Privacy policy

Last updated: July 8, 2026

This Privacy Policy explains how Omtilo collects, uses, stores and shares personal information when you visit our website, place an order, create an account, contact us, subscribe to email marketing, or otherwise use our services.

Omtilo operates this online store. In this Privacy Policy, “Omtilo”, “we”, “us” and “our” refer to the business operating the Omtilo store.

For the purposes of applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Omtilo is the data controller of your personal information.

1. Contact details

Trade name: Omtilo
Enterprise number: 1039897606
VAT number: BE1039897606
Address: Meerstraat 83, 3300 Tienen, Belgium
Customer support: care@omtilo.com
Privacy and GDPR requests: gdpr@omtilo.com

2. Personal information we collect

Depending on how you interact with our website and services, we may collect or process the following personal information.

Contact and order details

This may include your name, email address, billing address, shipping address, phone number where provided or required for delivery, order details, delivery information and customer account details.

Payment and transaction information

Payments are processed through our payment providers and ecommerce infrastructure. Omtilo does not normally receive or store your full payment card details. We may receive payment status, transaction references, refund information and limited payment information needed to process your order, handle refunds, prevent fraud and meet accounting obligations.

Account information

If you create an account, we may process your login details, account preferences, saved addresses, order history and account settings.

Communications with us

When you contact us, we may process the information you provide, such as your name, email address, order number, question, complaint, return request or other customer support information.

Website, device and usage information

When you visit our website, we may collect information such as your IP address, device information, browser type, approximate location, cookie identifiers, pages viewed, products viewed, cart activity and interactions with our website.

Some of this information is collected through cookies and similar technologies. More information is available in our Cookie Policy.

Email marketing information

If you subscribe to our email marketing, we may process your email address, subscription status, marketing preferences and interactions with our emails, such as opens and clicks where enabled.

We currently use email as our only direct marketing channel.

3. How we collect personal information

We may collect personal information:

directly from you, for example when you place an order, create an account, subscribe to emails or contact us;
automatically when you visit or use our website, including through cookies and similar technologies;
from service providers that help us operate our store, process orders, deliver products, prevent fraud, send emails, provide analytics or support our website.

4. Why we use your personal information

We only process personal information when we have a valid legal basis to do so.

Purpose	Examples of personal information used	Legal basis
Processing and delivering orders	name, email, billing address, shipping address, order details, delivery details, payment status	Performance of a contract
Processing payments and refunds	transaction details, payment status, refund details, limited payment information	Performance of a contract; legal obligation
Providing customer support	contact details, order details, communication history	Performance of a contract; legitimate interests
Managing customer accounts	account details, saved addresses, order history, preferences	Performance of a contract; legitimate interests
Handling returns, complaints or disputes	order details, return details, communication history	Performance of a contract; legal obligation; legitimate interests
Meeting accounting, tax, VAT and OSS obligations	invoice data, order data, transaction records, VAT-relevant information	Legal obligation
Securing our website and preventing fraud	IP address, device data, order data, account activity, fraud indicators	Legitimate interests; legal obligation where applicable
Improving our website and services	website usage, product views, cart activity, analytics data	Legitimate interests or consent, depending on the technology used
Sending email marketing	email address, subscription status, email preferences	Consent, or where legally permitted, legitimate interests
Using non-essential cookies, pixels or similar technologies	cookie identifiers, device data, browsing activity, analytics or marketing data	Consent, where required by law
Establishing, exercising or defending legal claims	order details, transaction information, communication history	Legitimate interests; legal obligation

Our legitimate interests include operating, securing and improving our store, preventing fraud, responding to customer requests and protecting our legal rights.

5. Service providers

We use trusted service providers to operate our store and provide our services. These may include:

ecommerce platform providers, including Shopify;
payment processors and fraud prevention providers;
shipping, fulfilment and logistics providers;
email marketing providers;
customer support tools;
analytics providers;
cookie consent tools;
accounting, tax, legal and professional advisers;
IT, hosting, cloud and security providers.

These service providers may process personal information only where necessary to provide their services to us, comply with legal obligations, prevent fraud, secure our website or support our business operations.

