Privacy Policy

Last updated: September 16, 2026

oakvessa (“oakvessa,” “we,” “us,” or “our”) operates https://oakvessa.com and the related online store, content, features, purchasing functions, and services (collectively, the “Services”).

Our ecommerce store is hosted by Shopify, which provides the ecommerce platform that enables us to offer the Services.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit or use the Services, place an order, create an account, subscribe to communications, contact us, or otherwise interact with oakvessa.

It also explains the privacy rights and choices that may be available to you under applicable law.

1. Personal Information We Collect

Depending on how you interact with the Services, we may collect the following categories of personal information.

Contact Information

This may include:

• Your name;

• Email address;

• Telephone number;

• Billing address; and

• Shipping address.

Order and Transaction Information

This may include:

• Products viewed or purchased;

• Shopping-cart activity;

• Order history;

• Purchase amounts;

• Discounts or promotions used;

• Returns;

• Refunds;

• Order status; and

• Communications relating to an order.

Payment-Related Information

Payments are processed through Shopify and authorized third-party payment providers.

oakvessa does not ordinarily receive or store complete payment-card numbers.

We may receive limited payment or transaction information necessary to:

• Confirm transactions;

• Prevent fraud;

• Process refunds; and

• Maintain legally required transaction or business records.

Account Information

If customer-account functionality is available, we may collect information such as:

• Account or login information;

• Saved addresses;

• Saved preferences;

• Order history; and

• Account activity.

Device and Usage Information

When you use the Services, we and our service providers may automatically collect information such as:

• IP address;

• Browser type;

• Device type;

• Operating system;

• Device identifiers;

• Cookie identifiers;

• Network information;

• General location derived from an IP address;

• Referring websites or pages;

• Pages viewed;

• Products viewed;

• Links clicked;

• Shopping-cart activity;

• Session information; and

• Other interactions with the Services.

Marketing and Preference Information

This may include:

• Newsletter subscriptions;

• Marketing preferences;

• Advertising preferences;

• Cookie choices;

• Privacy choices;

• Responses to promotions; and

• Interactions with marketing communications.

Communications and Customer-Service Information

We may collect information you voluntarily provide to us, including:

• Emails;

• Customer-service requests;

• Product reviews;

• Feedback;

• Photographs;

• Videos; and

• Other information you choose to provide.

2. How We Collect Personal Information

We may collect personal information in the following ways.

Directly From You

For example, when you:

• Place an order;

• Create an account;

• Enter billing or shipping information;

• Complete a form;

• Subscribe to marketing communications;

• Request a return or refund;

• Submit a review; or

• Contact customer support.

Automatically

We and our service providers may collect information automatically through technologies such as:

• Cookies;

• Pixels;

• Tags;

• Log files;

• Scripts;

• Local storage;

• Device identifiers; and

• Similar storage, access, or tracking technologies.

From Service Providers and Partners

We may receive information from third parties that help us operate the Services, including:

• Shopify;

• Payment processors;

• Fraud-prevention providers;

• Analytics providers;

• Advertising and marketing providers;

• Fulfilment providers;

• Warehouses;

• Delivery carriers;

• Returns providers; and

• Customer-service or technology providers.

3. How We Use Personal Information

We may use personal information to:

• Provide, maintain, and operate the Services;

• Process payments;

• Confirm and manage orders;

• Fulfil purchases;

• Arrange shipping and delivery;

• Provide tracking information;

• Process returns, replacements, and refunds;

• Provide customer support;

• Create and maintain customer accounts;

• Save customer preferences;

• Send transactional and service-related communications;

• Send order, delivery, security, account, and policy updates;

• Detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity;

• Protect our customers, website, systems, and business;

• Analyse how customers use the Services;

• Maintain and improve our website, products, services, and customer experience;

• Personalise content or product recommendations where permitted;

• Measure marketing and advertising performance;

• Provide or evaluate advertising where permitted by law;

• Send promotional communications in accordance with applicable law and your choices;

• Maintain business, accounting, tax, and transaction records;

• Comply with legal, regulatory, contractual, and law-enforcement obligations;

• Establish, exercise, or defend legal claims; and

• Enforce our Terms of Service and other policies.

