Privacy policy
PRIVACY POLICY
Last updated: October 22, 2026
1. Introduction
Welcome to OMAH Shop (“OMAH,” “we,” “us,” or “our”).
OMAH is an independent clothing and lifestyle brand operated by a self-employed individual established in Spain.
We operate the website omahshop.com and its associated online store, products, services, and digital features (collectively, the “Services”).
OMAH is powered by Shopify, which provides the e-commerce infrastructure that enables us to offer our products and services.
We are committed to protecting your privacy and handling your personal information transparently, responsibly, and securely.
This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit our website, purchase our products, subscribe to our communications, submit reviews, or otherwise interact with us.
We process personal information in accordance with applicable data protection legislation, including:
- The European Union General Data Protection Regulation (EU) 2016/679 (“GDPR”).
- Spain’s Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (“LOPDGDD”).
- Applicable Spanish legislation governing electronic communications and online services.
- The UK General Data Protection Regulation and Data Protection Act 2018, where applicable.
- Other applicable privacy and consumer protection laws in jurisdictions where we operate.
Please read this Privacy Policy carefully to understand how we handle your information and the rights available to you.
2. Identity of the Data Controller
For the purposes of applicable data protection laws, the data controller responsible for the personal information processed in connection with OMAH Shop is:
Legal Name: SU WON LEE KIM
Trading Name: OMAH Shop
Business Structure: Self-employed individual (Autónoma)
Business Address: Partida de Saboia, 59
Postal Code: 46120
City: Alboraia
Country: Spain
Email: info@omahshop.com
Website: omahshop.com
For questions about this Privacy Policy or requests concerning your personal information, please contact us at info@omahshop.com.
3. Personal Information We Collect
Depending on how you interact with our Services, we may collect and process the following categories of personal information.
3.1. Contact Information
- Full name.
- Email address.
- Telephone number, where provided.
- Billing address.
- Shipping address.
- Country and region of residence.
3.2. Order and Transaction Information
- Products purchased.
- Order numbers and transaction identifiers.
- Purchase dates.
- Order values and currencies.
- Shipping and delivery information.
- Order history.
- Returns, refunds, cancellations, and customer service requests.
- Payment status and confirmation.
Payments are processed through authorized payment service providers, including Shopify Payments and PayPal.
OMAH does not ordinarily receive or store complete payment card numbers, card security codes, or online banking credentials.
Payment providers may independently collect and process financial information in accordance with their own privacy policies.
3.3. Customer Account Information
If you create or use a customer account, we may process:
- Account identifiers.
- Contact information.
- Order history.
- Saved addresses.
- Account preferences.
Authentication information is managed through Shopify’s customer account infrastructure.
3.4. Website and Device Information
When you visit our website, certain technical information may be collected automatically, including:
- IP address.
- Browser type and version.
- Device type.
- Operating system.
- Language preferences.
- Website navigation and interactions.
- Referring websites.
- Approximate geographical location derived from technical information.
- Cookie identifiers and similar technologies, where applicable.
Some of this information is necessary for website functionality, security, and fraud prevention.
Other information, particularly that collected through optional analytics or advertising technologies, is processed only where a valid legal basis exists and any required consent has been obtained.
3.5. Communications
When you contact us, we may collect:
- Your name and contact details.
- The content of your message.
- Information necessary to respond to your inquiry.
- Relevant order or customer service history.
3.6. Product Reviews
If you submit a product review, we may process:
- Your name or chosen display name.
- Your review and rating.
- Photographs or other content you voluntarily submit.
- Information used to verify your purchase.
Product reviews may be collected and displayed using Judge.me, our customer review service provider.
Reviews submitted for publication may be visible to other visitors.
We recommend that you avoid including sensitive personal information in publicly displayed reviews.
4. Sources of Personal Information
We may collect personal information:
Directly from you: When you place an order, create an account, contact us, subscribe to marketing communications, or submit a review.
Automatically: Through your interactions with our website and the technologies necessary to operate it.
From service providers: Including Shopify, payment processors, fulfillment providers, delivery services, and customer support or review platforms.
From marketing and analytics partners: Where such integrations are enabled and the collection or sharing of information is permitted under applicable law.
