Legal

Privacy Policy

XMuscle is a trading name of Mando Systems Ltd (Company No. 17168657)

Terms Privacy Delivery Returns Cookies Supplement Safety

This Privacy Policy explains how XMuscle (xmuscle.co.uk) collects, uses, stores and protects your personal data when you visit our website, create an account, place an order or contact us. Please read it carefully. It should be read alongside our Cookie Policy and our Returns Policy.

We are committed to protecting your privacy and handling your personal data in an open and transparent manner, in line with the UK GDPR and the Data Protection Act 2018.

Who we are

XMuscle is a trading name of Mando Systems Ltd, a company registered in England & Wales under Company No. 17168657, with its registered office at 10 Pilgrims Walk, Worthing, BN13 1RJ.

For the purposes of data protection law, Mando Systems Ltd is the data controller responsible for your personal data.

If you have any questions about this policy or about how we handle your data, you can contact us at hello@xmuscle.co.uk.

Our products are food supplements and are intended for adults only. You must be 18 or over to purchase from us, and we do not knowingly collect personal data from anyone under 18.

What data we collect

Depending on how you use our website, we may collect and process the following categories of personal data:

Account data — your name, email address, password (stored securely) and any preferences you save to your account.
Order data — details of the products you purchase, order history, order value and confirmation of your age eligibility (18+).
Delivery data — your delivery address, billing address and any delivery instructions needed to fulfil your order.
Contact data — your name, email address, telephone number and the content of any messages you send us.
Marketing consent data — your preferences about whether you wish to receive marketing communications from us, and any consents or opt-outs you record.
Technical and cookie data — your IP address, browser type and version, device information, pages viewed, and information collected through cookies and similar technologies (see our Cookie Policy).

We do not store your full payment card details. Payments are handled securely by PayPal (see "Who we share your data with" below).

Our lawful bases for processing

Under the UK GDPR we must have a valid lawful basis to process your personal data. We rely on the following:

Performance of a contract — to process and deliver your orders, manage your account, handle returns and refunds, and provide customer support.
Consent — to send you marketing communications where you have opted in, and to set non-essential cookies. You can withdraw your consent at any time.
Legitimate interests — to run and improve our website and business, prevent fraud, keep our systems secure, and communicate with you about your orders, provided your rights and interests do not override these interests.
Legal obligation — to comply with our legal and regulatory duties, such as tax, accounting and consumer protection requirements.

How we use your data

We use your personal data to:

Create and manage your account.
Process, fulfil and deliver your orders, and take payment via PayPal.
Send you order confirmations, dispatch updates and other service messages relating to your purchases.
Handle returns, cancellations and refunds, and respond to your enquiries and complaints.
Manage any recurring subscription you have chosen to set up (see below).
Send you marketing communications where you have consented, and let you unsubscribe.
Improve our website, products and services, and keep our systems safe and secure.
Comply with our legal, regulatory and accounting obligations, and prevent fraud and misuse.

Who we share your data with

We do not sell your personal data. We share it only where necessary to run our business and provide our service, including with:

PayPal — our payment processor, which securely handles payments (including PayPal balance, credit/debit card, Apple Pay, Google Pay and Pay by Bank) and any recurring subscriptions. PayPal processes your payment data as an independent controller under its own privacy terms.
Delivery providers — the couriers and delivery partners we use to dispatch your order to your chosen address in mainland UK.
Communication providers — the email and SMS service providers we use to send you service messages and, where you have opted in, marketing communications.
Professional advisers and authorities — such as accountants, auditors, legal advisers and regulators, where required by law or to protect our legal rights.

All providers who process personal data on our behalf are required to keep it secure and to use it only for the purposes we specify.

International transfers

Wherever possible your data is stored and processed within the UK. Some of our providers may process data outside the UK. Where this happens, we take steps to ensure your data continues to be protected to the standard required by UK data protection law, for example by relying on adequacy decisions or by putting in place appropriate safeguards such as approved contractual clauses.

How long we keep your data

We keep your personal data only for as long as necessary for the purposes set out in this policy. In practice:

Account data is kept while your account remains active, and for a reasonable period afterwards.
Order, payment and delivery records are kept for as long as required to meet our legal, tax and accounting obligations (generally at least six years).
Marketing consent records are kept until you unsubscribe or withdraw consent, plus a short period to evidence your choices.

When we no longer need your data, we will securely delete or anonymise it.

Your rights

Under the UK GDPR you have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to ask us to correct data that is inaccurate or incomplete.
Right to erasure — to ask us to delete your data in certain circumstances.
Right to restriction — to ask us to limit how we use your data in certain circumstances.
Right to data portability — to receive certain data in a structured, commonly used and machine-readable format, or to have it transferred to another controller.
Right to object — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
Right to withdraw consent — where we rely on your consent, to withdraw it at any time (this does not affect processing carried out before you withdrew it).

How to exercise your rights

To exercise any of your rights, please contact us at hello@xmuscle.co.uk. We may need to verify your identity before responding. We will respond within one month, though we may extend this in complex cases. Exercising your rights is normally free of charge.

Marketing communications

We will only send you marketing communications where you have opted in to receive them. You can change your mind at any time by using the unsubscribe link in any marketing email, replying to opt out of SMS messages, or by contacting us at hello@xmuscle.co.uk. Opting out of marketing will not affect service messages relating to your orders.

Recurring subscriptions

We may offer recurring subscription orders through PayPal. If you set up a subscription, PayPal will take payment automatically on the schedule you agree. You can cancel your subscription at any time through your PayPal account or by contacting us at hello@xmuscle.co.uk.

Cookies

Our website uses cookies and similar technologies to make the site work, remember your preferences, and understand how the site is used. Non-essential cookies are only set where you have consented. For full details, including how to manage your preferences, please see our Cookie Policy.

Data security

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. Payments are processed securely by PayPal and we do not store your full card details on our systems.

Complaints

If you have a concern about how we handle your personal data, please contact us first at hello@xmuscle.co.uk so we can try to resolve it. You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and the "Last updated" date below will be revised accordingly. Please check back periodically to stay informed.

Last updated: July 2026