We seek to collect and process personal information only where reasonably necessary and permitted by applicable law.

4. Legal Bases for Processing

Because oakvessa is based in Spain, the General Data Protection Regulation (“GDPR”) and applicable Spanish data-protection law may apply to our processing activities.

Where a lawful basis is required, we may rely on one or more of the following.

Performance of a Contract

We may process personal information where necessary to enter into or perform a contract with you, including to:

• Process an order;

• Accept payment;

• Fulfil a purchase;

• Arrange delivery;

• Provide customer support;

• Process a return; or

• Issue a refund.

Compliance With Legal Obligations

We may process information where necessary to comply with applicable obligations relating to:

• Tax;

• Accounting;

• Consumer protection;

• Fraud prevention;

• Regulatory requirements; or

• Valid legal or governmental requests.

Legitimate Interests

Where permitted by law, we may process personal information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and interests.

These interests may include:

• Operating and improving our business;

• Providing customer service;

• Protecting our website and systems;

• Preventing fraud;

• Understanding website performance;

• Maintaining appropriate business records; and

• Establishing, exercising, or protecting legal rights.

Consent

Where required by law, we may rely on your consent for activities including:

• Certain marketing communications;

• Non-essential cookies;

• Certain analytics technologies;

• Advertising technologies; and

• Other processing activities requiring consent.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing that was lawful before consent was withdrawn.

5. Cookies and Similar Technologies

oakvessa, Shopify, and other service providers may use cookies and similar technologies to:

• Operate the website;

• Maintain shopping-cart and checkout functionality;

• Authenticate accounts;

• Remember customer preferences;

• Protect against fraud;

• Understand website usage;

• Measure website performance;

• Analyse customer interactions;

• Measure marketing effectiveness;

• Personalise content where permitted; and

• Provide or evaluate advertising.

Some cookies and similar technologies are necessary for the Services to function.

Other technologies, including certain analytics, personalisation, and advertising technologies, may require your consent.

Where consent is required by applicable law, non-essential cookies or similar technologies will be used only after the applicable consent has been obtained.

Where required, available cookie controls should allow users to accept or reject relevant non-essential technologies.

You may manage available cookie choices through the cookie or privacy controls presented on https://oakvessa.com.

You may also manage certain cookies through your browser or device settings.

Blocking certain technologies may affect website functions including:

• Account access;

• Shopping carts;

• Personalisation; or

• Checkout.

6. Marketing Communications

If you subscribe to promotional emails or other marketing communications, you may unsubscribe at any time by using the unsubscribe option included in the communication.

You may also contact us to object to the use of your personal information for direct marketing.

Where consent is the lawful basis for marketing, you may withdraw that consent at any time.

Opting out of marketing does not prevent us from sending necessary non-promotional communications relating to:

• Orders;

• Payments;

• Shipping;

• Returns;

• Refunds;

• Accounts;

• Security; or

• Customer-service requests.

7. Advertising and Privacy Choices

We may work with advertising, analytics, and marketing providers to understand customer interactions, measure advertising performance, attribute conversions, personalise marketing, or provide advertising where permitted by applicable law.

These activities may involve information such as:

• Cookies;

• Pixels;

• Device identifiers;

• IP addresses;

• Browsing activity;

• Product interactions; and

• Shopping-cart or purchase activity.

oakvessa does not exchange personal information for money.

However, certain privacy laws may classify some disclosures involving advertising technologies as a “sale,” “sharing,” or use for targeted advertising even when no money is exchanged.

Where an applicable law gives you an opt-out right, you may exercise that right using any applicable privacy controls made available through https://oakvessa.com or by contacting:

giczewskicreekmore5379@hotmail.com

Where required by applicable law and supported by our website configuration, qualifying browser-based privacy preference signals, such as Global Privacy Control, may also be processed in accordance with applicable requirements.

8. How We Disclose Personal Information

We may disclose personal information where reasonably necessary to the following categories of recipients.

Shopify

Shopify hosts and supports our ecommerce store and processes personal information in connection with providing ecommerce and related services.

