Privacy policy

Privacy Policy

Last updated: 4 July 2026

ODA Travel is operated by Hmarketing.
Paxtonstraat 3 N, Box A3968, 8013 RP Zwolle, The Netherlands
Chamber of Commerce (KvK): 81002246 · VAT: NL003515174B57
Email: support@oda-travel.com

Hmarketing is the data controller for the personal data processed via oda-travel.com. We handle your data in accordance with the General Data Protection Regulation (GDPR). This policy explains what we collect, why, and which rights you have.

What data we collect

  • Order data: name, delivery address, email address, phone number and the items you order, to fulfil and deliver your order and to send order and shipping confirmations.
  • Payment data: payments are processed by Shopify Payments and your chosen payment provider over an encrypted connection. We never see or store your full card details.
  • Customer service data: emails and messages you send us, so we can help you with questions, returns and warranty claims.
  • Newsletter data: your email address, only if you subscribe yourself. Every email contains an unsubscribe link.
  • Website data: device and browsing data via cookies and similar techniques. See our Cookie Policy for details and choices.

Legal basis for processing (GDPR Article 6)

  • Contract: processing and delivering your order, handling returns and warranty.
  • Consent: newsletter and marketing cookies. You can withdraw consent at any time.
  • Legal obligation: tax and accounting rules require us to keep order records.
  • Legitimate interest: improving our store, preventing fraud and securing our systems.

Who we share data with

Only with parties needed to run our store: Shopify (our e-commerce platform and payment processing), our shipping and fulfilment partners (to deliver your parcel), and our email service provider (order confirmations and, with consent, newsletters). These parties process data on our behalf under data processing agreements. We never sell your personal data.

Named service providers
The following is a specific list of the tools and platforms we use that process personal data on our behalf. Each is bound to handle your data only on our instructions and in accordance with applicable law:

Platform and payments

  • Shopify Inc. (Canada / USA) — e-commerce platform, order management, checkout, customer accounts, and Shopify Payments. Privacy policy: shopify.com/legal/privacy.
  • Payment gateways — PayPal, Apple Pay, Google Pay, Shop Pay, Klarna, and other methods shown at checkout. Each gateway processes only what is necessary to authorise and settle your payment.

Email and marketing

  • Klaviyo Inc. (USA) — email marketing, transactional emails, customer segmentation, and behavioural triggers. Data transferred to the USA under Standard Contractual Clauses. Privacy policy: klaviyo.com/legal/privacy.

Analytics and user behaviour

  • Google Analytics / Google Tag Manager (Google LLC, USA) — website traffic analysis and conversion measurement. Data transferred to the USA under the EU–US Data Privacy Framework. Privacy policy: policies.google.com/privacy.
  • Wetracked — cookieless analytics and attribution; collects aggregated page views and conversion events without storing personal identifiers in cookies.

Order tracking and logistics

  • ParcelPanel (China / USA) — shipment tracking portal; receives your order number and email address to send you tracking updates after dispatch. Privacy policy: parcelpanel.com/privacy-policy.

Reviews and user-generated content

  • Okendo (Australia / USA) — customer review platform; receives your name, email address, order reference, and any photos or text you submit with a review. Data stored on Okendo's platform. Privacy policy: okendo.io/privacy-policy.
  • Trustpilot A/S (Denmark) — review invitations; we may share your email address with Trustpilot to send you a review invitation after your order. Privacy policy: legal.trustpilot.com/for-reviewers/end-user-privacy-terms.

Translations

  • T-Lab AI Language Translate — client-side translation of storefront text based on your browser language; stores your locale preference in a cookie on your device.

Legal and compliance

  • Professional advisers — accountants, lawyers, and auditors, bound by confidentiality obligations.
  • Public authorities — tax authorities, law enforcement, and courts, where we are legally required to disclose information.

International transfers

Some of our service providers, such as Shopify, may process data outside the European Economic Area. Where that happens, transfers are protected by recognised safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

Security

All traffic on our store runs over an encrypted SSL connection. Access to personal data is limited to the people who need it to help you, and payment data is handled exclusively by certified payment providers.

Data retention period

We keep order data for 7 years to meet legal accounting requirements. Newsletter data is kept until you unsubscribe. Other data is kept no longer than necessary for the purpose it was collected for.

Minors

Our store is not aimed at children under 16. We do not knowingly collect data from minors; if you believe a minor has provided us with personal data, contact us and we will delete it.

