Privacy policy
Privacy Policy
Last updated: 14 August 2026
Ohh! By Gum Ltd ("Ohh! By Gum", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store and share your personal data when you visit or shop on our website, create an account, subscribe to our marketing communications, leave a review, contact us or otherwise interact with us.
Ohh! By Gum operates this website using Shopify, which provides the ecommerce platform through which we sell our products and provide our services.
For the purposes of the General Data Protection Regulation ("GDPR") and applicable Irish data protection law, Ohh! By Gum Ltd is the data controller of the personal data described in this Privacy Policy, except where another organisation acts as an independent controller for particular processing.
1. Who We Are
Ohh! By Gum Ltd
The Courtyard
Station House
Clifden
Co. Galway
H71 Y668
Ireland
Email: ohhbygum@gmail.com
Telephone: +353 87 800 0377
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us using the details above.
2. Personal Data We Collect
The personal data we collect depends on how you interact with us and may include:
Contact information
Your name, email address, telephone number, billing address and delivery address.
Order and transaction information
Information about products you purchase, return, exchange or cancel, your order history, transaction details, delivery information and payment confirmation.
Payment information
Payments made through our website are processed using our payment service providers. Depending on the payment method used, payment providers may process payment card, bank account or other financial information necessary to complete the transaction.
We do not necessarily receive or retain complete payment card details ourselves.
Account information
If you create an account, we may process information associated with that account, including your login details, preferences and order history.
Marketing information
If you choose to subscribe to our mailing list, we process information such as your name, email address, subscription status, marketing preferences and information about your interaction with our marketing communications.
Reviews and user-generated content
If you submit a product review through Judge.me or otherwise provide a review or other content, we may process your name or display name, email address, review, rating and information associated with your purchase or submission.
Communications
We process information you provide when you contact us by email, telephone, live chat, contact form, social media or another communication channel.
Device and website usage information
When you use our website, certain information may be collected about your browser, device and interaction with our website, including IP address, browser type, device identifiers, pages viewed, referring pages and information about how you use our website.
Some of this information is collected using cookies and similar technologies. Non-essential analytics and advertising technologies are used subject to the consent requirements described below.
3. Where We Obtain Your Personal Data
We may obtain personal data:
- directly from you when you place an order, create an account, contact us, subscribe to marketing or submit a review;
- automatically when you use our website, including through cookies and similar technologies where permitted;
- from Shopify and the apps and service providers that support our online store;
- from payment, delivery and fulfilment providers involved in completing your order; and
- from marketing, analytics and advertising providers where you have provided any consent required for the relevant processing.
4. How and Why We Use Your Personal Data
Under the GDPR, we must have a lawful basis for processing personal data.
Processing and fulfilling your orders
We use your personal data to:
- process your order;
- take or facilitate payment;
- deliver your purchases;
- provide order confirmations and delivery information;
- process returns, refunds and exchanges; and
- provide customer service relating to your purchase.
Lawful basis: Processing is necessary for the performance of our contract with you or to take steps at your request before entering into a contract.
Managing customer accounts
Where you choose to create an account, we process your information to create, maintain and provide the account and associated features.
Lawful basis: Performance of our contract with you and, where appropriate, our legitimate interests in providing and administering our customer services.
Customer service and live chat
We process personal data when you contact us with questions, requests, complaints or other enquiries, including through our live-chat facilities.
Lawful basis: Depending on the nature of your enquiry, processing may be necessary for our contract with you or based on our legitimate interests in responding to customers and operating our business.
Email marketing
We use Shopify Email, Klaviyo and Marsello to support our email marketing and customer communications.
We send marketing emails to you only where you have actively chosen to subscribe to our marketing communications.
We do not automatically add customers to our marketing list merely because they have purchased from us.
You can withdraw your marketing consent at any time by using the unsubscribe link provided in our marketing emails or by contacting us.
Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
Lawful basis: Consent.
Product reviews
We use Judge.me to provide product-review functionality. If you submit a review, personal data associated with your review may be processed in order to collect, verify, administer and display reviews.
Lawful basis: Depending on the circumstances, your consent and/or our legitimate interests in allowing customers to provide feedback and helping customers make informed purchasing decisions.
Loyalty and customer engagement
We use services including Smile.io and Marsello to support customer engagement, loyalty and related functionality.
Where participation requires the processing of your personal data, we use that information to provide the relevant service or feature.
