Privacy policy


Last updated: 11 October 2026

OTRY offers carefully selected natural cotton and wool textiles for babies, children and families. This policy explains how personal information is handled when you visit otry.com.cy, shop with us, use a customer account, subscribe to our newsletter or contact us.

1. Who is responsible for your information?

OTRY is operated by Britcol Ltd, which is the data controller responsible for the personal information described in this policy. We currently sell and deliver within Cyprus.

For privacy enquiries or requests, email info@otry.com.cy. Our business contact information is available at https://otry.com.cy/policies/contact-information.

This notice provides information about our practices. Visiting our website does not, by itself, constitute consent to marketing or optional tracking.

2. The information we handle

Depending on how you interact with OTRY, we handle:

  • Contact and delivery information: your name, email, telephone number, billing address, delivery address and chosen delivery or collection arrangements.
  • Order and transaction information: products purchased, amounts paid, payment status and references, deliveries, refunds, returns and related correspondence.
  • Account information: email address, account identifier, preferences, authentication information and order history.
  • Communications: details you provide through our contact form, email or other customer service channels.
  • Marketing preferences: newsletter subscription details, consent records and unsubscribe preferences.
  • Technical and browsing information: IP address, device and browser information, session identifiers, pages visited and interactions with the store. Optional tracking depends on your consent choices where required.

Payments are processed through Shopify Payments. Available methods currently include Visa, Mastercard, Maestro, Apple Pay and Google Pay. The payment service and any wallet provider process information necessary to authorise and complete your chosen payment. OTRY receives the transaction information needed to administer your purchase. Please do not send card numbers or security codes to us by email.

We receive information directly from you, through Shopify and our connected service providers, and through cookies or similar technologies. If you choose a third-party sign-in service, we also receive the authorised account information from that provider.

If someone buys a gift for you or specifies you as the recipient, we receive your delivery details from that purchaser and use them to arrange delivery and handle related service enquiries.

3. Why we use information and our legal grounds

Purpose

Legal ground

Process orders, arrange payments and deliveries, handle returns and provide order updates

Performance of our contract with you

Provide the customer account and sign-in service you request

Performance of the account service contract

Answer questions before a purchase

Steps you request before entering a contract

Resolve order enquiries and complaints

Performance of our contract; our legitimate interest in effective customer support for other enquiries

Maintain records required for tax, accounting or other legal obligations

Compliance with legal obligations

Contact purchasers about product recalls or safety warnings where required

Compliance with legal obligations

Protect the website, prevent fraud, investigate misuse and establish or defend claims

Our legitimate interests in security, preventing loss and protecting legal rights

Send newsletters or promotional messages

Consent

Use non-essential analytics, advertising or personalisation technologies

Consent where required

Maintain a limited unsubscribe record

Our legitimate interest in respecting your marketing choices

Where we rely on legitimate interests, we consider the necessity of the processing and its impact on your rights. You may object as described below.

We need relevant contact, delivery and transaction details to process and deliver an order. Without them, we may be unable to fulfil your purchase. Newsletter subscriptions and optional tracking consent are not conditions of purchase.

4. Customer accounts and social sign-in

You can sign in using an email verification code or Google. Email verification uses your email address and authentication information to verify access to your account. Facebook sign-in may be added in the future; the explanation below applies to it only if it becomes available and you choose to use it. We receive the basic information authorised for sign-in, such as your provider account identifier, email address, name and, where supplied, profile image. We use it to authenticate you and create or link your OTRY customer account.

Basic social sign-in does not give OTRY your Google or Facebook password or access to private messages, email inboxes, contacts or files. Signing in does not automatically subscribe you to our newsletter.

You can manage or revoke an app connection through the provider's account settings. Revoking that connection does not itself delete your OTRY account or order records. To request deletion, contact info@otry.com.cy. Records required for legal obligations or claims may still need to be retained.

The sign-in provider also processes information under its own policy:

5. Newsletters and promotional communications

Our current communications are service messages, such as order and payment confirmations. If we introduce newsletters or promotional emails and you choose to subscribe, we will use your email and subscription preferences to send news about OTRY products and offers. You can unsubscribe at any time using the link in a marketing email or by contacting us.

We keep order confirmations, delivery updates, recall communications and other necessary service messages separate from marketing. Unsubscribing from marketing does not prevent those necessary messages.

We plan to use Google Analytics, Google Ads and Meta/Facebook Pixel. Where enabled, these services help measure visits and advertising results and support remarketing, including showing OTRY adverts to people who previously visited the store. Depending on the configuration, they may receive device identifiers, IP addresses, pages viewed, product interactions and purchase or conversion events. Optional tracking and personalised advertising are subject to your consent where required.

We do not upload customer email lists to Google or Meta for audience matching. This is separate from information that enabled tracking tools may transmit when you consent. Google and Meta also process information under their own notices:

6. Cookies and similar technologies

Our store uses cookies and related technologies for functions such as the basket, checkout, authentication, security and remembering necessary settings.

Non-essential analytics, advertising and personalisation technologies, where used, require your consent where applicable. You may refuse optional technologies without losing the ability to shop. Your choices can be changed through Terms and Policies → Cookie preferences in the website footer.

The optional providers and purposes are described in sections 5 and 8. Cookie lifetimes vary by technology and configuration: session cookies expire when the session ends, while persistent cookies remain until their expiry or earlier deletion. Contact info@otry.com.cy for information about specific technologies and their current durations. Browser settings can also restrict or delete cookies, although blocking necessary cookies may affect store functions. Refusing optional cookies does not prevent necessary security or transaction processing.

