Privacy Policy

Effective date: 2 July 2023
Last updated: 21 July 2026

Xa Handmade respects the privacy of its customers, students and website visitors. This Privacy Policy explains what personal information we collect, how we use it, when we share it, how long we keep it and the choices available to you.

This Privacy Policy applies when you:

  • Visit xahandmade.com;
  • Create or use a customer account;
  • Purchase or customise a product;
  • Register for an online jewellery-making course;
  • Submit a website form;
  • Contact us by email, WhatsApp or social media;
  • Leave a product review; or
  • Otherwise interact with Xa Handmade.

By using the website or providing personal information to Xa Handmade, you acknowledge the practices described in this Privacy Policy.

1. About Xa Handmade

Xa Handmade is an online handmade jewellery and craft business based in Faisalabad, Punjab, Pakistan.

We offer:

  • Handmade and personalised jewellery;
  • Ready-made jewellery;
  • Beaded bags;
  • Jewellery-making materials;
  • Jewellery-making tools;
  • Starter kits;
  • Online jewellery-making courses; and
  • Related handmade products and services.

For privacy-related questions or requests, contact:

Business name: Xa Handmade
Business location: Faisalabad, Punjab, Pakistan
Website: xahandmade.com
Email: info@xahandmade.com

Xa Handmade determines why and how personal information collected directly through the website is used. Independent payment providers, banks, couriers, communication platforms and other third parties may separately process information under their own privacy policies.

2. Personal Information We Collect

The personal information we collect depends on how you interact with Xa Handmade.

Contact and identification information

We may collect:

  • Full name;
  • Email address;
  • Telephone or WhatsApp number;
  • Billing address;
  • Shipping address;
  • City;
  • Province, state or region;
  • Postal code;
  • Country; and
  • Recipient information where an order is being sent to another person.

Order and transaction information

When you place an order, we may collect:

  • Products ordered;
  • Product quantities;
  • Product prices;
  • Customisation charges;
  • Shipping charges;
  • Order total;
  • Currency;
  • Payment method;
  • Payment reference or transaction ID;
  • Payment-verification information;
  • Order status;
  • Billing and shipping information;
  • Delivery instructions;
  • Courier and tracking information;
  • Customer-service history; and
  • Cancellation, return, exchange or refund information.

Personalised-product information

For personalised or made-to-order products, we may collect:

  • A name, initials or wording to be placed on the product;
  • Selected number of letters;
  • Measurements;
  • Size;
  • Chain length;
  • Material;
  • Finish;
  • Gemstone;
  • Bead colour;
  • Gift-box selection;
  • Design preferences; and
  • Other customisation instructions.

We use this information to prepare and fulfil the personalised order.

You should provide another person’s name, delivery details or other personal information only where you have permission or another lawful reason to do so.

Xa Handmade will not use a customer’s personalised name, private message, payment evidence or identifiable order photograph in advertising or promotional material without permission.

Customer-account information

When you create or use an account, we may collect:

  • Name;
  • Email address;
  • Username;
  • Login and account activity;
  • Saved billing and shipping addresses;
  • Order history; and
  • Account preferences.

Customer passwords are protected through the website’s authentication system. Xa Handmade cannot view customer passwords in plain text.

Course-registration information

When you register for an online jewellery-making course, we may collect:

  • Student or participant name;
  • Email address;
  • Telephone or WhatsApp number;
  • Course selected;
  • Registration information;
  • Payment confirmation;
  • Attendance information;
  • Course-related questions;
  • Messages or support requests; and
  • Information reasonably necessary to administer and deliver the course.

Online classes may be delivered through Zoom or another platform disclosed to participants.

If a class is to be recorded, participants will be informed in advance. Where consent is required, recording will take place only after the necessary consent has been obtained.

Communications and support information

We may collect and retain information you provide through:

  • Contact forms;
  • Course-registration forms;
  • Checkout forms;
  • Email;
  • WhatsApp;
  • Customer-support messages;
  • Refund or exchange requests;
  • Product reviews;
  • Social-media messages; and
  • Other communications with Xa Handmade.

