Privacy Policy
Last updated 15 September 2026.
This Privacy Policy explains how personal data is handled when you use the Olleco online store, place an order, contact us or manage your marketing and cookie choices. It supplements the wider Olleco privacy notice that applies to our other websites and services.
Controller and contact details
| Data controller | Olleco |
|---|---|
| Registered address | Northampton Road, Blisworth, Northamptonshire, NN7 3DR |
| Privacy contact / DPO | Chief Financial Officer |
| enquiries@olleco.co.uk |
Personal data we collect
- Identity and contact data, such as name, business name, email address, telephone number and delivery address.
- Order and transaction data, such as products, quantities, prices, payment status, delivery details, returns, refunds and communications about an order.
- Technical and usage data, such as IP address, device, browser, pages viewed, referring source, cookie identifiers and interaction data.
- Marketing and preference data, such as whether you have opted in, opted out or changed cookie or communication choices.
- Enquiry and correspondence data supplied when you contact us.
Card payments are processed by our payment provider, Cardstream. We do not store full card details. Address lookup at checkout is provided by Google Places, which receives the search text needed to return suggested addresses. Your order details are passed to our order management system so we can fulfil and deliver your order.
Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Process, fulfil and deliver orders; manage returns and refunds | Performance of a contract; steps requested before entering a contract. |
| Create and administer customer records | Performance of a contract; legitimate interests in administering customer relationships and maintaining accurate business records. |
| Process payments and prevent fraud | Performance of a contract; legitimate interests in securing transactions and preventing fraud; legal obligations where applicable. |
| Respond to enquiries, complaints and rights requests | Performance of a contract where relevant; legitimate interests in customer service and dispute management; legal obligations. |
| Operate, secure and improve the site | Legitimate interests in running a secure, effective ecommerce service. Consent where required for non-essential cookies or similar technologies. |
| Measure campaigns and website activity | Consent for analytics or marketing cookies where required. Legitimate interests may apply only where permitted and appropriately assessed. |
| Send marketing communications | Consent where required. The existing-customer “soft opt-in” may be used only where its legal conditions are met. You can opt out at any time. |
| Keep records and comply with law | Legal obligations and legitimate interests in establishing, exercising or defending legal claims. |
Who receives personal data
We share personal data only where necessary and subject to appropriate safeguards. Recipients may include:
- Olleco group companies that support customer service, order management, delivery, finance, IT, marketing or compliance.
- Our payment provider, Cardstream.
- Delivery, logistics, order-management, hosting, security and IT support providers.
- Google, for address lookup at checkout and, where you have accepted analytics cookies, Google Analytics.
- WhatConverts, for marketing attribution, only where you have accepted analytics cookies.
- Professional advisers, insurers, auditors, regulators, law-enforcement bodies or courts where required or appropriate.
- A buyer, seller or adviser involved in a potential business reorganisation, subject to confidentiality and data-protection requirements.
We do not sell personal data.
International transfers
Some service providers may process personal data outside the UK. Google and WhatConverts are based in the United States. Where a transfer is not covered by UK adequacy regulations, we use an approved safeguard, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism, and apply supplementary protections where required. You may contact the privacy contact for more information about the relevant safeguards.
Data retention
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, regulatory, fraud-prevention and dispute requirements.
| Record type | Retention period |
|---|---|
| Customer records | While the customer relationship is active, then 6 years after the last activity. |
| Order, payment and transaction records | 7 years from the end of the financial year, taking account of tax, accounting, contract and legal-claims requirements. |
| Customer service, complaint and return records | 3 years after closure of the matter, or longer where needed for a legal claim. |
| Marketing consent and suppression records | Consent evidence while marketing continues; suppression records remain as necessary to respect opt-out choices. |
| Website analytics and cookie identifiers | As shown in the cookie policy and provider settings. |
| Rights-request records | 3 years after completion of the request. |
Marketing choices
We will send electronic marketing only where we have a lawful basis to do so. Where consent is required, marketing options are separate, clear and unticked by default. We may market similar products to existing customers under the soft opt-in only where the legal conditions are satisfied and an opt-out was offered when details were collected and in every message. You can unsubscribe using the link in a marketing email or by contacting the privacy contact. Service messages about orders are not marketing.
Your data-protection rights
Depending on the circumstances, you may have the right to request access, correction, erasure, restriction, portability or objection, and to withdraw consent at any time. You may also have rights in relation to automated decision-making. Some rights are subject to legal conditions and exemptions. Contact the privacy contact at enquiries@olleco.co.uk to exercise a right. We may need information to verify identity and will respond within the period required by data-protection law, normally one month.
You can complain to the UK Information Commissioner’s Office at ico.org.uk. We would welcome the opportunity to address the concern first, but this does not affect your right to contact the regulator.
Security, links and children
We use appropriate technical and organisational measures designed to protect personal data. No internet transmission or storage method is completely secure. The store may link to third-party websites whose privacy practices we do not control, so you should review their notices. The online store is intended for business and adult customers and is not designed to collect personal data from children.
Cookies and updates
Cookie use is explained in our cookie policy and in the cookie settings tool linked from the footer of every page. We may update this Privacy Policy when our practices, providers or legal requirements change, and will revise the date at the top when we do.