Privacy Policy

Last updated: 27 September 2026

Introduction

IconicSX Limited takes the privacy and security of personal information seriously. This Privacy Policy explains what personal information we collect, why we collect it, how it is used, who it may be shared with, how long it is retained and the rights available to individuals under UK data protection law.

1. Data Controller and Privacy Contact

Data Controller: IconicSX Limited
Registered in Scotland: Company No. SC796112
ICO Registration: ZB734232
Data Protection Lead: Maria Niewiadomska
Privacy contact: [email protected]

IconicSX Limited is the data controller responsible for the personal information processed in connection with this website, enquiries, waiting-list applications, visits, reservations, kitten placements and ongoing owner support.

Maria Niewiadomska acts as our Data Protection Lead and has completed formal Data Protection Officer training through the University of Derby. She oversees our day-to-day data protection practices, privacy documentation, information governance and responses to privacy-related enquiries and data protection requests.

You may contact our Data Protection Lead at [email protected] if you have any questions about how your personal information is used, wish to exercise your data protection rights, or have any concerns regarding this Privacy Policy.

ICO guidance requires a privacy notice to identify the controller and provide appropriate contact details, and DPO contact details only where a formal DPO applies.

2. Information We May Collect

Depending on your interaction with IconicSX, we may collect information including:

  • full name;

  • residential address;

  • email address and telephone number;

  • information provided through enquiries or waiting-list applications;

  • photographic identification;

  • proof of residential address;

  • information required for invoices and contractual documentation;

  • information required for insurance, microchip registration or transfer;

  • information required for GCCF, TICA or other relevant registration documentation;

  • information necessary for pedigree documentation and transfer of ownership;

  • veterinary or other references;

  • correspondence relating to a kitten or cat;

  • payment and transaction records;

  • information concerning the ongoing ownership and welfare of an IconicSX cat;

  • website and technical information such as IP address, browser, device, request information and website activity.

We aim to collect only information that is reasonably necessary for the relevant purpose.

3. Why We Use Personal Information

Personal information may be processed for purposes including:

  • responding to enquiries;

  • administering our waiting list;

  • assessing prospective homes;

  • verifying the identity and residential address of prospective owners;

  • protecting our cats and our private family home;

  • arranging visits;

  • preparing reservations and Sale Agreements;

  • invoicing and recording payments;

  • transferring legal ownership;

  • transferring or registering microchip details;

  • arranging insurance;

  • completing or releasing GCCF, TICA and other registration documentation;

  • issuing pedigree documentation;

  • arranging collection or transport;

  • providing lifelong breeder support;

  • administering health warranties and lifetime return provisions;

  • maintaining appropriate ownership, health and pedigree records;

  • preventing fraud, impersonation and misuse of false or altered documents;

  • protecting and securing our website and online services;

  • complying with legal, accounting or regulatory obligations;

  • establishing, exercising or defending legal rights.

Depending on the purpose, our lawful basis for processing may include:

  • taking steps at your request before entering into a contract;

  • performance of a contract;

  • compliance with a legal obligation;

  • our legitimate interests in responsibly managing our breeding programme, protecting our cats, household and business, preventing fraud and maintaining appropriate records;

  • consent, where consent is specifically required.

We determine and document the appropriate lawful basis according to the particular processing activity.

4. Buyer Identity and Address Verification

For the protection of our cats and the integrity of our placement process, prospective owners are required to provide sufficient information for us to verify their identity and residential address.

This may include:

  • valid photographic identification, such as a passport or driving licence;

  • recent proof of residential address;

  • a suitable reference, preferably from a veterinary practice where applicable.

Where someone is acquiring their first pet and does not have an existing veterinary history, we may request an alternative reference or additional information instead.

Where relevant, we may also request confirmation that animals are permitted at the property.

The buyer's name and verified residential address must correspond with the information recorded in the Sale Agreement and associated ownership documentation.

Verified information may also be used where necessary for:

  • microchip transfer;

  • insurance;

  • transfer of ownership;

  • registration documents;

  • pedigree documentation;

  • invoicing;

  • authorised transport and delivery.

A kitten transported by IconicSX will only be delivered to the verified residential address recorded during the placement process, and photographic identification may be required before the kitten is handed over.