This may include your contact details, the contents of the communication and any attachments you provide.

Payment-verification information

Where payment is verified manually, we may collect:

  • Payment method;
  • Transaction reference or transaction ID;
  • Payer or account-holder name;
  • Amount paid;
  • Date of payment;
  • Order number; and
  • A payment-confirmation screenshot where reasonably required.

Customers should conceal unrelated balances, passwords, PINs, identity numbers and other unnecessary sensitive information before sending a payment screenshot.

Technical and usage information

When you use the website, certain technical information may be collected automatically, including:

  • Internet Protocol address;
  • Browser type;
  • Device type;
  • Operating system;
  • Date and time of access;
  • Referring website;
  • Pages viewed;
  • Cart and checkout activity;
  • Login activity;
  • Cookie identifiers;
  • Error logs;
  • Security logs; and
  • Information used to prevent fraud or unauthorised access.

3. How We Collect Personal Information

We may collect personal information:

  • Directly from you when you place an order;
  • When you customise a product;
  • When you create or update an account;
  • When you complete a website form;
  • When you register for a course;
  • When you contact us by email, WhatsApp or social media;
  • When you leave a product review;
  • Automatically through cookies, server logs and security tools;
  • From banks or payment providers when a transaction is confirmed;
  • From couriers in connection with delivery, tracking or returns; and
  • From service providers that help us operate the website and fulfil your request.

4. How We Use Personal Information

Xa Handmade may use personal information to:

  • Receive and process orders;
  • Verify payments;
  • Prepare personalised and made-to-order products;
  • Confirm names, spellings, measurements and other customisation details;
  • Arrange shipment and delivery;
  • Send order and delivery updates;
  • Create and manage customer accounts;
  • Register participants for online courses;
  • Provide course links, schedules and course-related communication;
  • Respond to questions and customer-support requests;
  • Process cancellations, returns, exchanges and refunds;
  • Investigate missing, damaged or incorrect orders;
  • Resolve delivery or payment disputes;
  • Prevent fraud and unauthorised transactions;
  • Protect the website, customers and business;
  • Maintain and improve website functionality;
  • Maintain accounting, payment and transaction records;
  • Enforce applicable terms and policies;
  • Establish, exercise or defend legal claims;
  • Comply with legal, tax, accounting and regulatory obligations; and
  • Send optional marketing communications where permitted and appropriate.

We will not use personal information for a materially unrelated purpose without providing appropriate notice and, where required, obtaining consent.

5. Grounds for Processing

Where applicable law requires a lawful basis for processing personal information, Xa Handmade may rely on:

  • Contractual necessity: to process an order, deliver a product, provide a course or respond to a service request;
  • Legal obligations: to maintain records and comply with tax, accounting, regulatory or court requirements;
  • Legitimate business interests: to operate and secure the website, prevent fraud, improve services and protect legal rights;
  • Consent: for optional marketing, certain cookies, course recordings or another activity requiring permission; and
  • Legal claims and protection: to investigate disputes, misuse or suspected unlawful activity.

Where processing is based on consent, you may withdraw that consent, subject to applicable law and any processing already lawfully completed.

6. Payment Information

Xa Handmade may accept payment through methods displayed during checkout, including:

  • JazzCash;
  • Easypaisa;
  • Direct bank transfer to United Bank Limited;
  • PayPal, where lawfully available and enabled; and
  • Other payment methods clearly displayed during checkout.

Xa Handmade may receive the payment method, transaction reference and other limited information needed to verify the payment.

Xa Handmade does not ask customers to provide:

  • Online-banking passwords;
  • JazzCash or Easypaisa passwords;
  • Mobile-wallet PINs;
  • ATM PINs;
  • One-time passwords;
  • PayPal passwords;
  • Complete debit-card or credit-card numbers; or
  • Card-security codes.

