Privacy Policy

Last updated: 22 October 2026

1. Introduction

CipherX Technologies Ltd is committed to protecting your privacy and handling your personal data responsibly.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website, use our online store, create a customer account, purchase a Microdot Tattoo product, receive a redemption code, book an appointment, complete a waiver, attend a CipherX pop-up, event, or store, receive a Microdot Tattoo application, contact us by email or Instagram, submit a complaint, subscribe to marketing or stock alerts, or otherwise interact with us.

CipherX Technologies Ltd is a company registered in England and Wales under company number 13607960, with its registered address at Scale Space Building, 58 Wood Lane, London W12 7RZ, United Kingdom.

In this Privacy Policy, “CipherX”, “we”, “us”, and “our” refer to CipherX Technologies Ltd.

We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and other applicable UK laws.

2. Who is responsible for your personal data?

CipherX Technologies Ltd is the data controller for the personal data described in this Privacy Policy. This means we decide how and why your personal data is used.

We have not appointed a Data Protection Officer. Questions about this Privacy Policy or how we use your personal data should be sent to:

Email: support@cipherx.tech
Postal address: CipherX Technologies Ltd, Scale Space Building, 58 Wood Lane, London W12 7RZ, United Kingdom

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection matters. We would appreciate the opportunity to respond to your concerns first, so please contact us before raising a complaint with the ICO.

3. Personal data we collect

We may collect and use different types of personal data depending on how you interact with us.

3.1 Identity and contact data

This may include your name, email address, billing address, delivery address, and other contact details you provide to us.

You can check out as a guest, or sign in to a customer account using a one-time code we send to your email address. We do not use passwords for customer accounts. If you use an account, we may also process your sign-in codes, account preferences, and account history, including your orders and waivers.

We do not currently collect phone numbers as part of our standard online checkout or booking flows. We may hold a phone number if you have given one to us, for example in a partnership enquiry or with an order placed through our previous online store.

3.2 Order and transaction data

When you place an order, we may collect information about the product you purchased, your order number, billing details, delivery details, payment status, discount codes or gift cards used, refund status, order history, customer communications, and related purchase records.

We do not directly store full payment card details. Payments are processed through our third-party payment provider, Stripe. Apple Pay and Google Pay may also be available through Stripe. We may add other payment options in the future.

If you start a checkout but do not complete your payment, we may send you a reminder email about your unfinished order.

Our online store previously ran on Shopify. Order and customer records from that store have been transferred into our own order management system, and are handled as described in this Privacy Policy.

3.3 Booking and redemption data

When you purchase a Microdot Tattoo product, you may receive a digital QR code or equivalent redemption link by email. This is issued through our own systems.

When you redeem your purchase, we may collect booking information, appointment details, waiver completion status, redemption status, and operational information needed to provide the Microdot Tattoo application.

If you book an appointment for more than one person, we may ask you for the name and email address of each person attending, so that we can send them their own waiver and booking details. Please make sure they are happy for you to share these details with us.

Our current process may involve online purchase, QR-code or redemption link issuance by email, appointment booking through our own booking system, internal scheduling through Google Calendar, online or paper waiver completion, in-person age eligibility checks, staff-assisted application at our store or a physical pop-up or event, and application record collection through our internal systems.

3.4 Application and product traceability records

When a Microdot Tattoo is applied, we may record operational and traceability information. This may include the QR code or order reference, tattoo design, application site, patch used, applicator used, date and location of application, staff member involved, photos of the application outcome, and other product or application details.

We may also record the recipient’s gender. We do not ask you for this; we estimate it from your first name using a third-party service, genderize.io, and staff may correct it. We use it only in aggregate, to understand who our products appeal to.

We use this information for product traceability, quality management, customer support, complaint handling, safety monitoring, insurance, legal purposes, and continuous improvement of our products and services.

3.5 Age eligibility information

Microdot Tattoo application is only available to individuals aged 18 or over.

We may ask customers or recipients to confirm that they are aged 18 or over before purchase, booking, waiver completion, or application. The person receiving the Microdot Tattoo may be different from the person who purchased it.

When you complete a waiver, we ask for your date of birth and record it with your waiver, to confirm that you are aged 18 or over.

At our store or at physical pop-ups or events, if a recipient appears under 25, our staff may visually check their ID before proceeding.

We do not retain copies of ID documents, ID document numbers, or ID type. We may record a minimal confirmation that age eligibility has been confirmed.