7. Who we share information with

We share relevant information with:

  • Shopify: to host and operate the store, support checkout and customer accounts, and provide related commerce services.
  • Shopify Payments and relevant payment/wallet providers: to process your selected payment method, refunds and payment-security checks.
  • The courier or delivery provider appointed for your order: we share the contact, address and parcel information necessary to arrange delivery, collection and delivery notifications.
  • Our business email and other operational service providers: to receive and respond to enquiries and support necessary store communications. Newsletter providers receive relevant information only if that service is introduced and used.
  • Optional analytics, advertising or social sign-in providers: where those features are enabled and subject to your choices and the applicable legal ground.
  • Professional advisers and competent authorities: where necessary for accounting, legal obligations, fraud investigations or legal claims.

We limit disclosures to information appropriate for the relevant purpose. Providers may act under our instructions or as independent controllers for aspects of their own services. Their notices explain their independent processing.

If OTRY undergoes a sale, restructuring or transfer of its business, relevant information may be disclosed where necessary and lawful, subject to appropriate confidentiality and data-protection safeguards.

8. Shopify's role

Shopify processes personal information to provide the commerce platform supporting OTRY. Some services involve Shopify processing information as a controller for its own purposes.

Shopify Network Intelligence is enabled for our store. For related enhanced services, Shopify may use information about your interactions with OTRY together with information about interactions with other merchants and Shopify to support services such as personalisation, improvements and advertising. Shopify is responsible for this processing, including relevant rights requests. Personalised advertising based on activity with OTRY, other merchants and Shopify requires consent where applicable. You can withdraw consent using the cookie-preferences control and exercise relevant rights through Shopify’s Privacy Portal below.

For information about Shopify's practices and available rights, see:

9. Processing outside Cyprus and the EEA

Shopify and other service providers may process information in countries outside Cyprus and the European Economic Area.

Where GDPR transfer restrictions apply, transfers must be supported by an applicable adequacy decision or appropriate safeguards, such as European Commission Standard Contractual Clauses, together with additional measures where required. You can contact us for information about the safeguards relevant to your data and how to obtain a copy.

10. How long we retain information

We keep personal information only for as long as needed for its purpose, taking account of legal obligations and legitimate needs:

  • Order, invoice and tax records are retained for the applicable statutory record-keeping period.
  • Customer account information is retained while needed to provide the account, then deleted or anonymised when no longer required, subject to separate order-record and legal retention needs.
  • Enquiries and complaints are retained for the period needed to resolve the matter and handle reasonably anticipated related claims.
  • Newsletter information is retained while your subscription remains active. After unsubscribe, we may keep a limited suppression record to avoid contacting you again.
  • Technical and security information is retained for the time needed to operate the relevant service and investigate security issues. Specific durations depend on the relevant technology and settings, as explained in section 6.

Legal proceedings, investigations or a legal preservation obligation may require longer retention of relevant records. You may contact us for the retention criteria applicable to a particular record.

11. Your data-protection rights

Subject to the conditions in applicable law, you may:

  • Request access to your personal data and a copy.
  • Ask us to correct inaccurate or incomplete information.
  • Request erasure or restriction of processing.
  • Receive eligible data in a portable format and request transfer to another controller.
  • Object to processing based on legitimate interests for reasons relating to your situation.
  • Object to direct marketing at any time.
  • Withdraw consent at any time without affecting processing lawfully carried out before withdrawal.
  • Exercise applicable protections relating to decisions based solely on automated processing that have legal or similarly significant effects, including human intervention and the opportunity to contest a decision where applicable.

To exercise your rights, email info@otry.com.cy. We may ask for proportionate information to verify your identity. We normally respond within one month. If a permitted extension is necessary, we explain the reason within that first month. Requests are normally free of charge.

Some information cannot be erased immediately, for example where required for tax records or legal claims.

You may complain to the Cyprus Commissioner for Personal Data Protection, https://www.dataprotection.gov.cy/, or to the relevant supervisory authority in the EU/EEA country where you live, work or believe an infringement occurred. You do not have to contact us first.

12. Fraud checks and human review

Shopify and payment providers use automated security and fraud-detection tools to assess transactions. If Shopify flags an order as suspicious, an authorised member of the OTRY team reviews it before deciding whether to fulfil or cancel it. OTRY does not make that fulfilment or cancellation decision solely on the fraud flag.

Payment providers may independently decline a payment for security or authorisation reasons. Their notices explain their processing. If you believe an OTRY decision is incorrect, contact info@otry.com.cy to request a review.

13. Security, children and external websites

Orders and customer accounts are managed through Shopify. Internal access is restricted to authorised people operating OTRY who need the information for their role. Customer enquiries are also handled through our business email service. We use appropriate organisational and technical safeguards. No transmission or storage system can be guaranteed completely secure.

Our products are for babies and children, but our shopping, accounts and newsletter services are directed to adults. We do not request children's names, birthdays or other personal details for ordinary purchases. Please avoid sending unnecessary information about children in enquiries. If you believe a child has provided personal information through our services, contact us so that we can assess and address it.

External websites and social platforms operate under their own privacy notices. This policy covers OTRY's processing and does not replace those notices.

14. Policy changes

We may update this policy to reflect changes in our services, practices or legal requirements. The revised version will show its update date. Where required, we will give additional notice or seek fresh consent.

For questions, contact info@otry.com.cy.