Your rights as a data subject

Under the GDPR you have the following rights: right of access, right to rectification, right to erasure (right to be forgotten), right to restriction of processing, right to data portability, right to object, and the right to withdraw consent at any time where processing is based on consent. Email support@oda-travel.com and we will respond within 30 days. You can also file a complaint with your data protection authority: the Autoriteit Persoonsgegevens (Netherlands) or the Data Protection Commission (Ireland).

Data Protection Officer

Hmarketing does not process personal data on a scale that requires the appointment of a Data Protection Officer (DPO) under GDPR Article 37. For any privacy-related questions, contact our privacy team at support@oda-travel.com and we will respond within 30 days.

Changes to this policy

We may update this policy from time to time, for example when our services change. The most recent version is always available on this page.

United States residents - your additional rights

This section applies if you are a resident of the United States and supplements the information above. Where it conflicts with the sections above, this section prevails for residents of the states listed below.

Categories of personal information we collect

In the twelve months preceding the date of this policy we collect the following categories of personal information, as defined by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

  • Identifiers: name, postal address, email address, phone number, IP address, order number and account identifiers. Collected from you directly and from your use of our store. Purpose: fulfilling and delivering your order, customer service, fraud prevention.
  • Commercial information: products purchased, considered, or placed in your cart, and transaction history. Purpose: processing orders, returns and warranty claims.
  • Internet or other electronic network activity: pages viewed, referring site, session duration and interaction with our emails. Purpose: operating, securing and improving our store.
  • Geolocation data: approximate location derived from your IP address. Purpose: showing the correct currency, shipping options and tax.
  • Inferences: preferences and product interests derived from the above. Purpose: personalising the store experience and, with your consent, marketing.

We do not collect sensitive personal information as defined under the CPRA, and we do not use or disclose personal information for purposes other than those listed above. We retain each category for the periods described under "Data retention period" above.

We do not sell your personal information

We do not sell personal information, and we have not sold personal information in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16 years of age.

We may "share" personal information for cross-context behavioural advertising only where you have given consent through our cookie banner, within the meaning of the CPRA. You can withdraw that consent at any time via the cookie banner on our store, or by emailing us. We honour Global Privacy Control (GPC) signals transmitted by your browser as a valid opt-out request.

Your rights

Depending on your state of residence, you may have the right to:

  • Know and access the specific pieces and categories of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom it was disclosed.
  • Delete the personal information we hold about you, subject to legal exceptions such as completing a transaction or meeting accounting obligations.
  • Correct inaccurate personal information we hold about you.
  • Opt out of the sale or sharing of personal information and of targeted advertising.
  • Portability - receive a copy of your personal information in a portable format.
  • Non-discrimination - we will not deny you goods or services, charge you a different price, or provide a different level of quality because you exercised any of these rights.
  • Appeal - if we decline your request, residents of Virginia, Colorado, Connecticut, Montana, Texas, Oregon and certain other states may appeal that decision by replying to our response. We will inform you of the outcome and, if the appeal is denied, how to contact your state Attorney General.

These rights are available to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland and Indiana, in each case as and when the relevant state privacy law is in effect, and subject to the exceptions in that law.

How to exercise your rights

Email support@oda-travel.com with the subject line "US Privacy Request" and tell us which right you wish to exercise and your state of residence. To protect your information, we will verify your identity by asking you to confirm details associated with your order or account. We will not request more information than is necessary to verify you. We respond within 45 days and may extend this once by a further 45 days where reasonably necessary, in which case we will notify you.

An authorised agent may submit a request on your behalf by providing written permission signed by you, together with proof of their own identity. We may still contact you directly to confirm the authorisation.

California Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

Children's privacy (COPPA)

Our store is not directed to children and we do not knowingly collect personal information from children under 13 years of age. If you believe a child under 13 has provided us with personal information, contact support@oda-travel.com and we will delete it promptly.

Notice of financial incentive

Where we offer a discount in exchange for subscribing to our newsletter, this may constitute a financial incentive under the CCPA. The personal information collected is your email address. We estimate the value of this data to be reasonably related to the value of the offer provided to you, calculated by reference to the expense of our marketing programme. Participation is entirely voluntary and you may withdraw at any time via the unsubscribe link in any email.

Processing location

If you are located in the United States, your personal information may be transferred to and processed in the European Economic Area, where our company is established. By placing an order you acknowledge this transfer.