Privacy policy

This policy explains what Mondeaux, trading as Oakmerrow, does with personal data collected through https://www.oakmerrow.com. We handle personal data in line with the UK General Data Protection Regulation and the Data Protection Act 2018, and — because we are established in the Netherlands — with the European General Data Protection Regulation.

1. Who is responsible

Mondeaux, Torenlaan 5B, 1402 AT Bussum, Netherlands, is the controller of the personal data described here. Any question about this policy can go to info@oakmerrow.com.

2. What we collect

Order data: your name, delivery address, billing address, email address, telephone number where you give one, and the contents of your order.
Payment data: handled by our payment provider. We see whether a payment succeeded and the last four digits of the card. We never see or hold the full card number.
Correspondence: the messages you send us and our replies.
Technical data: IP address, browser and device type, and the pages you viewed on our site.
Marketing preferences: whether you subscribed to our emails and whether you open them.

3. Why we use it, and our lawful basis

To perform the contract — taking payment, dispatching, tracking and handling returns. Without this data we cannot complete the sale.
To answer you — replying to questions and dealing with complaints.
To meet legal obligations — Dutch tax law requires invoices and order records to be kept for seven years.
Legitimate interests — screening for fraudulent orders and keeping the site secure. We have weighed this against your rights and it does not override them.
Consent — marketing emails and non-essential cookies, which you can withdraw at any time.

4. Cookies

Cookies are small files a site stores on your device. We use three kinds:

Strictly necessary cookies, which keep your basket and session working. The site cannot function without them and they need no consent.
Analytics cookies, which tell us in aggregate how many people visit and which pages they view.
Marketing cookies, which measure whether an advertisement led to a visit.

Under the Privacy and Electronic Communications Regulations we ask for your consent before setting anything beyond the strictly necessary ones. The banner on your first visit lets you accept or refuse each category, and you can change your mind at any time through your browser settings. Blocking strictly necessary cookies will stop checkout from working.

5. Who we share it with

We do not sell personal data and we never will. We share it only with those who need it to get your order to you:

Shopify, which hosts the shop and stores order data.
Our payment providers, which process the payment.
Our suppliers and their carriers, which receive the name, address and telephone number needed to make the delivery.
Our email provider, for order confirmations and, where you subscribed, marketing messages.
Our accountant, and the tax authorities where the law requires it.

Each of these may use the data only for the task we have given them.

6. Transfers outside the United Kingdom

Our systems store data on servers in the European Economic Area and, in Shopify's case, in Canada and the United States. Because our suppliers and their carriers are located outside the UK, delivery data is transferred to recipients abroad, mainly in the European Economic Area and Asia.

Those transfers rest on UK adequacy regulations or on the International Data Transfer Addendum to the European Commission's standard contractual clauses, together with additional safeguards where the destination is not covered by adequacy.

7. How long we keep it

Orders and invoices: seven years, as Dutch tax law requires.
Customer service correspondence: two years after the matter is closed.
Marketing subscriptions: until you unsubscribe, after which we keep a record of the unsubscribe so we do not contact you again.
Analytics data: twenty-six months.

8. Security

The whole site runs over an encrypted connection. Access to order data is limited to those who need it, protected by individual accounts and two-factor authentication. Card details pass straight to the payment provider and never touch our systems.

No system is completely secure. Where a breach is likely to result in a risk to your rights and freedoms we will notify the Information Commissioner's Office within 72 hours, and we will tell you directly where the risk is high.

9. Your rights

Access — ask what personal data we hold about you and receive a copy.
Rectification — have inaccurate or incomplete data corrected.
Erasure — have your data deleted, except where we must keep it by law.
Restriction — ask us to limit how we use your data while a question is resolved.
Objection — object to processing based on our legitimate interests, and object to direct marketing at any time.
Portability — receive the data you gave us in a machine-readable format.
Withdraw consent — where processing rests on consent, withdraw it at any time without affecting what was lawful beforehand.

Email info@oakmerrow.com and we will respond within one month. We may ask you to confirm your identity first. Exercising these rights is free of charge.

10. Marketing and your choices

We send marketing email only to people who have asked for it. Every message carries a working unsubscribe link and we act on unsubscribe requests immediately.

You can also ask us to stop by email. Transactional messages about orders you have placed — confirmations, dispatch notices and refund notices — are not marketing and continue while an order is open.

We do not sell, rent or trade personal data to anyone for their own marketing purposes.

11. Automated decision-making

We do not make decisions about you by automated means that produce legal effects or similarly significant effects. Fraud screening may flag an order for a human to look at, but no order is refused by a machine alone.

12. Children

The shop is intended for adults. We do not knowingly collect data from children under 13. If you believe a child has given us personal data, email us and we will delete it.

13. Complaints

If you think we have mishandled your personal data, email info@oakmerrow.com with the details. We will investigate and reply within one month.

If our answer does not satisfy you, you may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. Because we are established in the Netherlands you may also approach the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.

14. Changes to this policy

We update this policy when our practices change. The current version is always on this page and material changes are announced on the site before they take effect.

Business details

Registered business name: Mondeaux
Trading as: Oakmerrow
Registered address: Torenlaan 5B, 1402 AT Bussum, Netherlands
Dutch Chamber of Commerce (KvK) number: 96593849
VAT number: NL867675688B01
Email: info@oakmerrow.com

Customer service
Monday to Friday: 08:00 – 18:00 (Central European Time)
Saturday and Sunday: 12:00 – 17:00 (Central European Time)
Email reaches us fastest and every message is answered within one working day.