Lawful basis: Depending on the particular feature, performance of our contract with you, consent, or our legitimate interests in operating and improving our customer services.
Product recommendations
We use Wiser to provide product recommendation functionality on our store. This may involve information about products viewed or interactions with our website.
Where this functionality involves non-essential cookies or tracking technologies, these will be subject to the applicable consent requirements.
Lawful basis: Our legitimate interests in improving the shopping experience, where the processing does not require consent. Where consent is required for cookies or similar technologies, we rely on consent.
Website analytics
We use Google Analytics to understand how visitors use our website, such as which pages are visited and how visitors interact with our store.
Google Analytics may use cookies and similar technologies.
We use analytics cookies or similar technologies where the required consent has been obtained.
Lawful basis: Consent where required for the storage of or access to information on your device and, where personal data is subsequently processed, the applicable GDPR lawful basis.
Meta/Facebook advertising and measurement
We use the Meta/Facebook Pixel to help measure website activity and the effectiveness of advertising and to support advertising-related functionality.
This technology may involve information about your device, browser and activity on our website being processed by or made available to Meta.
The Meta Pixel and other non-essential advertising or tracking technologies should only be activated where the required consent has been provided.
Lawful basis: Consent where required.
Fraud prevention and website security
We may process personal data to detect, prevent and investigate fraud, misuse, security incidents and other potentially unlawful activity and to protect our customers, website and business.
Lawful basis: Our legitimate interests in protecting our business, customers and systems and, where applicable, compliance with our legal obligations.
Legal and regulatory obligations
We may process and retain personal data where necessary to comply with our legal obligations, including accounting, taxation, consumer-protection and other applicable requirements.
Lawful basis: Compliance with a legal obligation.
5. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
Some cookies are strictly necessary for our website and Shopify store to function, for example to maintain your shopping basket, provide security or enable checkout.
Other technologies may be used for purposes including:
- analytics;
- measuring website performance;
- understanding how visitors use our website;
- product recommendations;
- advertising measurement; and
- personalised or targeted advertising.
Where required by Irish law, we ask for your consent before placing or accessing non-essential cookies or similar technologies on your device.
This includes technologies used for services such as Google Analytics and Meta/Facebook Pixel where consent is required.
You can choose whether to accept non-essential cookies through the cookie consent controls provided on our website. You can also change or withdraw your choices through the cookie/privacy settings available on the website.
Refusing non-essential cookies should not prevent you from making ordinary use of the essential shopping functions of our website, although certain optional features may work differently.
Further details about the individual cookies and technologies used, their purposes and durations should be available through our cookie settings or Cookie Policy.
6. Shopify
Our store is hosted on Shopify.
Shopify provides the ecommerce infrastructure that allows us to operate our website, process orders and provide our services.
Information you submit through our store may therefore be processed by Shopify in order to provide its services to us and, in certain circumstances, for Shopify's own purposes in accordance with its applicable privacy terms.
You can learn more about Shopify's processing of personal information through Shopify's Consumer Privacy Policy and privacy resources.
7. Other Service Providers
To operate our business and website, we use third-party service providers which may process personal data.
These include, where applicable:
- Shopify — ecommerce platform and related services;
- Shopify Email — email communications and marketing;
- Klaviyo — email marketing and related services;
- Marsello — marketing, loyalty and customer engagement;
- Judge.me — product reviews;
- Meta/Facebook — advertising, measurement and Meta Pixel;
- Google Analytics — website analytics;
- Smile.io — loyalty functionality;
- Wiser — product recommendations;
- Live chat services — customer support;
- EU Widerruf Button — functionality relating to cancellation/withdrawal requests;
- payment providers;
- delivery and fulfilment providers;
- IT, hosting and security providers; and
- professional advisers where necessary.
These organisations may act as processors acting on our instructions or, in some circumstances, as separate or joint controllers of personal data.
Their own privacy notices may also apply to processing they undertake independently.
8. When We Share Personal Data
We may disclose personal data where necessary:
- to operate our Shopify store;
- to process payments;
- to fulfil and deliver orders;
- to provide customer service;
- to administer reviews, loyalty services and other website functionality;
- to provide marketing where you have opted in;
- to provide analytics or advertising functionality where the required consent has been obtained;
- to protect our business against fraud or security threats;
- to comply with legal or regulatory requirements;
- to establish, exercise or defend legal claims; or
- in connection with a sale, restructuring or transfer of all or part of our business.
