1. Introduction
Obong (“we”, “us”) is the data controller for personal information collected through this website. This policy explains what we collect, why, and the rights you have under the UK GDPR and Data Protection Act 2018.
2. What we collect
- Order & account data — name, email, delivery address, phone, order history.
- Payment data — handled entirely by Stripe and PayPal. We never see or store your full card details.
- Device & usage data — pages viewed, referring pages, approximate location, device type (via analytics, only with your consent).
- Communications data — messages you send via the contact form, chatbot or email.
3. Why we use it (legal bases)
- Contract — to process orders, payments, deliveries and returns.
- Legal obligation — tax and accounting records (kept for 6 years).
- Legitimate interests — fraud prevention, site security, service improvement.
- Consent — analytics cookies and marketing emails. You can withdraw consent at any time.
4. Cookies
We use cookies to run the shop (cart, checkout) and, with your consent, for analytics. Full details are in our Cookie Policy. You can change your cookie choices at any time from the consent banner.
5. Who we share data with
We share only what is necessary with: payment processors (Stripe, PayPal), delivery carriers, our email platform, our analytics provider, and our hosting/support providers. We never sell your personal data.
6. International transfers
Some providers process data outside the UK/EU. We only use providers that offer appropriate safeguards such as UK adequacy regulations or Standard Contractual Clauses.
7. How long we keep it
Order and accounting records: 6 years (legal requirement). Account data: while your account is active. Analytics data: up to 26 months. Chat and contact messages: up to 24 months.
8. Your rights
You have the right to: access your data, rectify it, erase it (“right to be forgotten”), restrict or object to processing, portability, and to withdraw consent at any time. To exercise any right, email support@obong.co.uk. You can also complain to the Information Commissioner’s Office (ico.org.uk).
9. Security
The site is served over HTTPS; payments are tokenised by our processors; access to customer data is restricted to team members who need it.
10. Children
The shop is not directed at children under 16, and we do not knowingly collect their data.
11. Changes
We may update this policy; the “last updated” date above will always reflect the current version.