Privacy policy

This policy explains what personal information Ostavel collects, why we need it, who we share it with and the choices you have. It applies to everyone who shops with us, whether you’re ordering in the United Kingdom (in GBP) or in Italy (in EUR), and covers ostavel.com, our emails and any contact you have with our customer service team.

Who is responsible for your data

Ostavel is a trading name of Midtux LTD, a company registered in England and Wales under company number 16932731, with its registered office at 20 Wenlock Street, London N1 7GU, United Kingdom. Midtux LTD is the controller of your personal data.

For anything privacy-related, email support@ostavel.com with “Privacy” in the subject line so it reaches the right person straight away.

The laws we follow

  • Customers in the UK: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations (PECR).
  • Customers in Italy: the EU General Data Protection Regulation (Regulation (EU) 2016/679), the Italian Privacy Code (Legislative Decree 196/2003) and the cookie guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Your rights are the same wherever you shop from. Where the two sets of rules differ, we apply the one that protects you more.

What we collect

  • Contact and delivery details: name, email address, phone number, delivery and billing address. You give us these at checkout or when you create an account.
  • Order details: what you bought, sizes, order value, currency, delivery and returns history.
  • Payment details: card type, last four digits and payment confirmation, sent to us by our payment providers. We never receive your full card number.
  • Account details: login email, password (stored in encrypted form) and saved addresses, if you create an account.
  • Messages: emails, contact form messages, return requests and photos of a faulty item.
  • Device and browsing data: IP address, browser and device type, language, pages viewed and how you found us, collected through cookies and similar technologies.
  • Marketing preferences: whether you’ve signed up to our emails and whether you open them.

We don’t ask for sensitive information such as health details. If you send us your measurements to help choose a size, we use them for that and nothing else.

Why we use it

  • To process, deliver and track your order, and handle returns, withdrawals, exchanges and refunds. Lawful basis: performing our contract with you.
  • To reply to your questions and complaints. Lawful basis: performing our contract, or our legitimate interest in looking after customers.
  • To send order, dispatch and delivery emails. Lawful basis: performing our contract.
  • To handle customs and VAT paperwork for orders shipped to Italy. Lawful basis: legal obligation.
  • To prevent fraud and keep payments secure. Lawful basis: legitimate interests and legal obligation.
  • To keep tax and accounting records. Lawful basis: legal obligation.
  • To measure how the site is used so we can improve it. Lawful basis: your consent, given through our cookie banner.
  • To send marketing emails about new arrivals and offers. Lawful basis: your consent or, if you’ve already bought from us, our legitimate interest in telling you about similar products (you can opt out at checkout and in every email).
  • To show you personalised Ostavel ads on platforms such as Google. Lawful basis: your consent, given through our cookie banner.
  • To establish or defend legal claims. Lawful basis: legitimate interests.

Where we rely on legitimate interests, we’ve weighed our interest against your rights and only go ahead where the impact on you is low and something you’d reasonably expect.

Who we share it with

We don’t sell your personal data. We share only what’s needed, with:

  • Shopify, the platform that hosts our store and stores order information
  • Payment providers that process card and wallet payments
  • Delivery carriers, customs agents and our order-tracking provider, so your parcel reaches you in the UK or Italy and you can follow it
  • Email and customer service tools we use to send order updates and answer messages
  • Analytics and advertising partners such as Google, only if you’ve agreed to those cookies
  • Professional advisers such as accountants, and tax authorities, customs, the police or regulators in the UK or Italy when the law requires it
  • A buyer of our business, if the business is ever sold, under the same protections

Service providers acting for us may only use your data on our instructions and under a written contract.

Transfers between countries

We’re a UK company, so if you shop from Italy your data is transferred from the European Union to the United Kingdom. The European Commission recognises the UK as providing an adequate level of protection, so this transfer needs no extra paperwork.

Some of our providers also store or access data in other countries, such as Canada or the United States. When that happens we make sure the transfer is protected, using adequacy decisions where they exist, the EU-US Data Privacy Framework (and its UK Extension) where a US provider is certified, or standard contractual clauses approved by the European Commission and the UK Information Commissioner.

How long we keep it

  • Order and payment records: for as long as tax and accounting law requires, normally 6 years after the end of the financial year they relate to
  • Your account: until you ask us to close it, or after 3 years with no activity
  • Customer service messages and return requests: 3 years after the conversation ends
  • Marketing data: until you unsubscribe. We then keep only your email address on a suppression list so you aren’t contacted again
  • Cookies: for the periods shown in our cookie settings; most expire within 13 months

After that, we delete the data or anonymise it so it can no longer identify you.

Cookies

Cookies are small files saved on your device. Technical cookies keep your basket, checkout, language and currency settings working and are always on. Analytics and advertising cookies are only placed if you accept them through our cookie banner, which gives you an equally clear option to refuse. Closing the banner without choosing means only technical cookies are used.

You can change your mind at any time using the “Cookie preferences” link in the footer of our website, or block cookies in your browser settings (some parts of the site may stop working properly if you do).

Marketing emails

You’ll only get marketing emails from us if you’ve signed up, or if you’ve bought from us and didn’t opt out. Every email has an unsubscribe link, and you can also reply asking us to stop. We’ll act on it straight away.

Your rights

Wherever you live, you can:

  • ask for a copy of the personal data we hold about you
  • ask us to correct data that’s wrong or incomplete
  • ask us to delete your data
  • ask us to restrict how we use it
  • object to our use of it, including an absolute right to object to direct marketing
  • ask for your data in a format you can take elsewhere
  • withdraw your consent at any time, where we rely on consent

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

To use any of these rights, email support@ostavel.com. It’s free in most cases. We may ask you to confirm your identity first. We’ll reply within one month, or let you know within that month if a complex request needs up to two more months.

Complaints

If you’re unhappy with how we’ve handled your data, please tell us first. We’ll acknowledge your complaint within 30 days and keep you updated until it’s resolved. You also have the right to complain to a data protection authority:

  • In the UK: the Information Commissioner’s Office (ICO), ico.org.uk, 0303 123 1113
  • In Italy: the Garante per la protezione dei dati personali, garanteprivacy.it

Children

Our site and products are intended for adults. We don’t knowingly collect personal data from anyone under 18. If you think a child has given us their details, contact us and we’ll delete them.

Keeping your data safe

Our site uses an encrypted (HTTPS) connection, payments are processed by specialist providers, and access to customer data is limited to the people who need it to do their job. No system is completely secure, but if a breach ever puts your information at risk, we’ll tell you and the relevant authority as the law requires.

Changes to this policy

We’ll update this page whenever our practices change. If a change significantly affects how we use your data, we’ll also let you know by email.

Contact

Email: support@ostavel.com
Registered Office: 20 Wenlock Street, London N1 7GU, United Kingdom
Address: 129 Gawthorne St, New Basford, Nottingham NG7 7JU, United Kingdom
Address (Italy): Via Porta Calcinara, 22, 27100 Pavia PV, Italy
Contact form: Click here
Customer Service Hours: Monday to Friday, 9:00 AM – 5:00 PM (GMT)

Weekend messages will be answered the following Monday.