PRIVACY POLICY
Last updated: June 2026
This Privacy Policy explains how XO Henning (“we”, “us”, or “our”) collects, uses, stores, and protects your personal data when you visit our website, purchase artworks through our online store, subscribe to our newsletter, or otherwise interact with us.
We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable German data protection laws.
1. Data Controller
The data controller responsible for the processing of personal data is:
XO Henning
Hamburg, Germany
Email: xo@xoxoxo.space
2. Personal Data We Collect
We may collect and process the following categories of personal data:
Information you provide directly:
Full name
Billing address
Shipping address
Email address
Telephone number (if provided)
Order details and purchase history
Information submitted through contact forms
Newsletter subscription information
Any other information voluntarily provided by you
Information collected automatically:
IP address
Browser type and version
Device information
Operating system
Referral source
Pages visited and time spent on our website
Website interaction data
Cookie identifiers
3. Purposes and Legal Bases for Processing
We process your personal data only where a lawful basis exists under Article 6 GDPR.
Purpose
Legal Basis
Processing and fulfilling orders
Art. 6(1)(b) GDPR – Performance of a contract
Shipping and delivery of artworks
Art. 6(1)(b) GDPR
Customer service and responding to inquiries
Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR
Compliance with legal and tax obligations
Art. 6(1)(c) GDPR
Prevention of fraud and protection of our business interests
Art. 6(1)(f) GDPR
Website analytics and performance monitoring
Art. 6(1)(f) GDPR
Sending newsletters and marketing communications
Art. 6(1)(a) GDPR – Consent
4. Orders and Payment Processing
When you purchase artworks through our online store, we process your personal data to complete your order and arrange shipment.
Payments are processed securely through third-party payment providers, including:
Stripe
PayPal
We do not store complete payment card information on our servers.
The processing of payment data is subject to the privacy policies of the respective providers.
5. Newsletter and Email Marketing
If you subscribe to our newsletter, we process your email address to send updates regarding:
New artworks
Exhibitions
Releases and collections
Studio news
Promotions and announcements
We use Brevo (formerly Sendinblue) as our email marketing provider.
Newsletter subscriptions are based solely on your consent under Article 6(1)(a) GDPR.
You may withdraw your consent at any time by clicking the unsubscribe link included in every newsletter or by contacting us directly.
6. Shipping and Logistics
To fulfill your orders, we may share necessary personal information with shipping and logistics providers.
This information may include:
Name
Shipping address
Email address
Telephone number (where required)
Such processing is necessary for the performance of our contractual obligations under Article 6(1)(b) GDPR.
7. Squarespace Hosting and Website Services
Our website is hosted and operated through Squarespace.
Squarespace may process certain technical information automatically, including:
IP addresses
Browser information
Device identifiers
Website activity logs
This processing is necessary to provide website functionality, maintain security, and improve performance.
For further information, please review Squarespace’s privacy practices.
8. Analytics
We use Squarespace Analytics to better understand how visitors interact with our website.
Analytics data may include:
Pages viewed
Traffic sources
Device types
Visitor behavior
Session duration
Where required by applicable law, analytics technologies are only activated with your consent.
9. Cookies
Our website uses cookies and similar technologies.
Cookies may be used for:
Essential website functionality
Shopping cart functionality
Security purposes
Website analytics
Remembering user preferences
You can manage cookie preferences through your browser settings.
Please note that disabling certain cookies may affect website functionality.
10. International Data Transfers
Some of our service providers may process personal data outside the European Economic Area (EEA).
Where personal data is transferred internationally, we ensure that appropriate safeguards are implemented in accordance with Chapter V GDPR, including:
Adequacy decisions adopted by the European Commission; or
Standard Contractual Clauses approved by the European Commission.
11. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy.
Retention periods may vary depending on legal requirements.
Examples include:
Tax and accounting records: retained in accordance with applicable legal obligations.
Customer correspondence: retained for legitimate business purposes.
Newsletter data: retained until consent is withdrawn.
Once retention periods expire, personal data will be securely deleted or anonymized.
12. Your Rights Under GDPR
Under applicable data protection laws, you may have the right to:
Request access to your personal data (Art. 15 GDPR);
Request rectification of inaccurate data (Art. 16 GDPR);
Request erasure of personal data (Art. 17 GDPR);
Request restriction of processing (Art. 18 GDPR);
Object to processing based on legitimate interests (Art. 21 GDPR);
Request data portability (Art. 20 GDPR);
Withdraw consent at any time where processing is based on consent (Art. 7 GDPR);
Lodge a complaint with a supervisory authority.
13. Right to Object
Where personal data is processed based on legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing reasons.
14. Data Security
We implement appropriate technical and organizational measures designed to protect personal data against:
Unauthorized access;
Loss;
Alteration;
Disclosure;
Destruction.
However, no method of transmission over the internet can be guaranteed to be completely secure.
15. Children’s Privacy
Our website and services are not intended for individuals under the age of 16.
We do not knowingly collect personal data from children.
If we become aware that personal data has been collected from a child without appropriate consent, we will take steps to delete such information promptly.
16. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy from time to time to reflect changes in legal requirements or our business practices.
Any modifications will become effective upon publication on this website.
We encourage visitors to review this Privacy Policy periodically.
17. Contact
If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact:
XO Henning
Germany
Email: xo@xoxoxo.space
18. Supervisory Authority
If you believe that the processing of your personal data violates applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority in Germany.
You may contact the supervisory authority responsible for your place of residence or the authority responsible for the federal state in which XO Henning is established.
By using this website, placing an order, or subscribing to our newsletter, you acknowledge that you have read and understood this Privacy Policy.