We collect and process only the personal information reasonably necessary for the relevant purposes.
5. How We Use Your Personal Information
We use personal information for the following purposes.
5.1. Processing and Fulfilling Orders
We process information to:
- Confirm and manage purchases.
- Process payments.
- Arrange production and fulfillment.
- Deliver products.
- Provide order confirmations and shipping updates.
- Manage returns, refunds, and cancellations.
- Respond to order-related inquiries.
Legal basis: Performance of a contract under Article 6(1)(b) GDPR.
5.2. Customer Service
We use personal information to respond to inquiries, resolve problems, provide assistance, and manage customer relationships.
Legal basis: Performance of a contract or legitimate interests under Articles 6(1)(b) and 6(1)(f) GDPR, depending on the nature of the inquiry.
5.3. Legal and Accounting Obligations
We process certain information to comply with applicable tax, accounting, consumer protection, and other legal requirements.
Legal basis: Compliance with a legal obligation under Article 6(1)(c) GDPR.
5.4. Security and Fraud Prevention
We may process information to:
- Detect suspicious transactions.
- Prevent payment fraud.
- Protect customer accounts.
- Maintain website security.
- Investigate unauthorized activity.
- Establish, exercise, or defend legal claims.
Legal basis: Legitimate interests under Article 6(1)(f) GDPR, or compliance with a legal obligation where applicable.
Our legitimate interests include protecting customers, preventing financial loss, and maintaining the security of our Services.
5.5. Marketing Communications
Where permitted by applicable law, we may use your contact information to send:
- Product announcements.
- News about new collections.
- Special offers.
- Promotional communications.
- Brand updates and newsletters.
Where consent is required, we will obtain it before sending marketing communications.
You may unsubscribe at any time using the link provided in our emails or by contacting info@omahshop.com.
Legal basis: Consent under Article 6(1)(a) GDPR, or another applicable legal basis where direct marketing is expressly permitted by law.
5.6. Website Analytics and Advertising
We use marketing and advertising technologies provided by Meta Platforms (Facebook and Instagram) and TikTok to understand how visitors interact with our website, measure the effectiveness of our advertising campaigns, and improve our marketing activities.
These technologies may collect information about your interactions with our website, including pages viewed, products viewed, items added to your shopping cart, purchases, and certain device and browser information.
Where permitted by applicable law and subject to your privacy preferences, this information may be used to:
- Measure the performance of advertising campaigns.
- Understand how visitors discover and interact with our products.
- Deliver more relevant advertisements on Facebook, Instagram, and TikTok.
- Create advertising audiences based on website interactions.
- Improve our marketing strategies and customer experience.
We use the official Meta and TikTok integrations available through Shopify.
Where required by applicable law, non-essential tracking and advertising technologies are activated only after you have provided your consent.
You may withdraw or modify your consent at any time through the cookie preferences available on our website.
Legal basis: Consent under Article 6(1)(a) GDPR, where required by applicable law.
5.7. Customer Reviews
We may invite customers to review purchased products and publish reviews they choose to submit.
Legal basis: Legitimate interests or consent, depending on the processing activity and applicable legal requirements.
Where reviews include personal information, customers may exercise their applicable data protection rights.
6. Legal Bases for Processing
Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases:
Performance of a Contract: When processing is necessary to provide products or services you request.
Legal Obligation: When processing is necessary to comply with applicable law.
Legitimate Interests: When processing is necessary for legitimate business purposes, provided those interests are not overridden by your fundamental rights and freedoms.
Consent: When you have freely given specific, informed, and unambiguous consent to particular processing activities.
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
7. How We Share Personal Information
We share personal information only when necessary for legitimate business operations, legal compliance, or other purposes permitted by applicable law.
7.1. E-commerce Platform
Shopify
Our store operates on Shopify’s e-commerce infrastructure.
Shopify processes information necessary to provide online shopping, checkout, customer account, order management, and related services.
Certain Shopify features may involve additional processing for analytics, security, or service improvement, as described in Shopify’s privacy documentation.
Shopify may act as a processor or an independent controller depending on the particular processing activity.
