photographs, vehicle details, or descriptions of issues).

•       Purpose of collection: to provide customer support, process returns or warranty claims, and improve our service.

•       Source of collection: collected from you.

•       Disclosed to: Zendesk, Anthropic (Claude AI — see “Artificial Intelligence” section below).

Marketing Information

•       Examples of Personal Information collected: email address, name, purchase history, browsing behaviour, and marketing preferences.

•       Purpose of collection: to send you email marketing, including product recommendations, promotions, and updates where you have consented to receive these.

•       Source of collection: collected from you (via signup forms, checkout opt-in) and generated from your browsing and purchase activity.

•       Disclosed to: Klaviyo.

Artificial Intelligence & Automated Processing

How We Use AI

We use artificial intelligence (“AI”) technologies to enhance your experience and improve our operations. We believe in being transparent about where and how AI is used in our business. Below is a summary of our current AI usage:

Customer Support: Our customer support system uses AI-assisted technology (powered by Anthropic’s Claude and integrated with Zendesk) to help respond to customer enquiries via email. When you contact our support team, your message — including your name, email address, order details, and the content of your enquiry — may be processed by our AI assistant to generate or suggest a response.

Order & Shipping Automation: We use automated workflows to process order data, track shipping updates, and manage fulfilment. These workflows may process your name, order details, shipping address, and tracking information.

Email Marketing Personalisation: We use automated tools to personalise email marketing content (via Klaviyo), including product recommendations based on your browsing and purchase history, where you have opted in to receive marketing communications.

Your Rights Regarding AI Processing

All AI-assisted decisions and communications are subject to human oversight. You have the right to:

•       Request human review — if you receive a response from our support team and would prefer to speak with a human, simply let us know and your enquiry will be handled personally.

•       Contest a decision — if you believe an AI-assisted decision (such as a return or refund outcome) is incorrect, you may request that it be reviewed by a member of our team.

•       Understand the logic — you may request an explanation of how automated processing has been used in relation to a decision about you.

No solely automated decision-making with legal or similarly significant effects is carried out without human involvement.

Third-Party AI Processors

Our AI processing relies on the following third-party service providers, each of which processes data under a data processing agreement:

•       Anthropic (Claude AI) — provides the AI language model used in customer support. Data is processed in accordance with Anthropic’s privacy and data protection policies.

•       Zendesk — provides the helpdesk platform through which customer support interactions are managed.

•       Klaviyo — provides email marketing automation and personalisation.

Minors

The Site is not intended for individuals under the age of 16. We do not intentionally collect Personal Information from children. If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us at the address below to request deletion.

Sharing Personal Information

We share your Personal Information with service providers to help us provide our services and fulfil our contracts with you, as described above. Specifically:

•       We use Shopify to power our online store. You can read more about how Shopify uses your Personal Information at shopify.com/legal/privacy.

•       We use Klaviyo for email marketing and automation. Klaviyo processes your email address, name, purchase history, and browsing activity to deliver personalised communications.

•       We use Zendesk for customer support. Your support enquiries (including any personal information you share) are processed through Zendesk’s platform.

•       We use AI technologies (Anthropic/Claude) to assist with customer support, as detailed in the “Artificial Intelligence & Automated Processing” section above.

•       We may share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.

Behavioural Advertising

As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For example:

•       We use Google Analytics (GA4) to help us understand how our customers use the Site. You can read more about how Google uses your Personal Information at policies.google.com/privacy. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

•       We share information about your use of the Site, your purchases, and your interaction with our ads on other websites with our advertising partners — including Google Ads, Meta (Facebook/Instagram), and TikTok. We collect and share some of this information directly with our advertising partners, and in some cases through the use of cookies or other similar technologies (which you may consent to, depending on your location).

For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt out of targeted advertising by:

•       Facebook: facebook.com/settings/?tab=ads

•       Google: google.com/settings/ads/anonymous

•       Digital Advertising Alliance: optout.aboutads.info

Using Personal Information

We use your Personal Information to provide our services to you, which includes: offering products for sale, processing payments, shipping and fulfilment of your order, providing customer support (including AI-assisted support), and — where you have consented — keeping you up to date on new products, services, and offers via email marketing.

Lawful Basis

Pursuant to the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, we process your Personal Information under the following lawful bases:

•       Contract: where processing is necessary for the performance of our contract with you (e.g. processing your order, arranging shipping).

•       Consent: where you have given consent (e.g. opting in to email marketing, accepting cookies).

•       Legitimate interests: where processing is necessary for our legitimate interests and does not override your fundamental rights and freedoms (e.g. fraud prevention, improving our services, AI-assisted customer support).

•       Legal obligation: where processing is necessary to comply with our legal obligations.

Retention

When you place an order through the Site, we will retain your Personal Information for our records unless and until you ask us to erase this information. For more information on your right of erasure, please see the “Your Rights” section below.

Automatic Decision-Making

We use some automated processing in our business operations, as described in the “Artificial Intelligence & Automated Processing” section above. No solely automated decisions with legal or similarly significant effects are made about you without human oversight.