5. Please Redact Unnecessary Information Before Sending ID

We actively encourage prospective owners to remove information from identification documents that we do not need.

Unless we specifically ask for particular information, please obscure:

  • your full date of birth;

  • passport, driving licence or other document numbers;

  • machine-readable zones (MRZ);

  • QR codes or barcodes;

  • your signature;

  • place of birth;

  • unrelated reference numbers;

  • any other information not required for identity verification.

Please leave clearly visible:

  • your full name;

  • photograph;

  • type of document;

  • issuing authority or country;

  • expiry date.

If age verification is necessary, we may ask for sufficient information to confirm that the prospective owner is an adult. We do not require more information than is reasonably necessary for this purpose.

Where a separate proof-of-address document is supplied, it should show:

  • full name;

  • current residential address;

  • date of issue;

  • issuing organisation.

If a bank statement or similar financial document is used as proof of address, account numbers, balances, transactions and unrelated financial information should be redacted before it is sent to us.

If a date of birth or other information is separately required by an insurer, registration body or another service involved in completing the placement, we may request that information separately and explain why it is required.

This approach reflects the UK GDPR principle that personal information should be limited to what is necessary for the relevant purpose. Information Commissioner's Office

6. Accuracy and Authenticity of Information

Information and documents provided to IconicSX must be accurate and genuine and must relate to the person providing them unless they have lawful authority to act for someone else.

Identification or proof-of-address documents must not be falsified, altered in a misleading way or submitted using another person's identity.

Where information:

  • is inconsistent;

  • cannot reasonably be verified;

  • appears to have been improperly altered;

  • conflicts with other information supplied; or

  • gives us reasonable grounds to suspect impersonation, deception or fraudulent documentation,

we may pause the enquiry, reservation, visit, collection or delivery process and request additional evidence.

Until we are satisfied that identity has been appropriately verified, we may decline to:

  • confirm a visit to our private home;

  • proceed with a reservation;

  • complete a sale;

  • release a kitten or cat;

  • transfer legal ownership;

  • transfer microchip registration;

  • activate associated insurance;

  • release registration or pedigree documentation.

Any financial consequences arising from a cancelled reservation or transaction are governed separately by the applicable Sale Agreement, statutory consumer rights and applicable law.

7. Suspected Fraud, Impersonation or Forged Documents

Where there are reasonable grounds to suspect fraud, impersonation, forged or altered documentation, misuse of another person's identity or other unlawful conduct, relevant information may be retained and processed where necessary and lawful.

This may include processing information for:

  • investigating the matter;

  • protecting our cats, household or business;

  • preventing or detecting unlawful activity;

  • obtaining legal or professional advice;

  • establishing, exercising or defending legal claims;

  • cooperating with law-enforcement or other competent authorities.

We do not treat an unexplained discrepancy as proof of criminal conduct.

Information relating to an allegation or suspicion of criminal activity may constitute criminal-offence data and will therefore receive additional protection and restricted access where applicable.

8. References

Where a prospective owner provides details of a veterinary or other referee, we may contact that referee to confirm relevant information.

We will only seek information reasonably relevant to assessing the proposed placement.

Where possible, this will be done with the prospective owner's knowledge.

Referees' personal information will not be used for unrelated marketing or promotional purposes.

9. Who We May Share Information With

Where reasonably necessary, limited personal information may be shared with organisations involved in completing or administering a placement, including:

  • microchip databases;

  • insurance providers;

  • GCCF;

  • TICA;

  • veterinary professionals;

  • transport providers engaged by IconicSX;

  • banks and payment services;

  • accountants and professional advisers;

  • legal advisers;

  • website and technology providers;

  • law-enforcement or competent authorities where disclosure is necessary and lawful.

We aim to disclose only the information reasonably necessary for the particular purpose.

We do not sell personal information.

10. Squarespace

Our website is hosted using Squarespace.

When you visit the website, Squarespace may process information including:

  • IP address;

  • browser information;

  • network information;

  • device information;

  • referring pages;

  • pages visited;

  • clicks and internal links;

  • searches;

  • scrolling activity;

  • timestamps.

Squarespace provides hosting, website functionality and analytics services.