Banks, mobile-wallet providers, PayPal and other payment services process information according to their own terms, privacy policies and security procedures.

7. Shipping and Delivery

Xa Handmade may use TRAX or another courier or delivery service to fulfil orders.

We may provide the courier with information reasonably required to deliver or return a parcel, including:

  • Recipient name;
  • Telephone number;
  • Shipping address;
  • City and postal code;
  • Delivery instructions;
  • Parcel details;
  • Order number; and
  • Tracking number.

Courier companies may process this information under their own privacy policies and operational requirements.

Xa Handmade does not provide couriers with information that is unnecessary for delivery.

8. Online Courses and Communication Platforms

Online jewellery-making courses may be delivered or supported through:

  • Zoom;
  • Email;
  • WhatsApp;
  • Website forms; or
  • Another platform disclosed to participants.

When you communicate through Zoom, WhatsApp, Instagram, Facebook or another third-party platform, that platform may independently collect and process information under its own privacy policy.

Participants should not share passwords, payment credentials, identity documents, home addresses or other unnecessary sensitive information in group chats or course sessions.

9. Website Forms and Email Delivery

Information submitted through contact, registration, checkout or other website forms may be:

  • Stored within the WordPress website or its database;
  • Sent to an authorised Xa Handmade email account;
  • Processed by an email-delivery service;
  • Used to respond to the submission; and
  • Retained for order management, customer service, course administration, security or record-keeping.

Access should be limited to persons who require the information to operate Xa Handmade or provide the relevant service.

10. Cookies and Similar Technologies

The website uses cookies and similar technologies required for WordPress, WooCommerce and essential website functions.

Essential cookies may be used to:

  • Keep products in the shopping cart;
  • Maintain checkout sessions;
  • Allow customers to sign in;
  • Remember basic preferences;
  • Protect accounts and website security;
  • Prevent fraudulent activity;
  • Maintain website sessions; and
  • Keep the website functioning correctly.

Blocking essential cookies may prevent the cart, checkout, login or customer-account features from working properly.

Xa Handmade does not currently state that Google Analytics, Meta Pixel or advertising cookies are active because these services have not been confirmed as enabled on the website.

If non-essential analytics, advertising or tracking technologies are introduced later:

  • This Privacy Policy will be updated;
  • A cookie notice or consent mechanism will be implemented where required; and
  • Non-essential cookies will be managed according to applicable consent requirements.

You may also control cookies through your browser settings. Disabling cookies may affect website functionality.

11. Product Reviews and Public Content

Customers may be able to submit product reviews or other public content.

Information included in a public review may be visible to other visitors. Customers should not publish:

  • Home addresses;
  • Telephone numbers;
  • Transaction references;
  • Bank or mobile-wallet details;
  • Payment screenshots;
  • Passwords or PINs; or
  • Other confidential information.

Xa Handmade may moderate or remove reviews containing personal information, abusive content, unlawful material, spam or content unrelated to the product.

12. Marketing Communications

Xa Handmade may send promotional emails or messages where:

  • You have subscribed;
  • You have requested product or course updates;
  • You have otherwise agreed to receive marketing; or
  • The communication is permitted by applicable law.

You may unsubscribe by:

Unsubscribing from marketing will not stop essential communications concerning:

  • An existing order;
  • Payment verification;
  • Delivery;
  • Customer support;
  • Course registration;
  • Security;
  • Returns or exchanges; or
  • Refunds.

Xa Handmade does not sell contact lists to unrelated businesses.

13. When We Share Personal Information

Xa Handmade may share limited personal information with parties that help operate the website and fulfil customer requests, including:

  • Website-hosting providers;
  • WordPress and WooCommerce service providers;
  • Website-form providers;
  • Email-delivery providers;
  • Banks and payment providers;
  • Couriers and delivery companies;
  • Zoom and other communication platforms;
  • Website-security, anti-spam and backup providers;
  • Technical support providers;
  • Accountants, legal advisers and other professional advisers;
  • Government, tax, regulatory, law-enforcement or judicial authorities where legally required; and
  • A purchaser or successor if Xa Handmade is sold, transferred, merged or reorganised.