3.6 Waiver and safety eligibility information

Before receiving a Microdot Tattoo application, recipients may be asked to complete a waiver confirming that they are aged 18 or over, understand the application process, agree to follow aftercare instructions, and do not have any condition, circumstance, or skin issue that would make Microdot Tattoo application unsuitable.

When you complete a waiver, we record your name, email address, date of birth, signature, the date you signed, and your answers to any questions on the waiver. Waivers are usually completed online. If you complete a paper waiver, we may scan or photograph it and store the copy with your record.

We aim to collect only minimal safety eligibility information. Our preferred waiver approach is a negative confirmation, for example:

“I confirm that I am aged 18 or over and do not have any condition, circumstance, or skin issue that would make Microdot Tattoo application unsuitable for me.”

We do not ask recipients to provide detailed medical history unless this becomes necessary for safety, complaint handling, product traceability, insurance, or legal purposes.

Where waiver, safety screening, customer support, complaint, or adverse reaction information includes health-related information, this may constitute special category data under UK data protection law. We process this information only where necessary and with appropriate safeguards.

3.7 Marketing and communications data

If you subscribe to marketing communications, we may collect your email address, marketing preferences, subscription status, where you signed up, email engagement information, and records of whether you have opted in or opted out.

If you ask us to tell you when a product is back in stock, we will use your email address to send you that alert.

We keep our mailing list in our own systems, and currently use Mailchimp to send some marketing communications. We may use other marketing or customer communication tools in the future.

You can unsubscribe from marketing at any time by using the unsubscribe link in our emails or by contacting us at support@cipherx.tech.

3.8 Reviews, testimonials, photos, and media

You may choose to provide reviews, testimonials, photos, videos, social media posts, or other user-generated content.

We may also curate testimonials or link to public content from platforms such as Instagram, TikTok, or other social media platforms.

Where we wish to use your name, image, testimonial, photo, video, or content for marketing, website, social media, PR, or promotional purposes, we will seek appropriate permission or consent where required.

3.9 Website, analytics, and cookie data

When you visit our website or online store, we may collect technical and usage information. This may include your IP address, browser type, device information, pages visited, the website or advert that referred you, interaction data, approximate location, and cookie or similar technology data.

We measure visits to our website with our own analytics, which do not use cookies. We do not store your full IP address for this purpose: we shorten it and combine it with your browser details into a code that changes every day, so that we can count visits without recognising you from one day to the next. We look up your country from your IP address using a database held on our own servers, and do not record a more precise location.

Some cookies are necessary for the website and checkout to function properly. Other cookies or similar technologies may be used for marketing, advertising, retargeting, and measuring the performance of our advertising.

We use our own cookie banner to manage consent for non-essential cookies, including advertising cookies such as the Meta (Facebook/Instagram) Pixel and the TikTok Pixel. If you accept these cookies, we also record which other websites you follow links to from our website (the website only, not the full address).

Where required by law, we will only use non-essential cookies and similar technologies with your consent. You can manage your cookie preferences through our cookie banner or your browser settings.

Where you accept advertising cookies, we use Meta’s Pixel and Conversions API, and TikTok’s Pixel and Events API, to measure and improve our advertising. If you go on to complete a purchase or booking, we share limited order information — your email address and, where we hold one, your phone number, in hashed, non-readable form, your order value, your IP address and browser details, and the identifier of the advert you clicked, if any — directly with Meta and TikTok from our server, so that they can match the purchase to your ad activity and use it to build audiences of past purchasers for advertising purposes. We only do this if you have accepted advertising cookies; if you reject or have not accepted them, this information is not shared with Meta or TikTok.

3.10 Customer support and complaints data

If you contact us, including by email at support@cipherx.tech, through the contact form on our website, or by direct message on Instagram, we may collect your name, contact details, Instagram username, order details, application details, complaint details, correspondence, any photos or files you send us, and information needed to investigate and respond.

If you contact us about a partnership or wholesale opportunity, we may collect your name, company, location, website, email address, phone number, and our correspondence with you.

If a complaint relates to product performance, irritation, adverse reactions, application outcomes, or other safety-related matters, the information may include health-related or special category data.

We retain complaints and adverse reaction reports where necessary for customer support, product safety, quality management, insurance, legal, and regulatory purposes.