Squarespace confirms that its analytics can process browser, network, device and IP information together with information about how visitors use a website. Squarespace Help

11. Cloudflare

We use Cloudflare to assist with website security, network performance and protection against malicious or automated traffic.

When a visitor accesses our website, traffic may pass through Cloudflare before reaching the website.

Cloudflare may process technical information such as:

  • IP address;

  • request and traffic-routing information;

  • URLs requested;

  • browser or User-Agent information;

  • system and network configuration information;

  • timestamps;

  • security and threat indicators;

  • information used to distinguish legitimate traffic from bots or malicious requests.

We use this information for purposes such as website security, detecting unusual traffic, preventing abuse, rate limiting and investigating security incidents.

Cloudflare states that it processes information relating to users of customer websites including IP addresses, traffic-routing information and other traffic metadata. Cloudflare

12. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Cookies are small pieces of information stored on or accessed from a visitor's device. They may be required for website functionality, security, remembering choices or understanding website use.

Necessary Squarespace cookies

Squarespace uses necessary cookies to provide and secure website functionality.

Depending on the functions used by the website, these may include cookies used for:

  • security;

  • preventing cross-site request forgery;

  • remembering cookie choices;

  • website sessions;

  • redirects;

  • other essential Squarespace functions.

For example, Squarespace identifies Crumb as a session cookie used for CSRF protection and ss_performancecookiesAllowed as a cookie used to remember analytics-cookie choices for 30 days. Squarespace Help

Necessary cookies may operate without separate consent where they are genuinely necessary for the service requested by the visitor.

Squarespace analytics and performance cookies

Where enabled and accepted through our cookie controls, Squarespace may use analytics and performance cookies including:

CookieTypical purposeDurationss_cididentifies unique visitors and sessions2 yearsss_cpvisitidentifies unique visitors and sessions2 yearsss_cvridentifies unique visitors and sessions2 yearsss_cvisittracks visitor sessions30 minutesss_cvttracks visitor sessions30 minutes

These durations and purposes are specified by Squarespace. Squarespace Help

We use Squarespace's cookie controls to manage non-essential analytics and performance cookies.

Cloudflare security cookies

Cloudflare may place security-related cookies depending on the security features enabled or triggered during a visit.

Examples may include:

  • __cf_bm — used by Cloudflare's bot-management systems and normally expires after 30 minutes of inactivity;

  • cf_clearance — may be issued after a visitor successfully passes a Cloudflare security challenge and, by default, normally lasts approximately 30 minutes unless the challenge period has been configured differently;

  • _cfuvid — may be used by certain rate-limiting configurations to distinguish visitors sharing an IP address.

These cookies are used for security and abuse-prevention purposes rather than advertising. Cloudflare Docs

13. Cookie Choices

Where consent is required for non-essential cookies, visitors can accept or decline them through our cookie banner or cookie-preference controls.

Visitors may also change browser settings to block or delete cookies.

Blocking necessary cookies may affect the functionality or security of the website.

UK privacy rules require visitors to be given clear information about cookies and, where required, an appropriate mechanism for consenting to non-essential storage or tracking. Information Commissioner's Office

14. International Data Transfers

Some of our service providers operate internationally and personal information may therefore be processed outside the United Kingdom.

Squarespace states that information may be transferred globally, including to the United States. Its current Data Processing Addendum refers to the UK Extension to the EU-US Data Privacy Framework and, where necessary, Standard Contractual Clauses together with the UK International Data Transfer Addendum.

Cloudflare also operates a global network and may process relevant metadata outside the UK. Its current Data Processing Addendum provides for recognised transfer mechanisms including the UK-US Data Privacy Framework and contractual safeguards incorporating the UK Addendum where required.

Where restricted international transfers occur, we rely on appropriate safeguards recognised under UK data protection law.

15. How We Store and Protect Personal Information

We use appropriate technical and organisational measures to protect personal information against unauthorised access, misuse, loss, alteration or disclosure.

Depending on the type of information, measures may include:

  • access-controlled accounts;

  • password-protected systems;

  • appropriate device security;

  • restricted access to verification documents;

  • secure physical storage where paper records are necessary;

  • use of reputable service providers;

  • secure deletion when information is no longer required.

