Privacy notice

1. Who we are

Ozyrix Limited, a company registered in England and Wales (company number 16666851). Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the controller of the personal data described here: we decide how it is used.

For anything about your data, email privacy@ozyrix.com.

2. What we collect

From you, when you use the site or contact us:

Account details: your name, email address and sign-in details, if you create an account.
Order details: your name, delivery and billing address, email address, phone number if you give one, what you ordered, and any returns and refunds.
Payment details: Card payments are processed by Stripe, our only payment provider. We store only Stripe's transaction reference for your order — never your card details.
Messages and reviews: what you send us through the contact form, by email or through a marketplace, our replies, and reviews you submit.
Newsletter: your email address, if you sign up.
Technical data: your IP address, browser and device type, and which pages are visited and how the site performs, counted without any identifier for you.

From others: order and delivery details from a marketplace when you buy our products there, and payment and delivery status from our payment provider and carriers.

This site is not intended for children, and we do not knowingly collect their data.

3. How we use it, and our lawful basis

To take, deliver and support your order, including returns, refunds and messages about it. Basis: our contract with you.
To keep tax and accounting records, and to meet other legal duties, such as product safety and requests from authorities. Basis: legal obligation.
To answer other messages, prevent fraud and misuse (including of our returns process), keep the site secure, improve our products, site and service, and establish or defend legal claims. Basis: our legitimate interests in running and protecting our business.
To measure how the site is used, in counts that carry no identifier for you. Basis: our legitimate interest in knowing which pages work. You can turn this off (section 8).
To send the newsletter. Basis: your consent, which you can withdraw at any time.

We use automated tools, including AI, to help answer messages and handle orders. We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you. If you think we have, you can ask for a person to review it.

4. Who we share it with

We do not sell your personal data. We share it only with:

Stripe, which processes payments and refunds.
Amazon (Multi-Channel Fulfilment), which stores our stock and delivers orders: it receives your name, delivery address and what you ordered.
Our sourcing partners and carriers, which ship some items and deliver parcels: they receive the same delivery details.
Sylphx, which hosts this site and provides sign-in and email, and Cloudflare, which delivers and protects the site.
AI service providers that power the tools that help us answer messages and handle orders.
Marketplaces such as Amazon, eBay and TikTok Shop, when you buy from us there. Each marketplace is a separate controller of the data you give it; its own privacy notice applies to its copy.
Professional advisers, authorities and courts, when the law requires it or to protect our legal rights, and a buyer of our business or its assets, if that happens.

Data protection law requires us and our service providers to protect your personal data. Email privacy@ozyrix.com if you want details about a provider that handles it.

5. Transfers outside the UK

Some of these providers handle data outside the UK, for example in the European Economic Area, the United States or, for items shipped directly from a supplier, China. UK law requires an appropriate basis for a restricted transfer, such as an adequacy decision or approved contractual safeguards. Email privacy@ozyrix.com to ask which providers receive your data, where they handle it and what transfer basis applies.

6. How long we keep it

Orders, delivery addresses, invoices and refunds: 6 years after the end of the financial year the order falls in (our financial year ends in August), as tax law requires. After that your name, email, phone and address are removed from them.
Messages with us that are not about an order: 730 days after the last message. Messages about an order are kept with the order.
Newsletter: until you unsubscribe, then 30 days. A signup that is never confirmed is deleted after 30 days.
Payment, email and processing logs: 90 days, after which the personal details in them are cleared.
Reviews you publish: while they are published.
Analytics: only in aggregated form that no longer identifies you.

We may keep data for longer where we need it to deal with a claim or a legal requirement.

7. Newsletter

We send the newsletter only if you sign up for it. Every email has an unsubscribe link, and unsubscribing takes effect straight away. You can also email privacy@ozyrix.com. If you ask to be told when a product is back in stock, we use your address to send you that one message about that product. That request is not a newsletter sign-up: you join our marketing emails only if you tick the separate box offered beside it. We keep a back-in-stock request for 30 days after you make it, then delete it.

8. Cookies and usage statistics

We store only what the site needs to work: your basket (in your browser), and the sign-in and security cookies. We use no advertising or tracking cookies.

Usage statistics (which pages are visited and how fast they load) are counted without cookies and without any identifier for you, so we do not ask for cookie consent. They are off if your browser sends Global Privacy Control, and you can turn them off here. That choice is the one thing we store for them, so we can honour it.

9. Security

We protect personal data with technical and organisational measures suited to the risk, and our providers must do the same. No way of sending or storing data is completely secure, so we cannot promise that data will never be accessed without permission. If a breach puts your rights at high risk, we tell you as the law requires.

10. Your rights

Under UK data protection law you have the right to:

ask for a copy of your personal data;
have inaccurate data corrected;
have your data deleted, or its use restricted, in some circumstances;
object to our use of your data based on legitimate interests;
receive the data you gave us in a portable format;
withdraw consent at any time, where we rely on consent;
not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you.

With an account: download or delete your data (you will be asked to sign in).
Bought as a guest: send a privacy request or email privacy@ozyrix.com from the address you ordered with.

Some rights apply only in certain circumstances. To use them, email privacy@ozyrix.com from the address you used with us, or tell us how else we can confirm it is you. We answer within 1 month, or up to 2 months more for complex or repeated requests, in which case we tell you within the first month and explain why. There is normally no charge, but we may charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive.

When we delete your data, we keep the order records tax law requires, with your name, email, phone and address removed. This removes the data held by this shop; your Sylphx sign-in account is separate.

11. Complaints

Please tell us first if you are unhappy with how we handle your data, at privacy@ozyrix.com. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

12. Changes to this notice

We may update this notice at any time by publishing a new version here. Where the law requires, we will also tell you directly.

In short