Payment and Financial-Service Providers

We may disclose necessary information to:

• Payment processors;

• Banks;

• Financial-service providers; and

• Fraud-prevention providers

for purposes including payment authorization, transaction processing, refunds, verification, and fraud prevention.

Fulfilment and Delivery Providers

We may provide necessary customer and order information to:

• Fulfilment providers;

• Warehouses;

• Logistics providers;

• Delivery carriers; and

• Returns providers.

Technology and Business-Service Providers

We may use service providers supporting:

• Website functionality;

• Information technology;

• Cloud infrastructure;

• Data storage;

• Customer support;

• Email delivery;

• Analytics;

• Security; and

• Fraud prevention.

Advertising and Marketing Providers

Subject to applicable law and your privacy choices, we may disclose certain information to advertising, analytics, or marketing providers for:

• Measurement;

• Attribution;

• Personalisation; or

• Advertising.

Professional Advisers

We may disclose information where reasonably necessary to:

• Lawyers;

• Accountants;

• Auditors;

• Insurers; and

• Other professional advisers.

Government and Legal Authorities

We may disclose information to courts, regulators, government authorities, law-enforcement agencies, or other authorized parties where:

• Required by applicable law;

• Required by valid legal process;

• Necessary to investigate fraud or unlawful activity;

• Necessary to establish or protect legal rights; or

• Necessary to protect the rights or safety of customers or others.

Business Transactions

If oakvessa is involved in a merger, acquisition, financing, restructuring, sale of assets, transfer of business, or similar transaction, relevant personal information may be disclosed to prospective or actual purchasers, advisers, or successors, subject to appropriate safeguards.

9. Shopify

Our ecommerce store is powered by Shopify.

Shopify processes personal information in connection with providing ecommerce technology and related services to oakvessa.

Depending on the Shopify service involved, Shopify may process certain information on behalf of oakvessa and may also process certain information for purposes described in Shopify's own privacy notices.

Customers who use Shopify consumer services such as Shop or Shop Pay may also have a direct relationship with Shopify and may have separate privacy rights and choices concerning information processed directly by Shopify.

We encourage customers to review Shopify's applicable privacy notices for additional information about Shopify's processing practices.

10. International Data Transfers

oakvessa is based in Spain.

Shopify and other service providers may process, store, or access personal information in countries outside Spain or the European Economic Area (“EEA”).

Where GDPR rules governing international transfers apply, we will use or rely on an appropriate lawful transfer mechanism.

Depending on the circumstances, this may include:

• An adequacy decision adopted by the European Commission;

• Standard Contractual Clauses approved by the European Commission;

• Binding corporate rules where applicable;

• Appropriate supplementary safeguards where required; or

• Another lawful transfer mechanism permitted by applicable data-protection law.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and as required or permitted by applicable law.

The appropriate retention period may depend on:

• The type of personal information;

• The purpose for which it was collected;

• The duration of our relationship with you;

• Whether an account remains active;

• Tax and accounting obligations;

• Transaction-record requirements;

• Return and warranty periods;

• Fraud-prevention requirements;

• Legal or regulatory obligations;

• Dispute resolution; and

• The need to establish, exercise, or defend legal claims.

When information is no longer reasonably required, we may delete, anonymise, aggregate, or securely dispose of it, subject to applicable legal requirements.

12. Security

We use reasonable administrative, organisational, and technical safeguards designed to protect personal information against:

• Unauthorized access;

• Unauthorized disclosure;

• Loss;

• Misuse;

• Alteration; and

• Destruction.

However, no website, network, internet transmission, database, or electronic storage system can be guaranteed to be completely secure.

Customers are responsible for protecting their passwords, account credentials, and authentication information.

If you believe your account or personal information has been compromised in connection with oakvessa, please contact us promptly.

13. Your GDPR and European Privacy Rights

Where the GDPR applies, you may have rights concerning your personal information, including:

Right to Be Informed

You have the right to receive information about how and why your personal information is processed.

Right of Access

You may request confirmation of whether we process your personal information and request access to relevant information.