We seek to share only the information reasonably necessary for the relevant purpose.

Service providers may process information under contractual obligations, their own legal responsibilities or their independent privacy policies.

14. Sale of Personal Information

Xa Handmade does not sell customers’ personal information.

Xa Handmade does not provide customer names, telephone numbers, addresses, personalised names or order details to unrelated businesses for their own direct-marketing purposes.

If these practices change, this Privacy Policy will be updated and any legally required notice, consent or opt-out mechanism will be provided.

15. International Customers and Data Transfers

Xa Handmade is based in Pakistan and may accept orders or course registrations from customers in other countries.

Website hosting, email, payment, communication, course, security, backup or delivery providers may process information in Pakistan or another country.

The privacy and data-protection laws of those countries may differ from the laws of the customer’s country.

Where required and reasonably available, Xa Handmade will take appropriate steps to use reputable providers and protect personal information during international processing or transfer.

16. How Long We Keep Personal Information

Xa Handmade keeps personal information only for as long as reasonably necessary for the purpose for which it was collected and for customer-service, accounting, tax, fraud-prevention, dispute-resolution and legal requirements.

The intended retention periods are:

Completed orders and transaction records

Generally up to six years after the relevant transaction or accounting period, or longer where required for:

  • An unresolved audit;
  • Tax or accounting requirements;
  • A payment dispute;
  • Fraud prevention;
  • A legal claim; or
  • Another lawful obligation.

Pending orders

Generally up to 30 days, unless:

  • Payment is completed;
  • The order remains active;
  • The customer asks us to retain it; or
  • Longer retention is reasonably necessary.

Failed orders

Generally up to 30 days, unless longer retention is reasonably necessary for fraud prevention, payment investigation or legal purposes.

Cancelled orders

Generally up to 12 months, except where related information must be retained for accounting, fraud-prevention, dispute or legal purposes.

Inactive customer accounts

Generally up to 24 months after the last account activity.

Order and transaction information associated with an account may be retained separately for the applicable order-record period.

Contact forms and customer-support communications

Generally up to 24 months after the enquiry or complaint has been resolved, unless longer retention is reasonably necessary.

Course-registration records

Generally up to 24 months after the course has ended.

Payment, accounting and dispute-related records connected with a course may be retained for up to six years or longer where required.

Marketing records

Until:

  • You unsubscribe;
  • Consent is withdrawn; or
  • There has been approximately 24 months of inactivity.

Xa Handmade may retain limited suppression information to ensure that an unsubscribe request continues to be respected.

Technical, security and access logs

Generally up to 12 months, unless required to investigate:

  • Fraud;
  • Unauthorised access;
  • Website misuse;
  • A security incident; or
  • A legal claim.

Website backups

Personal information may remain temporarily in secured backups after deletion from active systems until the backup is overwritten or safely deleted through the normal backup cycle.

After the relevant retention period, information may be deleted, anonymised or securely destroyed.

Anonymous or aggregated information that no longer identifies an individual may be retained for business analysis, security or statistical purposes.

17. How We Protect Personal Information

Xa Handmade uses reasonable administrative, organisational and technical measures intended to protect personal information, including:

  • Secure website connections;
  • Restricted administrator access;
  • Password-protected accounts;
  • Website, theme and plugin updates;
  • Website backups;
  • Security monitoring;
  • Anti-spam and fraud-prevention measures;
  • Limited access to customer information;
  • Use of established service providers; and
  • Procedures for responding to suspected security incidents.

No website, email system, database or internet transmission can be guaranteed to be completely secure.

Customers should:

  • Use strong and unique account passwords;
  • Keep login credentials private;
  • Sign out on shared devices; and
  • Never send passwords, PINs or one-time passwords to Xa Handmade.

