Privacy policy

Privacy policy

Last updated 7 October 2026

If you have a privacy question, email privacy@ourooh.co.uk. A short note is enough. I will reply within one month, which is the time the law allows, and usually much sooner.

At a glance

  • I collect the information needed to run the shop, send your order, handle returns, reply to you, and keep proper records.
  • This usually includes your name, email address, delivery address, billing details, order details, and messages you send.
  • Payments are handled securely by payment providers. I do not see or store your full card details.
  • Ourooh is powered by Shopify, so Shopify also processes personal information when you use the website or checkout.
  • For orders sent outside the UK, the details customs need are shared with Royal Mail, overseas postal services, and customs authorities.
  • Cookies and similar tools keep the website working, and where you agree, support analytics and marketing.
  • You can ask to access, correct, delete, or restrict the use of your personal information, where the law gives you that right.
  • I do not sell personal information.

Who I am

Ourooh is an online shop based in Edinburgh. The correspondence address is Office 380, 18 Young Street, Edinburgh, EH2 4JB.

Ourooh is the data controller for the personal information collected and used for the shop's own purposes, and is registered with the Information Commissioner's Office under registration number C1904139.

What I collect

This depends on how you use the shop. It may include:

  • Contact details, such as your name, email address, phone number, delivery address, and billing address.
  • Order details, such as what you bought, the date of your order, delivery method, return requests, return labels, refunds, and customer notes. For orders sent outside the UK, this also includes the customs details that travel with the parcel, such as its contents and value.
  • Payment information, such as payment method, payment confirmation, and transaction details. Full card details are handled by payment providers and are not stored by Ourooh.
  • Messages, such as emails, contact form messages, WhatsApp messages, gift note requests, and replies from me.
  • Account information, if you choose to create or use a customer account, including returns you start from your account.
  • Technical information, such as IP address, device, browser, cookies, pages viewed, and how the website is used.
  • Marketing preferences, such as whether you have signed up to receive emails, and whether you have unsubscribed.

How I collect it

In three main ways:

  • From you, when you place an order, contact me, create an account, add a gift note, start a return, or sign up to receive emails.
  • Automatically, when you visit the website, use checkout, or interact with cookies and similar technologies.
  • From service providers, such as Shopify, payment providers, delivery services, analytics tools, and email services used to run the shop.

How I use it

To run Ourooh properly. This includes:

  • processing orders and payments;
  • packing and sending orders;
  • preparing customs declarations for orders sent outside the UK;
  • sending order confirmations, dispatch emails, and service messages;
  • handling returns, including issuing prepaid return labels;
  • replying to questions, damage reports, and other customer messages;
  • handling refunds, replacements, and complaints;
  • keeping business, tax, accounting, and legal records;
  • protecting the shop from fraud, misuse, and security issues;
  • understanding how the website is used and improving it;
  • sending marketing emails if you have chosen to receive them.

Why I am allowed to use it

Under UK data protection law, and for customers in the European Union under the EU General Data Protection Regulation, there has to be a lawful basis for each use of your information. Mine are:

  • Contract. Taking and processing your order, sending it, and handling returns and refunds.
  • Legal obligation. Keeping tax, accounting, and business records, meeting consumer law duties, and giving customs authorities the information they require for orders sent abroad.
  • Legitimate interests. Replying to your messages, preventing fraud, keeping the shop secure, and understanding how the website is used so it can be improved. These are balanced against your rights, and you can object.
  • Consent. Marketing emails and non-essential cookies. You can withdraw consent at any time.

Marketing emails

If you sign up to hear from Ourooh, you may receive emails about new objects, shop updates, and other news.

You can unsubscribe at any time using the link in the email. If you unsubscribe, you may still receive service emails about orders you have placed, returns, refunds, or other necessary shop matters.

Cookies and similar tools

Some cookies are needed to make the website work, such as remembering what is in your bag. Others help me understand how the shop is used, or support marketing, and those are only set where you agree.

You can manage your choices through the cookie banner or privacy settings on the website, and through your browser settings.

Shopify

Ourooh is powered by Shopify. Shopify provides the website, checkout, payments support, security, analytics, and other services that help the shop run.

When you visit the shop or use checkout, personal information may be shared with Shopify and processed by Shopify. Some information may be transferred to countries outside the UK or the country where you live.

To learn more, read the Shopify Consumer Privacy Policy. You can also use the Shopify Privacy Portal to learn more about privacy choices connected to Shopify.

Who I share information with

Only where it is needed to run the shop, provide the service, meet legal duties, or protect the business. This may include:

  • Shopify and services connected to Shopify;
  • payment providers and fraud prevention services;
  • delivery and postal services, such as Royal Mail, including for prepaid return labels;
  • for orders sent outside the UK, overseas postal services and customs authorities, which receive the details needed to clear and deliver your parcel, such as your name, address, contact details, and the contents and value of your order;
  • email, marketing, analytics, and customer service tools;
  • review tools that invite you to leave feedback after an order, such as Judge.me;
  • professional advisers, such as accountants or legal advisers where needed;
  • public authorities, regulators, or law enforcement where required by law.

I do not sell customer lists or personal information.

How long I keep information

Only for as long as it is needed for the reason it was collected, including to complete orders, handle returns, answer questions, keep business records, meet tax or legal duties, prevent fraud, and resolve disputes.

Order, payment, and tax records are kept for at least six years, as accounting and tax rules require. Marketing preferences are kept until you unsubscribe or ask for them to be removed, though a record may be kept in order to respect your choice.

Security

I take reasonable care with personal information and use trusted services to run the shop. No website, email system, or online service can be completely secure, so please avoid sending sensitive personal information by email or message unless it is necessary.

Your rights

Depending on where you live and the circumstances, you may have the right to:

  • ask for a copy of the personal information held about you;
  • ask for information that is wrong or incomplete to be corrected;
  • ask for personal information to be deleted, where the law allows;
  • ask for certain uses of your personal information to be restricted or stopped;
  • object to certain processing, including some marketing uses;
  • withdraw consent, where consent is the basis for use;
  • ask for your information in a portable format, where this applies.

These rights are not always absolute. Some information has to be kept for legal, tax, accounting, fraud prevention, or order record reasons.

How to make a privacy request

Email privacy@ourooh.co.uk and say what you need. I may need to check your identity first, and I will reply within one month.

If your request relates to information processed by Shopify for Shopify's own purposes, you can also use the Shopify Privacy Portal.

Third party links

The website may link to other websites, platforms, or social media pages. Their privacy practices are their own, so please read their privacy information if you follow those links.

Children

The shop is not intended for children, and personal information is not knowingly collected from children.

International transfers

Some of the services used to run the shop, including Shopify, may process personal information outside the UK or the country where you live. Orders delivered to the European Union also mean that some information passes between the UK and the EU so the parcel can clear customs and reach you.

Where required, appropriate safeguards or recognised transfer mechanisms are relied on for international transfers of personal information.

Complaints

If you are unhappy with how your personal information has been handled, please email me first and I will try to put it right.

You also have the right to complain to the Information Commissioner's Office, at ico.org.uk/make-a-complaint/. If you live in the European Union, you can also complain to the data protection authority in the country where you live.

Changes to this policy

This policy may be updated from time to time, including when services, tools, legal duties, or privacy practices change. The latest version is posted on this page with the updated date.

Contact

For privacy questions or requests, email privacy@ourooh.co.uk. For anything else, email hello@ourooh.co.uk.

Ourooh, Office 380, 18 Young Street, Edinburgh, EH2 4JB.

ICO registration number: C1904139.