Privacy policy

This Privacy Policy explains how personal data is collected, used, and protected in connection with the website odelloo.com and the purchase of products through it. It is published in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data controller

The data controller is CSJO Ltd, registered office Barkat House, Suite 9, 116-118 Finchley Road, London NW3 5HT, England, Companies House registration number 13189175.

2. ICO registration

Registration with the UK Information Commissioner's Office (ICO) is pending. This Privacy Policy will be updated with the ICO registration number once it has been issued.

3. Categories of personal data collected

CSJO Ltd may collect and process the following categories of personal data: identifiers such as name and account login details; contact information such as postal address, email address, and telephone number; order data such as items purchased, order value, delivery address, and order history; payment data processed through the Website's payment provider (CSJO Ltd does not store full payment card details); and browsing data such as IP address, device type, browser, referring URL, and pages visited.

4. Purposes of processing

Personal data is processed for the following purposes: to perform the contract for the supply of goods, including order processing, payment, dispatch, customer service, and returns; to send marketing communications where the customer has provided consent; to comply with legal and regulatory obligations, including tax and accounting requirements; to prevent and detect fraud; and to analyse Website usage in order to maintain and improve the Website.

5. Legal bases for processing

The processing of personal data is carried out on the following legal bases under Article 6 of the UK GDPR: Article 6(1)(b), performance of a contract, for order processing and related customer service; Article 6(1)(a), consent, for marketing communications and non-essential cookies; Article 6(1)(c), compliance with a legal obligation, for tax, accounting, and other statutory records; and Article 6(1)(f), legitimate interests, for fraud prevention, network security, and Website analytics, where those interests are not overridden by the customer's rights and freedoms.

6. Recipients of personal data

Personal data may be shared with the following categories of recipient, each of which acts as a processor or independent controller as appropriate: Shopify Inc., as the e-commerce platform provider hosting the Website; payment processors that handle card transactions on behalf of CSJO Ltd; postal and courier carriers responsible for delivery; IT and hosting providers supporting the Website; professional advisers, such as accountants and legal counsel; and competent authorities and regulators, where disclosure is required by law.

7. International transfers

Where personal data is transferred outside the United Kingdom, CSJO Ltd relies on appropriate safeguards under the UK GDPR. Transfers between the United Kingdom and the European Economic Area are protected by the mutual adequacy decisions in force between the UK and the EU. Transfers to other jurisdictions are protected by Standard Contractual Clauses or other lawful transfer mechanisms.

8. Retention periods

Order and transaction records are retained for 7 years from the end of the relevant financial year, to comply with UK tax and accounting requirements. Marketing data is retained for as long as the customer's consent remains in place and is deleted or anonymised promptly after consent is withdrawn. Browsing and analytics data is retained for up to 14 months. Customer service correspondence is retained for the period necessary to resolve the matter and to comply with applicable limitation periods.

9. Data subject rights

Subject to the conditions set out in the UK GDPR, data subjects have the right of access to their personal data; the right to rectification of inaccurate data; the right to erasure; the right to data portability; the right to restriction of processing; the right to object to processing, including direct marketing; and the right to lodge a complaint with the UK Information Commissioner's Office, whose website is available at https://ico.org.uk.

10. Exercising your rights

To exercise any of the rights described in section 9, please email Support@odelloo.com or write to CSJO Ltd at Barkat House, Suite 9, 116-118 Finchley Road, London NW3 5HT, England. CSJO Ltd will respond within one month of receipt of the request, in line with the timescales set out in the UK GDPR.

11. Cookies

The Website uses cookies and similar technologies for functionality, analytics, and (where consent has been given) marketing. Detailed information on the cookies used and the choices available is set out in the Cookie Policy.

12. Updates to this Privacy Policy

This Privacy Policy may be updated from time to time. The most recent version will be published on the Website with an effective date. Material changes will be communicated through the Website or by direct notice where appropriate.

13. Last updated

This Privacy Policy was last updated on 15 May 2026.