Your UK GDPR Rights

Last updated: June 21, 2026 · Applies to UK residents

Scope

This notice supplements our Privacy Policy and explains the data protection rights available to individuals in the United Kingdom under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Oshop Ltd. (“Oshop247”, “we”, “us”) is committed to handling personal data lawfully, fairly, and transparently. This page explains your rights and how to exercise them.

Controller & processor roles

Depending on how you interact with Oshop247, different roles apply:

• Merchants & website users — Oshop247 is the data controller for platform account, billing, support, and security data relating to your use of oshop247.com and admin tools.
• Store customers — the merchant whose store you buy from is the controller for your order and customer relationship data. Oshop247 processes that data on the merchant’s behalf as a processor.

If your request relates to a purchase on a merchant storefront, contact the merchant first. We will assist merchants in responding where we process data on their behalf.

Your data protection rights

Subject to applicable exceptions, UK residents have the following rights:

• Right of access — obtain confirmation of whether we process your personal data and receive a copy of that data, together with information about how it is used.
• Right to rectification — request correction of inaccurate personal data or completion of incomplete data.
• Right to erasure — request deletion of personal data where there is no compelling reason for continued processing (sometimes called the “right to be forgotten”).
• Right to restrict processing — request that we limit how we use your data in certain circumstances (for example, while a dispute about accuracy is resolved).
• Right to data portability — receive personal data you provided to us in a structured, commonly used, machine-readable format, or have it transmitted to another controller where technically feasible.
• Right to object — object to processing based on legitimate interests or for direct marketing. We will stop marketing communications when you object.
• Rights related to automated decision-making — not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, where those apply.
• Right to withdraw consent — where processing is based on consent, withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Lawful bases for processing

We process personal data under UK GDPR only where we have a valid lawful basis, such as:

• Contract — to provide the Oshop247 platform and services you signed up for
• Legitimate interests — security, fraud prevention, product improvement, and business operations (balanced against your rights)
• Legal obligation — tax, accounting, and regulatory requirements
• Consent — optional marketing cookies and certain marketing communications

See our Privacy Policy and Cookie Policy for more detail.

International transfers

Oshop247 is operated from Nigeria. If you are in the UK, your data may be transferred to and processed in Nigeria or other countries where our infrastructure and service providers operate. Where required, we implement appropriate safeguards such as standard contractual clauses or equivalent mechanisms recognised under UK data protection law.

How to exercise your rights

You may submit a request by email or using the form below. We may need to verify your identity before responding, especially for access or deletion requests involving account data.

Deletion request

Use this form to request erasure of personal data we control as a data controller:

Access, rectification & other requests

For access copies, corrections, portability exports, or objections, email [email protected] with the subject line “UK GDPR Request” and describe your request. Include enough information for us to locate your data.

Merchants can export much of their store data from the admin dashboard. Account holders may also update profile details directly in admin settings.

Response times

We aim to respond to valid requests within one calendar month of receipt. Complex requests may take up to an additional two months; if so, we will inform you within the first month and explain why an extension is needed.

There is no fee for most requests. We may charge a reasonable fee or refuse manifestly unfounded or excessive requests as permitted by UK GDPR.

Right to complain

If you are unhappy with how we handle your personal data or a rights request, please contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the UK supervisory authority:

• Information Commissioner’s Office (ICO) — ico.org.uk/make-a-complaint

Contact