Access to identity and verification information is limited to those who reasonably require it for the purposes described in this Privacy Policy.

Identification documents are not used for advertising or unrelated marketing.

16. How Long We Keep Personal Information

We do not retain all information for the same period.

Identification and proof-of-address documents

Copies of passports, driving licences and proof-of-address documents used solely for verification will normally be securely deleted within 30 days after the relevant visit, reservation, collection, delivery or placement process has been completed.

Where an enquiry or proposed placement does not proceed, verification documents will normally be deleted within 30 days after the process is closed.

We may retain a limited record that verification was completed, such as:

  • type of document checked;

  • date checked;

  • verification outcome.

It is not normally necessary to retain the full identification document once verification has been completed.

Waiting-list and unsuccessful enquiry information

Information relating to an active waiting-list application may be retained while the application remains active.

Where an enquiry or application does not proceed, the information will normally be deleted or anonymised within 12 months of the last meaningful contact, unless there is a legitimate reason to retain it longer.

Sale, ownership and placement records

Sale Agreements, ownership records, microchip-transfer information, registration information, insurance administration and associated placement records may be retained for the lifetime of the cat and for a reasonable period afterwards where this is necessary for:

  • proof of ownership history;

  • lifetime return provisions;

  • breeder support;

  • health warranties;

  • contractual administration;

  • legal claims;

  • regulatory or accounting requirements.

Financial and accounting records

Invoices, payment records and other information required for accounting or taxation purposes will be retained for the applicable statutory retention period.

Pedigree, genetic and health records

Information concerning the cat itself, including pedigree, parentage, genetic testing, cardiac screening and other relevant health information, may be retained indefinitely where it forms part of our breeding, pedigree or health records.

Where such records contain owner information, we will retain only the personal information reasonably necessary for the continuing purpose.

References

Detailed reference information will normally be retained only during the assessment and placement process unless there is a legitimate reason for longer retention.

Website and security information

Website traffic and security information is retained according to the relevant provider's services, configuration and retention periods.

For example, Squarespace's Activity Log currently displays individual recent website visits for up to seven days. Cloudflare retention periods vary according to the particular security or analytics service and account configuration. Squarespace Help

We do not intentionally retain website traffic information ourselves indefinitely.

Fraud or security incidents

Where there is a genuine security incident, dispute or reasonable suspicion of impersonation, forged documents or unlawful activity, relevant information may be retained beyond the normal period where necessary to:

  • investigate the matter;

  • obtain professional advice;

  • protect our legal rights;

  • establish or defend a claim;

  • cooperate with competent authorities.

Such retention will be periodically reviewed and information will be deleted once there is no longer a lawful and proportionate reason to retain it.

UK GDPR requires organisations to specify retention periods or the criteria used to determine them and not keep identifiable personal information for longer than necessary. Information Commissioner's Office

17. Secure Deletion

When personal information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.

Paper documents containing personal information will be securely destroyed.

Electronic information will be deleted from active systems and will cease to exist from backups in accordance with the relevant backup and retention cycles.

18. Your Data Protection Rights

Depending on the circumstances and lawful basis relied upon, you may have rights including:

  • the right to access personal information we hold about you;

  • the right to request correction of inaccurate information;

  • the right to request erasure in certain circumstances;

  • the right to request restriction of processing;

  • the right to object to certain processing;

  • the right to data portability where applicable;

  • the right to withdraw consent where processing is based on consent.

Not every right applies to every processing activity, and some information may need to be retained where there is a legal, contractual or overriding legitimate reason to do so.

To exercise a data protection right, contact our Data Protection Officer.

ICO guidance confirms that privacy notices should explain the purposes and lawful bases for processing, recipients, retention periods, applicable rights and how individuals can complain. Information Commissioner's Office

19. Right to Object

You have the right to object to processing based on our legitimate interests in certain circumstances.

If you object, we will consider your request and whether there are compelling legitimate grounds requiring the processing to continue.

20. Complaints

If you have concerns about how IconicSX has handled your personal information, please contact our Data Protection Officer first so that we have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

Our ICO registration number is ZB734232.

21. Changes to This Privacy Policy

We may update this Privacy Policy where our practices, services, technology or legal obligations change.

The current version will always be published on this website with the date of the latest update.