This policy explains how Om & Ah London collects, uses and shares your personal information when you visit www.omandahlondon.com, place an order, contact us or receive our marketing. It also explains your choices and privacy rights.
1 Who we are
Om & Ah London is operated by the company below. It is the controller responsible for the personal information described in this policy. References to “we”, “us” and “our” mean that company trading as Om & Ah London.
Legal company name Eness LTD
Postal contact address Unit 2/14 Premier Park, Winsford, Cheshire, CW7 3PH
Privacy email hello@omandah.london
You can use these contact details for privacy questions, rights requests or complaints. You do not need to use a particular form.
2 Information we collect
Information you give us includes your name, email, phone number, billing and delivery addresses; account details; products, sizes and colours ordered; returns and refunds; messages and feedback; and marketing choices. If you provide a gift recipient’s details, we use them to deliver the order, not to add that person to marketing lists.
Payment and order information includes payment status, transaction references and limited payment-method details made available by the payment provider. Payment providers collect the payment credentials needed to process your purchase. Please do not send full card details in an email or chat.
Website and device information includes your IP address, approximate location derived from it, browser and device details, pages and products viewed, cart activity and cookie identifiers. Where permitted by your choices, we also receive information about advertising interactions and whether marketing messages were opened or links clicked.
Other sources include Shopify, payment and fraud-prevention providers, delivery partners and the marketing or analytics services used for the activities described below. They supply information such as payment results, delivery updates, security signals and permitted campaign measurements. We also receive information you choose to share with us through social media.
We need contact, delivery and payment information to accept and fulfil an order. Without the necessary details, we may be unable to do so. Marketing subscriptions and optional tracking are voluntary. Please avoid sending sensitive information that is not needed for your enquiry.
3 How and why we use your information
We use the following legal grounds under applicable data protection law. Where we rely on legitimate interests, we consider whether the use is necessary and balance our interests against your rights and reasonable expectations.
Orders and accounts. We use account, contact, order and payment information to take steps you request before a purchase, fulfil orders, manage any subscription you choose, send service updates and handle returns. Our basis is performing our contract with you.
Customer support. Order-related support uses the contract basis. For other enquiries and complaints, we rely on our legitimate interests in answering questions and resolving problems. We rely on legal obligation where a law requires a particular response or record.
Security and fraud prevention. We use transaction, device and account information to detect misuse, protect customers, secure the website and investigate suspicious activity. Our basis is our legitimate interests in preventing fraud and maintaining a safe service.
Business records and legal matters. We use relevant records to meet tax, accounting and other legal duties, relying on legal obligation. Handling or defending legal claims relies on our legitimate interests in protecting our legal rights.
Improving our products and service. We use order trends and feedback to understand demand and improve the shopping experience, relying on our legitimate interests in running and improving the business. Optional device tracking and personalised advertising rely on consent as explained below.
Marketing. We rely on consent to send marketing you subscribe to. Where the existing-customer exception described below applies, we rely on our legitimate interests in promoting our own similar products.
4 Marketing and your choices
We send marketing emails or texts when you have agreed to receive them, or where the law allows us to market our own similar products using contact details we collected directly during a sale or negotiations for a sale. For that exception, we must have offered a clear opportunity to opt out when collecting the details and in every subsequent message. We do not treat a purchase or acceptance of this policy as blanket marketing consent.
Marketing may include product news, offers and reminders about items left in your basket. Basket reminders containing promotional content follow the same marketing rules. Where permitted, we use purchase history and engagement to make messages more relevant.
You can stop direct marketing at any time. Use the unsubscribe link in an email, the opt-out instructions in a text, or contact us. Your objection also covers profiling for direct marketing. We will stop using your information for those purposes.
Unsubscribing does not stop essential order, delivery or account messages. We keep a limited record of your opt-out so that we can respect it. Withdrawing consent does not affect the lawfulness of earlier use.
5 Cookies and advertising
We use cookies and similar technologies, such as pixels and local storage, to operate the website. Essential technologies support functions such as the basket, checkout, security and remembering privacy choices.
We ask for consent before using optional analytics, advertising or personalisation technologies. With your permission, these can help us understand visits, measure campaigns and show relevant advertising on other websites or social platforms. Advertising partners may receive device identifiers, pages viewed, product and purchase events and other information described in the consent notice. They may combine this with information they already hold.
Where email tracking pixels or similar technologies are used, we obtain any consent required for that tracking. Agreeing to receive marketing does not automatically mean agreeing to every form of tracking.
You can accept or reject optional cookies and change or withdraw your choices through our cookie controls. Rejecting optional cookies does not prevent you from placing an order. Browser settings can also manage cookies, although blocking essential cookies may affect shopping features.
Cookie details and controls [INSERT LINK TO COOKIE SETTINGS AND CURRENT COOKIE INFORMATION]
The cookie information explains the technologies in use, their providers, purposes and lifetimes. Visiting the website or continuing to browse does not by itself give consent to optional tracking.
6 Who we share information with
We share relevant information with organisations needed to run the store and deliver your purchases, including:
Shopify, which hosts our store and processes information to provide the ecommerce platform, checkout and related services. Shopify also processes information for its own purposes in circumstances explained in its privacy policy, including when you use its consumer services.
Shopify’s consumer privacy policy: https://www.shopify.com/legal/privacy/consumers
Payment providers, which process transactions, refunds and payment security checks. If you choose a credit or instalment service offered at checkout, that provider may use your information to assess eligibility under its own privacy notice.
Production, fulfilment and delivery partners, which receive the order and contact details needed to print or supply products, pick and pack orders, arrange delivery, process returns and handle customs where relevant.
Technology and communications suppliers, which support hosting, customer service, email or text delivery, reviews, analytics and advertising, where relevant and subject to the choices described in this policy.
Professional advisers, insurers and public authorities, where needed for advice, legal claims, regulatory duties or lawful requests. If our business is sold or reorganised, relevant information may be disclosed to advisers and prospective or new owners, subject to appropriate confidentiality and data protection safeguards.
Providers acting on our instructions must protect the information and use it for the agreed services. Some recipients, including certain payment providers, act as independent controllers and explain their own uses in their privacy notices.
7 International transfers
Our suppliers may process personal information outside the UK, including in countries where their operations and support teams are based. If your information is transferred internationally, we use a lawful transfer arrangement where required.
This may be an applicable UK adequacy regulation or, where needed, contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses. We assess the protection provided and use additional measures where necessary. Where EU data protection law applies, we use the corresponding EU transfer arrangements.
Contact us using the details in section 1 to ask about the destinations and safeguards relevant to your information, or to request a copy of applicable safeguards, with any confidential or unrelated information removed.
8 How long we keep information
We keep personal information only for as long as needed for the purpose for which we hold it. We decide the period by considering the type of record, our relationship with you, legal recordkeeping duties, the time available for legal claims and any ongoing dispute.
Order, payment and accounting records are kept for the applicable tax and accounting periods and any further period necessary to handle a live claim or investigation. Closing an account does not automatically erase records we must retain.
Account and customer service information is kept while needed to provide the account or resolve the issue, and afterwards only where justified by repeat enquiries, complaints, security needs or potential claims.
Marketing information is kept while we have a valid basis to contact you and the information remains relevant. We review inactive contacts. Limited consent and opt-out records may be retained to demonstrate compliance and prevent unwanted marketing.
Cookie, analytics and security information is retained for the lifetimes stated in the cookie information or for the period needed to measure the relevant activity or investigate security incidents. We delete or anonymise information when it is no longer required.
9 Security
We use appropriate technical and organisational measures to protect personal information and limit access to people and providers who need it for their work. No online service is completely secure. Please protect your account credentials and contact us promptly if you suspect unauthorised use.
10 Personalisation and automated decisions
Where permitted by your choices, purchase history, browsing and engagement may be used to suggest products or tailor marketing. You can object to direct-marketing profiling at any time.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Payment or credit providers may make their own automated decisions, including eligibility or fraud checks. Their privacy notices explain those decisions and the available rights. Contact us if you need help with an order affected by a payment or security decision.
11 Your privacy rights
Depending on the applicable law, the reason we use your information and the circumstances, you may have the right to:
Your right to object. You can object to processing based on legitimate interests for reasons connected with your situation. We will stop unless we have overriding compelling grounds or need the information for legal claims. Your right to stop direct marketing, including related profiling, is absolute.
To exercise a right, contact us using section 1. We normally respond within one month and do not usually charge a fee. We may need proportionate information to verify identity or clarify a request. If a lawful extension or other timing rule applies, we will explain it. If we cannot meet a request in full, we will explain why and how to challenge our response.
12 Questions and complaints
If you are concerned about how we handle your personal information, email or write to us using section 1. Please describe the concern and how we can contact you. We will acknowledge a data protection complaint within 30 days, investigate it, keep you informed and communicate the outcome without undue delay.
You also have the right to complain to the UK Information Commissioner’s Office. You do not have to waive that right or obtain our permission to use it.
ICO complaints: https://ico.org.uk/make-a-complaint/
If EU data protection law applies, you may also complain to the relevant supervisory authority, including where you live, work or believe an infringement occurred.
13 Children and other websites
Our store is intended for a general adult shopping audience. We do not knowingly collect children’s personal information for marketing. If you believe a child has provided personal information inappropriately, contact us so that we can review and address it.
Links to third-party websites and services are governed by those organisations’ own privacy notices. This does not remove our responsibility for information that we collect or share.
14 Changes to this policy
We may update this policy to reflect changes in the store, our practices or the law. We will update the date above and bring significant changes to your attention where required. If a new use requires your consent, we will ask for it before that use begins.