Privacy policy
This Privacy Policy describes how oletoptical.shop collects, uses, shares, retains and protects personal information when customers or other visitors access our website, communicate with us or purchase products through our store.
For privacy questions, rights requests or data-protection complaints, contact:
Our handling of personal information is intended to reflect applicable United Kingdom data-protection requirements, including the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 and relevant amendments introduced by the Data (Use and Access) Act 2025. The 2025 Act amended rather than replaced the existing UK GDPR, DPA 2018 and PECR framework.
Personal Information We May Collect
Depending on how an individual interacts with our store, we may collect information including:
Identity Information
Such information may include:
- Name;
- Account username;
- Order identifier; and
- Other information reasonably necessary to identify a customer or transaction.
Contact Information
This may include:
- Email address;
- Telephone number;
- Billing information;
- Shipping information; and
- Other contact details supplied by the customer.
Order and Transaction Information
This may include:
- Products ordered;
- Product options selected;
- Order value;
- Purchase history;
- Returns;
- Refunds;
- Discounts;
- Shipping status; and
- Customer-service history.
Payment Information
Payments may be processed by Shopify Payments or other authorised payment providers.
We may receive limited information concerning the status or identification of a transaction while payment-card or financial information may be collected directly by the relevant payment processor.
Technical Information
When users access our website, technical information may be collected automatically, including:
- IP address;
- Browser information;
- Device information;
- Operating system;
- Website activity;
- Pages viewed;
- Referring URLs;
- Session information;
- Cookie identifiers; and
- Similar online identifiers.
Customer Communications
If a person contacts us, we may process the information contained in the communication and related correspondence.
How We Collect Personal Information
Information may be collected:
- Directly from customers;
- Through checkout and account functionality;
- Through cookies and similar technologies;
- From payment providers;
- From shipping or fulfilment partners;
- From fraud-prevention providers;
- Through Shopify;
- From analytics or advertising providers where legally permitted; and
- From other service providers supporting the operation of the store.
Why We Use Personal Information
We may process personal information for purposes including:
- Processing orders;
- Taking or confirming payments;
- Delivering products;
- Providing order updates;
- Managing returns and refunds;
- Responding to customer-service requests;
- Preventing fraud and misuse;
- Securing our website;
- Maintaining business records;
- Complying with legal obligations;
- Improving website functionality;
- Analysing store performance;
- Managing customer accounts;
- Sending marketing communications where legally permitted;
- Managing cookie choices; and
- Establishing, exercising or defending legal claims.
Lawful Bases
Where UK data-protection law requires a lawful basis, processing may rely on one or more appropriate bases, including:
Contract
We may process information where necessary to enter into or perform a contract with a customer, for example to process an order and arrange delivery.
Legal Obligation
We may process information where necessary to comply with legal, tax, accounting, consumer-protection or regulatory requirements.
Legitimate Interests
We may process certain information where we have a legitimate business interest and where that interest is not overridden by the individual's rights and freedoms.
Examples may include fraud prevention, network security, improving services and managing legitimate business operations.
Consent
Where required, we may rely on consent, including for certain marketing activities or non-essential storage and access technologies.
Consent can be withdrawn where the processing is based upon consent.
Cookies and Similar Technologies
Our website may use cookies, pixels, tags, local storage and similar technologies.
These technologies may support:
- Essential website functionality;
- Shopping carts;
- Secure checkout;
- Customer preferences;
- Analytics;
- Fraud prevention;
- Store performance;
- Advertising; and
- Marketing.
Under the UK's PECR regime, prior consent is generally required for storage and access technologies unless a statutory exception applies. The Data (Use and Access) Act 2025 introduced or expanded certain exceptions, including some circumstances involving statistical or service-improvement technologies.
Where consent is required, we seek to use appropriate consent controls.
Marketing Communications
Where permitted by law, we may use contact information to send information concerning products, offers or store updates.
Recipients may unsubscribe using an available unsubscribe mechanism or by contacting:
Withdrawal from marketing does not prevent us from sending necessary transactional communications concerning an existing order.
Shopify and Service Providers
Our store is operated using Shopify ecommerce technology.
We may disclose information to service providers when reasonably necessary to operate our business, including providers involved with:
- Ecommerce hosting;
- Payment processing;
- Fraud prevention;
- Order fulfilment;
- Shipping;
- Customer service;
- Analytics;
- Marketing;
- Information technology;
- Security; and
- Professional services.
These organisations may process information according to applicable contractual terms, their role under data-protection law and their own privacy obligations.
International Transfers
Some providers involved in operating an ecommerce business may process information outside the United Kingdom.
Where personal information is transferred internationally, we seek to use transfer arrangements required by applicable UK data-protection law where relevant.
Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate legal, accounting, tax, fraud-prevention, contractual and dispute-resolution requirements.
Different categories of information may therefore be retained for different periods.
When information is no longer required, we may delete, anonymise or otherwise securely dispose of it where reasonably practicable.
Information Security
We use reasonable administrative, technical and organisational safeguards intended to protect personal information against unauthorised access, misuse, loss, alteration or disclosure.
No internet transmission or electronic storage system can be guaranteed to be completely secure.
Customers are responsible for protecting passwords and access credentials associated with their accounts.
Your Data Protection Rights
Depending on the circumstances and applicable law, individuals may have rights relating to:
- Being informed about processing;
- Accessing personal information;
- Correcting inaccurate information;
- Completing incomplete information;
- Requesting erasure;
- Requesting restriction of processing;
- Objecting to certain processing;
- Data portability;
- Withdrawing consent; and
- Rights relating to certain automated decision-making.
The precise rights available can depend on the lawful basis and circumstances of the processing. The ICO identifies access, rectification, erasure, restriction, objection and portability among the rights that privacy information may need to explain.
To exercise an applicable right, contact:
We may request reasonable information necessary to verify identity before completing a request.
Data Protection Complaints
If an individual believes that we have not handled personal information in accordance with applicable data-protection law, they may make a complaint directly to us at:
Under the data-protection complaint requirements now in force, organisations must provide a method for raising complaints, acknowledge receipt within 30 days, make appropriate enquiries and investigate without undue delay, keep complainants appropriately informed, and communicate the outcome without undue delay.
We will handle qualifying data-protection complaints accordingly.
Individuals may also have the right to raise concerns with the United Kingdom Information Commissioner's Office where applicable.
Children
Our store is intended for ordinary ecommerce transactions by persons capable of entering into legally valid purchases or by persons acting with appropriate parental or guardian involvement.
We do not knowingly seek to collect unnecessary personal information from children.
Third-Party Websites
Our website may contain links to third-party websites, applications or services.
Their privacy practices are controlled by the relevant third party and are not necessarily governed by this Privacy Policy.
Users should review relevant third-party privacy information before providing personal data.
Changes to This Privacy Policy
We may update this Privacy Policy when our business practices, technology, service providers or legal requirements change.
The revised version will be published through the website with an updated revision date where appropriate.
Contact
For privacy enquiries, data-rights requests or data-protection complaints:
oletoptical.shop
Email: info@oletoptical.shop
- Choosing a selection results in a full page refresh.