For more information, please consult:
7.2. Payment Providers
Shopify Payments and PayPal
We use payment service providers to securely process transactions.
These providers may collect payment information, conduct fraud checks, and process transaction-related data in accordance with their own legal obligations and privacy policies.
7.3. Production and Fulfillment
Gelato
OMAH uses Gelato to produce and fulfill certain products through a print-on-demand model.
To fulfill your order, we may share information such as:
- Recipient name.
- Shipping address.
- Contact details necessary for delivery.
- Product and order information.
Gelato and its production and logistics partners process this information as necessary to manufacture and deliver purchased products.
7.4. Shipping and Logistics
We may share delivery information with shipping companies, postal services, and logistics providers responsible for delivering your purchases.
7.5. Customer Reviews
We use Judge.me to collect, manage, and display customer reviews.
Relevant order and customer information may be shared with Judge.me for review invitations, purchase verification, and review management.
7.6. Marketing and Analytics Providers
We use the following marketing and advertising platforms:
Meta Platforms (Facebook and Instagram)
We use Meta’s advertising technologies to measure campaign performance, understand website interactions, and deliver relevant advertising through Facebook and Instagram.
TikTok
We use TikTok’s advertising technologies to measure campaign performance, analyze website interactions, and deliver relevant advertising through TikTok.
Depending on the configuration of these services and your consent preferences, information shared with these providers may include website activity, purchase events, device information, and identifiers used for advertising measurement.
These providers may process certain information as independent data controllers in accordance with their respective privacy policies.
Where required by law, we obtain your consent before activating non-essential advertising technologies or sharing information for these purposes.
You may manage your preferences through the cookie consent controls available on our website.
7.7. Legal Requirements
We may disclose personal information when necessary to comply with applicable law, respond to lawful requests from competent authorities, protect legal rights, or establish, exercise, or defend legal claims.
8. Cookies and Similar Technologies
Our website uses cookies and similar technologies to support essential functionality and, where enabled, analytics, personalization, and advertising.
Cookies are small files or identifiers that may be stored on your device when you visit a website.
Categories of Cookies
Strictly Necessary Cookies
These support essential functions such as shopping carts, checkout, security, and session management.
Where legally permitted, these cookies do not require prior consent.
Analytics Cookies
Where enabled, these help us understand website performance and visitor interactions.
Marketing and Advertising Cookies
Where enabled, these may help measure advertising campaigns and display relevant advertisements.
Preference Cookies
These may remember certain website settings or choices.
Your Cookie Choices
Where required by law, we request your consent before placing or accessing non-essential cookies or activating similar tracking technologies.
You may accept, reject, or modify your preferences through the cookie consent controls available on our website.
Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.
For additional information about the cookies and technologies used by our website, please consult our Cookie Policy and the cookie preferences interface, where available.
9. International Transfers of Personal Information
OMAH is established in Spain and serves customers internationally.
Some of our service providers and their partners may process personal information outside the European Economic Area or the United Kingdom.
Where personal information is transferred internationally, we take steps to ensure that the transfer complies with applicable data protection requirements.
Depending on the circumstances, safeguards may include:
- European Commission adequacy decisions.
- The EU-US Data Privacy Framework, where applicable.
- European Commission Standard Contractual Clauses.
- Applicable UK international data transfer mechanisms.
- Other legally recognized safeguards.
You may contact us for additional information about the safeguards applicable to transfers of your personal information.
10. Data Security
We take reasonable technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, loss, or destruction.
Our e-commerce and payment service providers implement security measures appropriate to their respective services.
However, no method of electronic transmission or storage can be guaranteed to be completely secure.
We encourage customers to protect their account credentials and avoid transmitting sensitive financial information through unsecured communication channels.
11. Data Retention
We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, subject to applicable legal obligations.
Retention periods depend on the category of information and the purpose of processing.
Order and Transaction Records: Retained for the periods required by applicable tax, accounting, commercial, and consumer protection laws.
Customer Account Information: Retained while necessary to maintain the account and provide requested services, subject to applicable legal obligations.
Customer Service Communications: Retained for as long as reasonably necessary to resolve inquiries, manage disputes, and comply with legal requirements.
