Privacy policy

Last updated 27 October 2026

We only collect what we need to sell you odd things and look after you, and we never sell your data. This policy explains what we collect, why, and your rights under the UK GDPR and the Data Protection Act 2018.

Who we are

The data controller is Oddvana. For anything about your data, email hello@oddvana.com.

What we collect

Order details: your name, email, delivery address, phone (if given), what you bought, any gift note and how you paid. Card numbers go straight to our payment providers. We never see or store them.
Account and Club details: your email, first name, birthday (if you give it) and Odd Points balance.
Messages: anything you send us, such as return requests and reviews.
Browsing on our site: basic, anonymous counts of which products are viewed and added to baskets, to show bestsellers and improve the shop. These aren't linked to your name. Your basket is kept in your own browser.
Technical data: your IP address and browser details, held briefly by our host for security and to stop fraud.

Why we use it (and our lawful basis)

To take payment, send your order, handle returns and keep you updated (contract).
To keep records for tax and accounting (legal obligation).
To prevent fraud, keep the site secure, and improve the shop using anonymous counts (legitimate interests).
To send you a reminder if you leave something in your basket at checkout, or ask for a review after your order arrives (legitimate interests; every email has an unsubscribe link).
To send marketing emails and show you relevant ads, only if you've said yes (consent, see below).

Marketing emails and ads

We'll only send you marketing emails (new finds, offers, live show alerts) if you've ticked the box or joined the Club. You can unsubscribe at any time with the link in every email, or by emailing us.

If you've agreed to marketing, we may also share a scrambled (hashed) version of your email address with Google and Meta (Facebook and Instagram) so they can show you, or people like you, Oddvana ads, and so we don't show you ads for things you've already bought. They match it to their own users and don't receive it in readable form. If you unsubscribe, we stop sharing it and remove you from these lists the next time they update. You can also manage ad settings in your Google and Meta accounts.

We share data only with companies that help us run the shop, under contracts that protect it:

The UK warehouses that send your items: your name, delivery address and what to send.
Couriers: your name, address and sometimes email or phone for delivery updates.
Payment providers: Stripe, PayPal, Mollie, Klarna and Clearpay, to take payment and prevent fraud. Klarna and Clearpay may run their own checks if you choose them.
Cloudflare: hosts our website and stores our data.
Resend: sends our emails.
Google and Meta: only for customers who have agreed to marketing, as above.
Our accountants, professional advisers, and the police or regulators if the law requires it.

How long we keep it

We keep order records for 6 years after your order, as tax law requires. Club and marketing details are kept until you unsubscribe or ask us to delete them. If you haven't ordered or opened an email from us in 3 years, we'll remove your marketing details. Anonymous browsing counts are kept for up to 2 years.

Data outside the UK

Some of our providers (such as Cloudflare, Stripe, Google and Meta) may process data outside the UK, including in the US and EU. When they do, it's protected by UK adequacy decisions, the UK–US data bridge or the UK's standard contract clauses.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit or object to how we use it, or to move it to someone else. You can withdraw consent to marketing at any time. Email hello@oddvana.com and we'll reply within one month. If you're not happy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), but we'd love the chance to sort it out first.

Keeping it safe

Our site uses HTTPS throughout, payments are handled by PCI-compliant providers, and access to customer data is limited and protected by passcodes. Our shop is for adults; we don't knowingly collect data from children under 13.

Changes

If we change this policy we'll update the date at the top, and tell you by email if the change is significant. See also our Cookie policy.