Enjoy Free 48 hours Delivery on all orders.
This notice explains how VIXII collects and uses personal data at our retail pop-up event, our legal basis for doing so, how long we keep it, and the rights you have under the UK GDPR.
VIXII is the data controller responsible for personal data collected at this pop-up event. This means we determine the purposes and means of processing your personal data.
VIXII and/or the venue operator may operate CCTV cameras within and around the pop-up. CCTV captures video footage of individuals present at the event. Where the venue operator operates CCTV independently, it is an independent data controller for that processing.
VIXII uses an AI Analytics system that processes video footage to track customer movement paths through the store and to record which products customers interact with or pay attention to. The system does not currently use facial recognition or gait analysis and does not process biometric data as defined under Article 4(14) UK GDPR. It does not make automated decisions that produce legal or similarly significant effects on individuals.
VIXII uses an AI Analytics system that processes video footage to generate aggregated footfall analytics, zone dwell data, and heatmap analytics showing customer movement paths through the store and interactions with specific products. The AI Analytics system does not make automated decisions that produce legal or similarly significant effects on individuals.
Where you provide your name, email address, or other contact details (for example, at the point of purchase, in connection with an enquiry, or when enrolling in the VIXII Gems loyalty programme), we collect and process that information.
We collect records of transactions completed at the pop-up, including items purchased, price, and payment method (though we do not retain full card details).
| Purpose | Lawful basis under UK GDPR |
|---|---|
| CCTV: security, safety, and loss prevention | Legitimate interests (Article 6(1)(f)). We have assessed that this processing is necessary and proportionate and does not override your rights. |
| AI Analytics: product development, store layout, marketing strategy, and future events | Legitimate interests (Article 6(1)(f)). We have conducted a Legitimate Interests Assessment. The data is used at an aggregate and anonymised level for commercial improvement purposes. |
| Issuing receipts and managing purchases | Performance of a contract / legitimate interests (Article 6(1)(b) and (f)). |
| Responding to customer enquiries | Legitimate interests (Article 6(1)(f)). |
| Sending marketing communications (email) | Consent (Article 6(1)(a)) or soft opt in under Regulation 22 PECR where applicable. |
| Administering the VIXII Gems loyalty programme | Performance of a contract / consent where applicable (Article 6(1)(b) and (a)). |
| Membership: facial recognition for return visit identification | Explicit consent (Article 6(1)(a) and Article 9(2)(a)). You may decline enrolment or withdraw consent at any time. |
| Data type | Retention period |
|---|---|
| CCTV footage | Maximum 7 days, unless required longer in connection with an incident, investigation, or legal claim. |
| AI Analytics data | Aggregated, non personal footfall and zone dwell analytics are retained indefinitely for trend analysis. Member biometric records (face embeddings) are deleted after 12 months of inactivity. |
| Customer contact details and purchase records | 5 years from the date of the relevant transaction, or longer if required by law. |
| Membership biometric records (face embeddings) | Deleted after 12 months of inactivity, or upon withdrawal of consent, whichever is earlier. |
| Marketing consent records | Until consent is withdrawn, plus a further period for compliance purposes. |
We may share your personal data with:
We do not sell your personal data. Where any provider processes data outside the United Kingdom, we ensure that appropriate safeguards are in place, including the International Data Transfer Agreement or equivalent mechanism under UK GDPR.
Under UK GDPR you have the following rights. To exercise any of them, contact us at the details in section 1.
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you. |
| Rectification | Ask us to correct inaccurate or incomplete data. |
| Erasure | Ask us to delete your data in certain circumstances. |
| Restriction | Ask us to restrict how we use your data in certain circumstances. |
| Objection | Object to processing based on legitimate interests or for direct marketing purposes. Where we rely on legitimate interests, we will stop unless we have compelling grounds that override your interests. |
| Data portability | Receive your data in a structured, machine readable format in certain circumstances. |
| Withdraw consent | Where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. |
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at any time:
We do not use your personal data to make automated decisions that produce legal or similarly significant effects on you. The AI Analytics system generates aggregate and anonymised data about movement and product interaction patterns; it does not produce individual profiles used for decision making about you.
VIXII and its representatives may photograph or film the pop-up event for promotional, editorial, and social media purposes. If you do not wish to be photographed or filmed, please notify VIXII staff at entry or at any time during your visit.
We may update this notice from time to time. The current version will always be available on our website and displayed at the entrance to the pop-up. The version date is shown at the top of this notice.
For any privacy related query, to exercise your rights, or to raise a concern:
