PRIVACY POLICY

Last updated: May 2025

1. Who We Are

Under Control by OB is the data controller for the personal information collected through this website. If you have any questions about how we handle your data, please contact us through our Contact page.

2. What Data We Collect

When you use our website or place an order, we may collect the following information:

• Personal details — name, email address, phone number
• Delivery information — shipping address and billing address
• Payment information — processed securely by our payment provider; we do not store full card details
• Order history — products purchased, order value, and dates
• Communications — emails or messages you send us
• Website usage data — pages visited, time spent, browser and device type via cookies

3. How We Use Your Data

We use your personal information to:

• Process and fulfil your orders
• Send order confirmation and shipping notifications
• Respond to your enquiries and provide customer support
• Send marketing emails — only if you have opted in; you can unsubscribe at any time
• Improve our website and product offering
• Comply with our legal obligations

4. Legal Basis for Processing

Under UK GDPR, we process your data on the following legal bases: contract (to fulfil your order), legitimate interests (to improve our service and prevent fraud), and consent (for marketing communications).

5. Cookies

Our website uses cookies to improve your browsing experience. These include essential cookies (required for the site to function), analytics cookies (to understand how visitors use our site), and marketing cookies (to show you relevant content). You can manage your cookie preferences through your browser settings.

6. Sharing Your Data

We do not sell your personal information to third parties. We may share your data with:

• Payment processors — to handle transactions securely
• Delivery partners — to fulfil and track your order
• Email service providers — to send order and marketing emails
• Analytics providers — to understand website performance (data is anonymised)

All third-party providers are required to handle your data in accordance with UK GDPR.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy. Order data is retained for 7 years for accounting and legal compliance. You may request deletion of your data at any time, subject to our legal obligations.

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict how we process your data
• Data portability — receive your data in a structured format
• Withdraw consent at any time for marketing communications

To exercise any of these rights, please contact us through our Contact page. We will respond within 30 days.

9. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, disclosure, or loss. All payments are processed over encrypted connections (SSL/TLS).

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this page periodically.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us via our Contact page. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.