4. How we collect personal data

We collect personal data directly from you when you visit our website, create or sign in to a customer account, place an order, use a discount code or gift card, receive or redeem a QR code, complete a waiver, book an appointment, attend our store, a pop-up, or an event, receive a Microdot Tattoo application, contact customer support, submit a complaint, sign up for marketing or stock alerts, submit a review, provide a testimonial, share a photo or video, or interact with us on social media.

We may also receive personal data from other people, for example when someone buys a Microdot Tattoo product for you or books an appointment that includes you, and from service providers and platforms we use to operate our store, process payments, manage bookings, provide customer support, and run our advertising.

5. How and why we use your personal data

We use your personal data only where we have a lawful basis to do so.

We may use your personal data to operate our website and online store, manage customer accounts, process orders and payments, issue and manage QR codes or redemption links, manage appointment bookings, send booking confirmations and reminders, confirm age eligibility, manage waiver completion, provide staff-assisted Microdot Tattoo application, send aftercare reminders such as when to remove your patch, maintain product traceability, handle customer support enquiries, investigate complaints, monitor product performance, understand our customers in aggregate, improve our products and services, protect our website and forms against spam and abuse, send marketing communications where permitted, measure and improve our advertising where you have consented, display reviews or testimonials where permitted, comply with accounting and tax obligations, comply with legal obligations, and establish, exercise, or defend legal claims.

Our lawful bases may include performance of a contract, compliance with legal obligations, our legitimate interests, your consent, or, where health-related information is involved, an additional special category condition under UK data protection law.

6. Special category data

Special category data is personal data that requires additional protection. This includes information about health.

We do not seek to collect detailed medical records or unnecessary health information. However, we may process limited health-related or safety-related information where this is provided through waivers, safety eligibility confirmations, contraindication checks, customer support communications, complaints, adverse reaction reports, or application records.

Where we process special category data, we will identify both a lawful basis under Article 6 UK GDPR and a special category condition under Article 9 UK GDPR.

Depending on the circumstances, we may rely on explicit consent, where you voluntarily provide safety or health-related information for the purpose of receiving a Microdot Tattoo application. We may also rely on processing necessary for the establishment, exercise, or defence of legal claims, or another lawful condition where applicable.

We will only use this information for safety, eligibility, application, complaint handling, quality management, insurance, legal, regulatory, or product traceability purposes.

7. Marketing

You will receive marketing emails from us only where you have opted in or where we are otherwise legally permitted to contact you.

You can unsubscribe from marketing communications at any time by using the unsubscribe link in our emails or by contacting us at support@cipherx.tech.

If you opt out of marketing, we may still contact you about orders, bookings, redemptions, applications, aftercare, safety matters, complaints, legal notices, or other service-related communications.

8. Cookies and similar technologies

Our website and online store use cookies and similar technologies.

Some cookies are necessary for the website and checkout to function properly. These may include cookies required for page navigation, secure checkout, signing in to your account, remembering your cookie preferences, fraud and spam prevention, shopping basket functionality, and order processing. To protect our checkout and booking forms against spam and abuse, we use Cloudflare Turnstile, which may set or read its own cookies and collect technical information about your browser.

Our own website analytics do not use cookies (see section 3.9).

We may also use optional cookies and similar technologies for marketing, advertising, retargeting, and measuring the performance of our advertising. These currently include the Meta (Facebook/Instagram) Pixel and the TikTok Pixel. We may introduce other tools in the future.

Where required by law, we will only use non-essential cookies and similar technologies with your consent. You can manage your cookie preferences through our cookie banner or your browser settings.

If we introduce new analytics, heatmap, advertising, or tracking tools, we will update our cookie information and consent settings as appropriate.

9. Sharing your personal data

We may share personal data with trusted third parties where necessary to operate our business, provide our products and services, comply with legal obligations, or protect our rights.

These third parties may include Stripe for payment processing, including Apple Pay and Google Pay where used for payment; OVHcloud for hosting our website, online store, order management and quality management systems, databases, and stored files, such as signed waivers and photos; Twilio SendGrid for sending our emails and receiving emails sent to us; Mailchimp for marketing emails; Google Workspace, including Gmail and Google Calendar, for our support mailbox, internal records, scheduling, and operations; Cloudflare for protecting our forms against spam and abuse; genderize.io for estimating gender from first names; Slack for notifying our staff of new customer messages (the sender’s name or contact details, not the message itself); Meta Platforms, Inc. (Facebook and Instagram) for Instagram direct messages and, where you have accepted advertising cookies, for advertising, audience building, and ad measurement; TikTok for advertising, audience building, and ad measurement, where you have accepted advertising cookies; professional advisers, including lawyers, accountants, insurers, and auditors; event or operational partners where necessary to provide pop-up or application services; and regulators, public authorities, courts, insurers, or law enforcement where required or permitted by law.