18. Security Incidents

If Xa Handmade becomes aware of a security incident involving personal information, we will take reasonable steps to:

  • Investigate the incident;
  • Reduce further risk;
  • Secure affected systems;
  • Preserve necessary evidence;
  • Contact relevant service providers; and
  • Notify affected individuals or authorities where required by applicable law or reasonably necessary to protect customers.

19. Your Privacy Choices and Rights

Depending on applicable law and the circumstances, you may ask Xa Handmade to:

  • Confirm whether we hold personal information about you;
  • Provide access to personal information held about you;
  • Correct inaccurate or incomplete information;
  • Provide a copy of certain information;
  • Delete information that is no longer required;
  • Restrict or object to certain uses;
  • Withdraw consent where processing is based on consent;
  • Stop direct-marketing communications;
  • Explain how information has been used or shared; or
  • Address a privacy-related complaint.

These rights are not absolute. Xa Handmade may retain or continue using information where reasonably necessary for:

  • An active order;
  • Contract performance;
  • Accounting or tax requirements;
  • Fraud prevention;
  • Website and account security;
  • A payment or delivery dispute;
  • Establishing or defending a legal claim;
  • Compliance with a court, regulator or lawful authority; or
  • Another lawful reason.

20. How to Submit a Privacy Request

Send privacy requests to:

Email: info@xahandmade.com
Subject: Privacy Request

Please include enough information to help us identify the relevant records and understand your request.

Xa Handmade may request reasonable information to verify your identity before providing, correcting or deleting personal information.

We will respond within a reasonable period and within any period required by applicable law.

We will not intentionally discriminate against a customer for making a genuine privacy request.

21. Children and Minors

The website is not intended for independent use by children under 13.

Orders or course registrations for a minor should be completed or authorised by a parent or legal guardian.

Where a course is suitable for a minor, the parent or guardian should provide the necessary registration and contact information.

A parent or guardian may contact info@xahandmade.com to request review, correction or deletion of information submitted by a minor, subject to applicable order, payment, accounting and legal requirements.

22. Third-Party Links

The website may contain links to third-party platforms or services, including:

  • WhatsApp;
  • Instagram;
  • Facebook;
  • Zoom;
  • PayPal;
  • Courier tracking services; and
  • Other external websites.

Xa Handmade does not control the privacy or security practices of independent third parties.

Customers should review the relevant third party’s privacy policy before submitting information directly to that service.

The presence of a link does not mean Xa Handmade is responsible for the third party’s processing activities.

23. Business Transfers

If Xa Handmade is sold, transferred, merged, reorganised or otherwise changes ownership, personal information may be transferred as part of the business records where reasonably necessary.

Any successor receiving the information will be expected to handle it consistently with this Privacy Policy or provide appropriate notice of any materially different practice.

24. Changes to This Privacy Policy

Xa Handmade may update this Privacy Policy when there are changes to:

  • Products or courses;
  • Payment methods;
  • Couriers;
  • Website hosting;
  • WordPress or WooCommerce functionality;
  • Plugins or forms;
  • Email or communication services;
  • Analytics or advertising tools;
  • Cookies;
  • Information-handling practices;
  • Retention periods; or
  • Applicable legal requirements.

The revised policy will be published on this page with an updated Last updated date.

Where a change is material, Xa Handmade may also provide additional notice through the website, email or another appropriate communication method.

25. Applicable Law

This Privacy Policy is intended to operate consistently with applicable laws of Pakistan and Punjab.

Customers located outside Pakistan may also have rights under laws that apply to them or to the relevant processing activity.

Nothing in this Privacy Policy limits a right or remedy that cannot lawfully be excluded.

26. Contact Xa Handmade

For privacy questions, complaints or requests, contact:

Xa Handmade
Faisalabad, Punjab, Pakistan
Website: xahandmade.com
Email: info@xahandmade.com

When contacting us about an account, order or course, include the relevant order or registration number where available. Do not send passwords, PINs or one-time passwords.

Shopping Cart