Right to Rectification

You may request correction of inaccurate or incomplete personal information.

Right to Erasure

In certain circumstances, you may request deletion of your personal information.

This right is subject to applicable legal exceptions, including circumstances where information must be retained to comply with legal obligations or establish, exercise, or defend legal claims.

Right to Restriction of Processing

In certain circumstances, you may request that processing of your personal information be restricted.

Right to Data Portability

Where applicable, you may request certain personal information in a structured, commonly used, machine-readable format and, where legally and technically possible, request its transfer to another controller.

Right to Object

You may object to certain processing based on legitimate interests.

You may also object at any time to processing of your personal information for direct-marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights relating to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

14. How to Exercise Your Privacy Rights

To exercise an applicable privacy right, please contact:

Email: giczewskicreekmore5379@hotmail.com

Where possible, use the subject line:

Privacy Request

Please describe your request and provide enough information for us to identify the relevant records.

We may request additional information where reasonably necessary to verify your identity and protect personal information against unauthorized disclosure.

We will respond within the period required by applicable law.

Where the GDPR applies, requests will generally be addressed without undue delay and within one month, subject to any legally permitted extension based on the complexity or number of requests.

Applicable privacy rights are generally available without charge, although applicable law may permit reasonable measures where requests are manifestly unfounded or excessive.

Where permitted by law, an authorized representative may submit a request on your behalf, although we may require appropriate evidence of authorization and identity verification.

15. Privacy Rights Outside the EEA

Customers located outside Spain or the EEA may have additional privacy rights under applicable local law.

Depending on your jurisdiction, these rights may include:

• Accessing personal information;

• Correcting inaccurate personal information;

• Requesting deletion;

• Obtaining a portable copy of certain information;

• Opting out of direct marketing;

• Opting out of targeted advertising;

• Opting out of processing treated as a sale or sharing;

• Limiting certain uses of sensitive personal information;

• Appealing certain privacy-request decisions; and

• Exercising applicable privacy rights without unlawful discrimination.

These rights apply only where the relevant law applies to oakvessa and the particular processing activity.

Requests may be submitted using the contact information in Section 14.

16. Children's Privacy

The Services are intended for a general shopping audience and are not specifically directed toward children.

We do not knowingly collect or process children's personal information in circumstances prohibited by applicable law.

Where parental authorization or another lawful basis is required for processing a child's personal information, we will comply with applicable legal requirements.

If you believe that a child has provided personal information to us inappropriately or unlawfully, please contact us so that we can review the matter and take appropriate action.

17. Third-Party Websites and Services

The Services may contain links to websites, applications, platforms, or services operated by independent third parties.

Their privacy and security practices are governed by their own policies.

oakvessa does not control and is not responsible for the privacy practices of independent third parties.

We encourage you to review the applicable privacy notice before providing personal information directly to an independent third party.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• Our operations;

• Our Services;

• Technology;

• Service providers;

• Privacy practices;

• Advertising practices; or

• Legal and regulatory requirements.

When this Policy is updated, we will publish the revised version on https://oakvessa.com and update the “Last updated” date.

Where applicable law requires additional notice or consent for a material change, we will provide such notice or obtain consent as required.

19. Complaints

If you have a question or concern about how oakvessa handles your personal information, please contact us so that we can review the matter.

Where Spanish or EU data-protection law applies, you may also have the right to lodge a complaint with the competent supervisory authority.

In Spain, the competent supervisory authority is:

Agencia Española de Protección de Datos (AEPD)
Spanish Data Protection Agency

You may also have the right to lodge a complaint with another competent supervisory authority where applicable law permits.

Contacting oakvessa first does not prevent you from exercising your right to contact an applicable supervisory authority.

20. Contact Us

oakvessa is responsible for personal information under its control where oakvessa acts as the applicable data controller.

For privacy questions, requests, or complaints, please contact:

Privacy Contact — oakvessa

Website: https://oakvessa.com
Email: giczewskicreekmore5379@hotmail.com
Phone: +34 687 86 78 65
Business Address:
Calle Roger de Lluria, 58
08009 Barcelona
Spain