We may also share personal data in connection with a business sale, investment, restructuring, merger, acquisition, licensing arrangement, or transfer of assets, subject to appropriate confidentiality and data protection safeguards.

10. International transfers

Our main systems and databases are hosted in the United Kingdom and the EEA. Some of our service providers may process personal data outside the United Kingdom, including in the EEA, the United States, or other jurisdictions.

Where personal data is transferred outside the UK, we will take steps designed to ensure that appropriate safeguards are in place. These may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms.

11. How long we keep your personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide our products and services, maintain business records, comply with legal obligations, support product traceability, investigate complaints, monitor product performance, and establish, exercise, or defend legal claims.

Unless a longer period is required or justified, our standard retention periods are as follows.

Order and transaction records are retained for 6 years.

Booking and redemption records are retained for 6 years where they are linked to an application, complaint, or transaction.

Waiver and application consent records are retained for 6 years from the date of application.

Product traceability and application records are retained for 6 years from the date of application.

Age eligibility confirmation records, including the date of birth on your waiver, are retained for 6 years from the date of application. We do not retain ID copies, ID numbers, or ID type.

Complaint and adverse reaction records are retained for 6 years from resolution, or longer where necessary for legal, insurance, regulatory, or product safety reasons.

Marketing consent records are retained until you unsubscribe, plus a suppression record to ensure we do not contact you again.

Photos, videos, reviews, and testimonials are retained until consent is withdrawn or the content is no longer needed for the purpose for which it was collected.

General enquiries and customer support records, including Instagram messages, are retained for up to 2 years after the last interaction, unless they are linked to an order, application, complaint, safety matter, or legal issue.

Detailed website analytics records are retained for 90 days. After that, we keep only aggregated statistics that do not identify you.

Account sign-in codes expire after 15 minutes.

We may anonymise personal data so that it no longer identifies you. Anonymised data may be used for research, analytics, quality improvement, internal reporting, and business planning.

12. How we protect your personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

These measures may include access controls, encryption in transit, staff sign-in through our company accounts, restricted staff access, confidentiality obligations, internal procedures, secure systems, and supplier due diligence.

Only authorised personnel and service providers may access personal data where they need it for their role or service.

No internet transmission or storage system can be guaranteed to be completely secure. If you believe your interaction with us is no longer secure, please contact us immediately at support@cipherx.tech.

13. Your rights

Depending on the circumstances, you may have the right to access your personal data, correct inaccurate or incomplete personal data, request deletion of your personal data, restrict how we use your personal data, object to certain uses of your personal data, request transfer of your personal data, withdraw consent where we rely on consent, and complain to the ICO.

To exercise your rights, contact us at support@cipherx.tech.

We may need to verify your identity before responding to a request. We will normally respond within one month, unless the request is complex or numerous.

If you ask us to delete your personal data, we may need to keep some records, such as signed waivers, application records, and the financial details of orders, where we are required or permitted to by law, for example for product traceability, safety, accounting, or legal claims. Where this applies, we will tell you which records we have kept and why.

You will not usually have to pay a fee to exercise your rights. However, we may refuse to comply with a request or charge a reasonable fee where the request is clearly unfounded, repetitive, or excessive.

14. Children and age-restricted services

Our Microdot Tattoo application services are intended only for individuals aged 18 or over.

We do not knowingly provide Microdot Tattoo application services to individuals under 18. If we become aware that we have collected personal data from a person under 18 in connection with a Microdot Tattoo application, we will take appropriate steps to delete or restrict that data unless retention is required for legal, safety, complaint-handling, insurance, safeguarding, or regulatory reasons.

15. Links to other websites and platforms

Our website may contain links to third-party websites, platforms, or social media services, including Instagram, TikTok, or other external platforms.

We are not responsible for the privacy practices of those third parties. You should read their privacy policies before providing personal data to them or interacting with their services.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will be posted on our website with the updated date.

Where changes are material, we may take additional steps to notify you, such as displaying a notice on our website or contacting you directly where appropriate.

17. Contact us

For questions about this Privacy Policy or how we use your personal data, please contact:

CipherX Technologies Ltd
Scale Space Building
58 Wood Lane
London W12 7RZ
United Kingdom

Email: support@cipherx.tech