We do not sell your personal data in the ordinary meaning of the term.
9. International Transfers
Some of the service providers we use operate internationally, and use of those services may involve personal data being processed outside Ireland or the European Economic Area ("EEA").
Where personal data is transferred outside the EEA, we take steps to ensure that an appropriate transfer mechanism or safeguard applies where required by GDPR.
Depending on the destination and provider, this may include:
- a European Commission adequacy decision;
- the EU-US Data Privacy Framework where applicable to an eligible participating organisation;
- European Commission Standard Contractual Clauses; or
- another lawful transfer mechanism permitted under GDPR.
You may contact us if you would like further information about the safeguards applicable to transfers of your personal data.
10. How Long We Keep Your Personal Data
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting and regulatory requirements.
The applicable retention period depends on the type of information and why we hold it.
In general:
- Order and transaction records are retained for the period required to comply with applicable Irish tax, accounting and legal requirements.
- Customer account information is retained while the account remains active and afterwards where reasonably necessary for legal, security or record-keeping purposes.
- Marketing information is retained while you remain subscribed and as necessary afterwards to record your unsubscribe or withdrawal of consent so that we can respect your preference.
- Customer-service communications are retained for as long as reasonably necessary to deal with the enquiry and any related legal or customer-service requirements.
- Reviews may remain available while the relevant review service or product listing remains active, subject to applicable rights and legitimate retention requirements.
- Cookie and analytics information is retained according to the applicable cookie/service settings and retention periods.
We may retain certain information for longer where necessary to establish, exercise or defend legal claims, prevent fraud, resolve disputes or comply with a legal obligation.
11. Your GDPR Rights
Subject to the conditions and exceptions in applicable law, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate or incomplete personal data;
- request deletion of your personal data;
- restrict our processing of your personal data;
- object to certain processing based on legitimate interests;
- object at any time to direct marketing;
- receive certain personal data in a portable format and, where applicable, have it transmitted to another controller;
- withdraw your consent at any time where processing is based on consent; and
- lodge a complaint with a data protection supervisory authority.
These rights are not absolute and may be subject to conditions and exemptions under applicable law.
To exercise your rights, contact us at:
We may need to request information necessary to verify your identity before responding to a request.
We will respond within the timeframe required by applicable data protection law.
12. Marketing Choices
We only send our email marketing to people who have chosen to subscribe.
You can unsubscribe at any time by selecting the unsubscribe link in a marketing email or contacting us.
If you unsubscribe, we may retain a limited record of your email address and unsubscribe status to ensure that we respect your choice.
Unsubscribing from marketing does not prevent us from sending necessary service communications, such as order confirmations, delivery information, security messages or communications relating to a transaction you have made with us.
13. Children's Personal Data
Our website and services are intended for customers capable of entering into purchases in accordance with applicable law and are not directed at children.
We do not knowingly seek to collect personal data from children for marketing purposes.
If you believe a child has provided personal data to us in circumstances where it should not have been collected, please contact us.
14. Security
We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
You are responsible for keeping any account credentials associated with our website confidential.
15. Third-Party Websites
Our website may contain links to websites or services operated by third parties.
We are not responsible for the privacy practices of independent third-party websites. We recommend reviewing their privacy notices before providing personal data to them.
16. Complaints and the Irish Data Protection Commission
If you have a concern about how we process your personal data, we encourage you to contact us first so that we can try to resolve it.
You also have the right to lodge a complaint with the Data Protection Commission (DPC), Ireland's supervisory authority for data protection.
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
Website: www.dataprotection.ie
You may also have the right to complain to another competent supervisory authority, particularly in the EEA country where you live, work or believe an infringement has occurred.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or privacy practices.
When we make changes, we will publish the updated version on our website and update the "Last updated" date at the top of this Policy.
Where required by law, we will provide additional notice or obtain consent before materially changing how we use personal data.
18. Contact Us
For questions about this Privacy Policy, our privacy practices or your personal data, or to exercise your data protection rights, please contact:
Ohh! By Gum Ltd
The Courtyard
Station House
Clifden
Co. Galway
H71 Y668
Ireland
Email: ohhbygum@gmail.com
Telephone: +353 87 800 0377
For the purposes of applicable data protection law, Ohh! By Gum Ltd is the data controller for the personal data for which we determine the purposes and means of processing.
