Last updated: 22 September 2026

This Privacy Policy explains how OSMANLY LTD collects and uses your personal data when you visit osmanly.com, place an order or contact us. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

The data controller is OSMANLY LTD, a private limited company registered in England & Wales, Company No. 17185875, registered office: Office 18653, 182–184 High Street North, East Ham, London E6 2JA, United Kingdom. You can contact us about privacy by email at info@osmanly.com or through the Contact section of our website or by post at the address above, marking your letter “Data Protection”.

2. The personal data we collect

  • Identity and contact data – name, billing and delivery address, email address and telephone number.
  • Order data – products purchased, personalisation details you give us (such as a name to be engraved), order value, delivery and returns information.
  • Payment data – payments are processed by our payment providers (Stripe, including Apple Pay, Google Pay and Link). We do not receive or store your full card number; we receive only a confirmation of payment and limited details such as card type and last four digits.
  • Account data – username, password (stored in encrypted form), wishlist and order history, if you create an account.
  • Communications – messages you send us by email, WhatsApp or our contact form, and any reviews you submit.
  • Technical and usage data – IP address, browser and device type, pages visited and similar data collected through cookies (see section 9).
  • Marketing preferences – whether you have subscribed to our newsletter.

We do not knowingly collect special category data. Please do not include sensitive information (for example about health or religious belief) in personalisation requests or messages unless it is necessary for your order.

3. How and why we use your data

Purpose Lawful basis (UK GDPR Art. 6)
Processing, making, shipping and delivering your order; handling returns and refunds Performance of a contract
Managing your account and answering your enquiries Performance of a contract / legitimate interests
Keeping accounting and tax records; meeting customs and legal requirements Legal obligation
Preventing fraud and keeping our website secure Legitimate interests
Improving our website, products and service, and measuring site performance Legitimate interests / consent (for non-essential cookies)
Sending newsletters and marketing emails Consent — or, for existing customers, our legitimate interest in sending similar-product offers (the “soft opt-in”), which you can refuse at any time
Establishing, exercising or defending legal claims Legitimate interests

4. Who we share your data with

We share personal data only where necessary, and never sell it. Recipients include:

  • Our artisans and fulfilment partners in Türkiye – who make, pack and dispatch your order and therefore receive your name, delivery address, telephone number and order details;
  • Couriers and postal services – for delivery and tracking, and customs authorities where required for international shipments;
  • Payment providers – Stripe and the related wallet providers, for payment processing and fraud prevention;
  • IT and service providers – our website host (Hostinger), e-commerce platform (WordPress/WooCommerce), email and newsletter tools (such as Mailchimp) and analytics (Google), acting on our instructions;
  • Location and translation services – an IP geolocation service (GeoJS) that receives your IP address once to show prices in your local currency, and Google Translate, which receives the page text when you choose a language other than English;
  • Professional advisers – accountants, lawyers and insurers;
  • Authorities – HMRC, law enforcement or regulators where the law requires it.

5. International transfers

Because our products are made and shipped from Türkiye, and some of our service providers are based in the United States or elsewhere, your personal data may be transferred outside the UK. Where a country does not have UK “adequacy” status, we rely on appropriate safeguards recognised under UK data protection law, such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, the UK Extension to the EU–US Data Privacy Framework, or, where applicable, the transfer being necessary to perform your contract. You can ask us for more information about these safeguards.

6. How long we keep your data

  • Order, invoice and payment records: 6 years after the end of the financial year of the order, to meet UK tax and accounting requirements.
  • Account data: until you close your account, then deleted or anonymised, except records we must keep by law.
  • Customer-service correspondence: up to 2 years after the matter is resolved, unless needed for a claim.
  • Marketing data: until you unsubscribe or withdraw consent, after which we keep a suppression record so we do not contact you again.

7. Your rights

Subject to certain conditions, you have the right to:

  • access a copy of your personal data;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to our processing, including objecting at any time to direct marketing;
  • data portability;
  • withdraw consent at any time, where we rely on consent (this does not affect processing already carried out).

To exercise your rights, contact us as set out in section 1. We will respond within one month and there is normally no fee. You can unsubscribe from marketing emails at any time using the link in each email.

You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO): ico.org.uk, telephone 0303 123 1113. We would appreciate the chance to deal with your concern first.

8. Security

We use appropriate technical and organisational measures to protect your data, including encrypted (HTTPS) connections, a PCI-DSS compliant payment provider, access controls and limiting access to personal data to those who need it. No method of transmission over the internet is completely secure, but we take reasonable steps to protect your information and will notify you and the ICO of a personal data breach where the law requires.

9. Cookies

Cookies are small files stored on your device. We use:

  • Strictly necessary cookies – to run the shopping basket, checkout, account login and security features, and to help our payment provider detect fraud. These do not require consent.
  • Preference cookies – to remember choices such as language, currency or wishlist items.
  • Analytics cookies – such as Google Analytics, to understand how visitors use our site.
  • Marketing cookies – if used, to measure or personalise advertising.

Non-essential cookies (preference, analytics and marketing) are only set with your consent, which you can give or withdraw at any time through our cookie banner or your browser settings. Blocking some cookies may affect how the site works.

10. Children

Our website is not directed at children. We do not knowingly collect personal data from anyone under 16, and customers must be 18 or over to place an order.

11. Links to other websites

Our site may link to third-party websites, including Companies House and social media platforms. We are not responsible for their privacy practices; please read their own policies.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be published on this page with its “last updated” date. Where changes are significant, we will notify you by email or by a notice on the website.

OSMANLY LTD · Registered in England & Wales · Company No. 17185875 · Verify on Companies House · View Certificate of Incorporation