Our processor Shopify uses limited automated decision-making to prevent fraud. Services that include elements of automated decision-making include:

•       Temporary denylist of IP addresses associated with repeated failed transactions. This denylist persists for a small number of hours.

•       Temporary denylist of credit cards associated with denylisted IP addresses. This denylist persists for a small number of days.

Under the UK GDPR (as amended), you have the right to request human intervention, express your point of view, and contest any automated decision that significantly affects you. Please contact us using the details below if you wish to exercise these rights.

Selling Personal Information

We do not sell your Personal Information in the traditional sense. However, as defined by the California Consumer Privacy Act of 2018 (“CCPA”), the sharing of data with advertising partners for targeted advertising purposes may be considered a “sale” of Personal Information. If you are a California resident and wish to opt out, please visit our CCPA Opt-Out page at xxiituning.com/pages/ccpa-opt-out-1.

Your Rights

UK GDPR

If you are a resident of the United Kingdom or the European Economic Area (“EEA”), you have the following rights under data protection law:

•       Right of access — the right to request a copy of the Personal Information we hold about you.

•       Right to rectification — the right to ask that your Personal Information be corrected or updated.

•       Right to erasure — the right to ask that your Personal Information be deleted.

•       Right to data portability — the right to receive your Personal Information in a structured, commonly used format.

•       Right to object — the right to object to processing based on legitimate interests, including profiling and automated decision-making.

•       Right to restrict processing — the right to request that we limit how we use your data.

•       Rights relating to automated decisions — the right to human intervention, to express your point of view, and to contest any solely automated decision that significantly affects you.

If you would like to exercise these rights, please contact us using the details below.

Your Personal Information will be initially processed in Ireland and may be transferred outside of the United Kingdom and Europe for storage and further processing, including to the United States and Canada. For more information on how data transfers comply with UK data protection law, see Shopify’s GDPR documentation at help.shopify.com/en/manual/your-account/privacy/GDPR.

CCPA (California)

If you are a resident of California, you have the right to access the Personal Information we hold about you (also known as the “Right to Know”), to port it to a new service, and to ask that your Personal Information be corrected, updated, or erased. If you would like to exercise these rights, please contact us through the information below or visit our CCPA Opt-Out page at xxiituning.com/pages/ccpa-opt-out-1.

If you would like to designate an authorised agent to submit these requests on your behalf, please contact us at the address below.

Cookies

A cookie is a small amount of information that is downloaded to your computer or device when you visit our Site. We use a number of different cookies, including functional, performance, advertising, and social media cookies. Cookies make your browsing experience better by allowing the website to remember your actions and preferences. For full details, please see our Cookie Policy at xxiituning.com/pages/cookies.

Cookies Necessary for the Functioning of the Store

Name	Function
_ab	Used in connection with access to admin.
_secure_session_id	Used in connection with navigation through a storefront.
cart	Used in connection with shopping cart.
cart_sig	Used in connection with checkout.
cart_ts	Used in connection with checkout.
checkout_token	Used in connection with checkout.
secret	Used in connection with checkout.
secure_customer_sig	Used in connection with customer login.
storefront_digest	Used in connection with customer login.
_shopify_u	Used to facilitate updating customer account information.

 

Reporting & Analytics Cookies

Name	Function
_tracking_consent	Tracking preferences.
_landing_page	Track landing pages.
_orig_referrer	Track landing pages.
_s	Shopify analytics.
_shopify_s	Shopify analytics.
_shopify_sa_p	Shopify analytics relating to marketing & referrals.
_shopify_sa_t	Shopify analytics relating to marketing & referrals.
_shopify_y	Shopify analytics.
_y	Shopify analytics.

 

The length of time that a cookie remains on your computer or mobile device depends on whether it is a “persistent” or “session” cookie. Session cookies last until you stop browsing and persistent cookies last until they expire or are deleted. Most of the cookies we use are persistent and will expire between 30 minutes and two years from the date they are downloaded to your device.

You can control and manage cookies in various ways. Please keep in mind that removing or blocking cookies can negatively impact your user experience and parts of our website may no longer be fully accessible. Most browsers automatically accept cookies, but you can choose whether or not to accept cookies through your browser controls, often found in your browser’s “Tools” or “Preferences” menu. For more information, visit allaboutcookies.org.

Please note that blocking cookies may not completely prevent how we share information with third parties such as our advertising partners. To exercise your rights or opt out of certain uses of your information by these parties, please follow the instructions in the “Behavioural Advertising” section above.

Do Not Track

Please note that because there is no consistent industry understanding of how to respond to “Do Not Track” signals, we do not alter our data collection and usage practices when we detect such a signal from your browser.

Changes

We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons. We encourage you to review this page periodically.

Contact

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by email at Support@xxiituning.com or by mail using the details below:

Twenty Two Tuning LTD

86-90 Paul Street

London, EC2A 4NE

United Kingdom

 

If you are not satisfied with our response to your complaint, you have the right to lodge your complaint with the relevant data protection authority. You can contact the UK’s Information Commissioner’s Office at ico.org.uk/make-a-complaint.