6. Cookies and similar technologies

We use cookies and similar technologies to operate our website, remember your preferences, support checkout, understand how visitors use our website and improve our services.

Some cookies are necessary for the website to function. Other cookies, such as analytics or advertising cookies, will only be used where legally permitted and, where required, after you have given consent.

You can manage your cookie preferences through our cookie banner or cookie settings, where available. More information is provided in our Cookie Policy.

7. Email marketing

If you subscribe to our email marketing, we may send you emails about Omtilo products, launches, offers, skincare content and related updates.

You can unsubscribe at any time by clicking the unsubscribe link in our emails or by contacting us at care@omtilo.com.

If you unsubscribe from marketing emails, we may still send you non-marketing emails, such as order confirmations, delivery updates, customer service messages, return updates or legally required notices.

8. Who we share personal information with

We may share personal information with trusted third parties where necessary to operate our store, provide our services, comply with the law or protect our rights.

These third parties may include:

service providers listed in this Privacy Policy;
public authorities, regulators, courts or law enforcement where required by law;
professional advisers where necessary for accounting, tax, legal or business purposes;
third parties involved in a business transfer, restructuring, merger, sale or legal reorganisation, where permitted by law.

We only share personal information where necessary and where we have a valid legal basis to do so.

9. International transfers

Some of our service providers may process personal information outside the European Economic Area.

Where personal information is transferred outside the European Economic Area, we rely on appropriate safeguards where required by law, such as adequacy decisions, the European Commission’s Standard Contractual Clauses or other legally recognised transfer mechanisms.

10. How long we keep personal information

We keep personal information only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

In general:

customer account information is kept for as long as the account remains active and for a reasonable period afterwards where needed;
order, invoice and transaction information is kept for as long as required for accounting, tax, VAT, warranty, returns and legal obligations;
OSS/VAT ecommerce records may be kept for up to 10 years from the end of the year in which the relevant transaction took place, where required;
customer support communications are kept for as long as necessary to handle your request and for a reasonable period afterwards in case of follow-up questions, complaints or legal claims;
email marketing data is kept until you unsubscribe or withdraw your consent, unless we need to keep limited information to record your opt-out;
cookie and analytics data is kept as described in our Cookie Policy or cookie settings;
fraud prevention and security records are kept for as long as reasonably necessary to protect our store, customers and legal rights.

When personal information is no longer needed, we will delete it, anonymise it or securely retain it only where legally required.

11. Your rights

Subject to the conditions and limits set out in applicable law, you may have the following rights in relation to your personal information:

the right to access the personal information we hold about you;
the right to correct inaccurate or incomplete personal information;
the right to request deletion of your personal information;
the right to restrict our processing of your personal information;
the right to object to certain processing, including processing based on legitimate interests and direct marketing;
the right to withdraw consent where we rely on consent;
the right to receive your personal information in a portable format where applicable;
the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or similarly significant effects.

Omtilo does not make decisions based solely on automated processing that produce legal effects or similarly significant effects for customers.

To exercise your rights, please contact us at gdpr@omtilo.com.

We may need to verify your identity before responding to your request. We will respond within the time limits required by applicable law.

Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

12. Complaints

If you have a question or complaint about how we process your personal information, please contact us first at gdpr@omtilo.com so we can try to resolve the issue.

You also have the right to lodge a complaint with a data protection authority.

For Belgium, the competent authority is the Belgian Data Protection Authority:

Belgian Data Protection Authority / Gegevensbeschermingsautoriteit / Autorité de protection des données
Rue de la Presse 35
1000 Brussels
Belgium
Website: www.dataprotectionauthority.be

13. Children

Our website and services are not intended for children. We do not knowingly collect personal information from children under the age of majority in their country of residence.

If you believe that a child has provided us with personal information, please contact us at gdpr@omtilo.com.

14. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of transmission over the internet or electronic storage is completely secure. Please avoid sending sensitive or confidential information through unsecured channels.

15. Third-party websites

Our website may contain links to third-party websites, platforms or services. We are not responsible for the privacy practices, security or content of third-party websites. Please review their privacy policies before providing personal information to them.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our business, services, technology, legal obligations or website setup.

The updated version will be posted on this page with a new “Last updated” date. Where required by law, we will provide additional notice.