Marketing Information: Retained while a valid legal basis exists, including until consent is withdrawn where processing relies on consent, subject to any necessary suppression records.
Fraud Prevention and Security Records: Retained for periods necessary and proportionate to the relevant security purpose.
Product Reviews: Retained while necessary for legitimate review-related purposes, subject to applicable rights and legal requirements.
When information is no longer required, we will delete, anonymize, or otherwise handle it in accordance with applicable law.
12. Your Privacy Rights
Depending on your location and applicable law, you may have the following rights.
Right of Access
You may request confirmation of whether we process your personal information and obtain access to that information.
Right to Rectification
You may request correction of inaccurate or incomplete personal information.
Right to Erasure
You may request deletion of your personal information where the legal requirements for erasure are met.
Right to Restriction
You may request that we restrict certain processing activities in circumstances provided by law.
Right to Data Portability
Where applicable, you may request to receive certain personal information in a structured, commonly used, machine-readable format or request its transfer to another controller.
Right to Object
You may object to processing based on legitimate interests in circumstances provided by law.
You have the right to object at any time to processing of your personal information for direct marketing purposes.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time.
Rights Relating to Automated Decision-Making
Where applicable, you have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.
Exercising Your Rights
To exercise your rights, contact:
We may request reasonable information to verify your identity before processing your request.
We will respond within the time limits established by applicable law.
Under the GDPR, this is generally one month from receipt of the request, subject to legally permitted extensions.
We will not discriminate against customers for exercising applicable privacy rights.
13. Privacy Rights in Other Jurisdictions
Customers residing outside the European Economic Area may have additional privacy rights under applicable local laws.
For example, certain US state privacy laws may provide rights to access, correct, delete, or obtain copies of personal information, as well as rights concerning targeted advertising or certain disclosures of personal information.
Where such laws apply to OMAH, we will honor the rights and obligations established by those laws.
Applicable opt-out mechanisms and privacy controls will be provided where legally required.
14. Children’s Privacy
Our Services are intended for a general adult audience.
We do not knowingly collect personal information directly from children in circumstances prohibited by applicable law.
If you are a parent or legal guardian and believe that a child has provided us with personal information unlawfully, please contact info@omahshop.com.
We will review the request and take appropriate action in accordance with applicable law.
15. Third-Party Websites and Services
Our website may contain links to websites, social media platforms, or services operated by third parties.
These third parties have their own privacy policies and data protection practices.
We encourage you to review their privacy notices before providing personal information.
OMAH is not responsible for the privacy practices of independent third-party websites or services.
16. Marketing Communications
If you subscribe to our newsletter or otherwise agree to receive promotional communications, we may contact you with information about OMAH products, collections, and special offers.
You can unsubscribe at any time by clicking the unsubscribe link in our marketing emails.
You may also contact info@omahshop.com to request removal from our marketing mailing list.
Unsubscribing from marketing communications will not prevent us from sending necessary transactional messages, such as order confirmations, shipping updates, or legally required notices.
17. Complaints and Supervisory Authorities
If you have concerns about how we process your personal information, please contact us first at:
We will make reasonable efforts to address your concerns.
If you believe that your data protection rights have been violated, you may lodge a complaint with the relevant supervisory authority.
For customers in Spain, the competent supervisory authority is:
Agencia Española de Protección de Datos (AEPD)
Website: https://www.aepd.es
Customers in other European Economic Area countries may also contact their relevant data protection supervisory authority.
18. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our business operations, services, technologies, legal obligations, or privacy practices.
When changes are made, we will publish the revised policy on our website and update the “Last updated” date.
Where required by law, we will provide additional notice or obtain consent before implementing changes that materially affect how personal information is processed.
19. Contact Information
For questions about this Privacy Policy, privacy-related inquiries, or requests to exercise your data protection rights, please contact:
OMAH Shop
Operated by: SU WON LEE KIM
Business Address: PARTIDA DE SABOIA, 59
Postal Code and City: 46120 ALBORAYA
Country: Spain
Email: info@omahshop.com
Website: omahshop.com
Data Controller: SU WON LEE KIM, trading as OMAH Shop.