Legal
Privacy Policy
Last updated: 26 September 2026
This policy explains how we collect and use your personal information when you visit ovelunne.shop, place an order or contact us, and the choices and rights you have.
Who is responsible for your data
The data controller is SOUTH CENTRAL CLOTHING LIMITED, trading as OVELUNNE, a company registered in England and Wales. Our company details are on our Legal Information page. For any privacy question or request, email support@ovelunne.shop.
Information we collect
- Contact and delivery details: name, email address, billing and delivery address, and phone number if you give it.
- Order details: items bought, prices, currency, shipping method, order and return history.
- Payment information: payments are processed by Stripe and PayPal. We receive limited details such as the payment method type, card brand, last four digits and payment status. We never receive or store full card numbers.
- Account details: if you create an account, your login email and password (stored in encrypted form).
- Messages: what you send us by email, phone or our contact form.
- Technical information: IP address, browser and device type, and pages requested, recorded in server logs for security, and the cookies described in our Cookie Policy.
How we use it and our legal bases
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Processing and delivering your order, handling returns and refunds | Performance of a contract |
| Answering your questions and providing customer service | Performance of a contract / legitimate interests |
| Preventing fraud and keeping our website secure | Legitimate interests |
| Keeping accounting and tax records | Legal obligation |
| Remembering your bag, language and currency | Legitimate interests (strictly necessary cookies) |
We do not send marketing emails, and we do not use advertising or analytics tracking on this website. If that changes, we will ask for your consent first where the law requires it.
Who we share it with
We share personal information only with service providers who help us run the shop, under contracts that require them to protect it:
- Payment providers: Stripe and PayPal, to process payments and prevent fraud. They act as independent controllers for some processing under their own privacy notices.
- Delivery carriers: name, address, phone number and parcel details needed to deliver your order.
- Hosting and email providers: our website host (Hostinger) and email service, which store data on our behalf.
- Professional advisers and authorities: accountants, legal advisers, or public authorities where we are required by law.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
International transfers
Some of our providers process data outside the UK and European Economic Area, for example in the United States. Where this happens we rely on adequacy decisions or on appropriate safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
How long we keep it
- Order and payment records: 6 years after the end of the financial year, as required by UK tax law.
- Customer account: until you ask us to delete it, or after 3 years without activity.
- Customer service messages: up to 2 years after the matter is closed.
- Server logs: up to 90 days.
Your rights
If you are in the UK or the EU, you have the right to access your personal data, correct it, ask us to delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent where we rely on it. You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk), or the authority in your EU country. We would appreciate the chance to help first.
California and other US states: you have the right to know what personal information we collect and how we use it, to request deletion or correction, and not to be discriminated against for exercising these rights. We do not sell or share personal information as defined by the California Consumer Privacy Act.
To make a request, email support@ovelunne.shop. We respond within one month (or 45 days where US law applies) and may need to verify your identity.
Security
Our website uses HTTPS encryption throughout. Payments are handled by PCI DSS compliant payment providers, and access to order data is limited to people who need it to serve you.
Children
Our shop is not directed at children under 16, and we do not knowingly collect their personal information.
Changes to this policy
We may update this policy. The date at the top shows when it was last changed. Significant changes will be highlighted on this page.