Last updated: 13 November 2026
This notice explains how OZAK NATURES REMEDIES LTD uses personal information in connection with Ozak, this website and our customer and business correspondence.
1. Who is responsible for your information?
Ozak is operated by OZAK NATURES REMEDIES LTD, a company registered in England and Wales, company number 17515014. We are the controller of the personal information described in this notice.
Postal contact: 165 Stoke Newington Road, London, N16 8BP, United Kingdom
Email: [email protected]
The company also operates Nurs at nurslokmanhekim.co.uk. Each shop identifies its own customer contact address. Contacting or shopping with one brand does not subscribe you to marketing from either brand.
2. Information we collect and where it comes from
- Enquiries and correspondence: your name, email address, the content of your message and any contact or order details you choose to provide directly to us.
- Website use and security: IP address, browser and device information, requested pages, dates, times and security events, such as unsuccessful login attempts. Our infrastructure providers also process technical information needed to deliver and protect the website.
- Shopping and account information, when these features are available: names, billing and delivery addresses, email address, telephone number if supplied, basket contents, order details and account information. Account passwords are stored as protected hashes.
- Payments, when checkout is enabled: payment status and transaction references supplied by the payment provider. We do not store full payment card numbers or card security codes in our website database.
- Reviews, if you submit one: your chosen display name, review, rating and technical information used to help prevent abuse. Published reviews are visible to other visitors; your email address is not displayed as part of the review.
Online orders are currently disabled while the shop is being prepared. Checkout-related processing described here applies when that functionality becomes available. We obtain contact details directly from people dealing with us, or from the payment and delivery services involved in their transaction. We do not use purchased, rented or scraped contact lists for email campaigns.
Please do not send payment card details, account passwords or medical records by email. Product enquiries do not require you to disclose your medical history.
3. Why we use information and our lawful bases
- To answer purchase enquiries, process orders and arrange delivery or returns: taking steps at your request before a contract, or performing our contract with you.
- To answer general enquiries and manage customer or supplier correspondence: our legitimate interests in communicating with people who contact or do business with us.
- To operate accounts, deliver service messages, prevent fraud and protect the website and mailboxes: performing a contract where applicable, and our legitimate interests in running a reliable service, protecting users and investigating misuse.
- To maintain financial records and respond to lawful requests: compliance with applicable legal obligations.
- Optional marketing, if introduced: your separate consent. We do not currently operate a newsletter signup or automatically enrol customers in marketing. Any future optional marketing will provide a clear opt-in and a simple way to withdraw consent.
Contact details needed to answer your message, and the information needed to fulfil a future order, are necessary to provide those services. If you do not provide them, we may be unable to respond or fulfil the order. Optional information is not required.
4. Email communications
We use our business mailboxes for customer enquiries and replies, supplier correspondence and service messages. When connected, Mailjet will relay outgoing messages and website notifications, such as password resets and order updates. It processes recipient addresses, message content and delivery information needed for that service.
Service messages are linked to your enquiry, account or transaction. Providing an email address for these purposes does not give consent to promotional email. We do not sell personal information or share contact details with other organisations for their independent marketing.
5. Who receives information?
Authorised people working for the company have access where needed for their role. We also use the following categories of service provider:
- Oracle Cloud Infrastructure: hosting our websites, databases and business mail service. Our main server is in the London region.
- Cloudflare: website delivery, DNS and security services; it processes technical request information when protecting and delivering the website.
- Mailjet (Sinch): our selected outgoing email delivery provider, once account activation and connection are complete.
- Payment providers: no payment service is currently connected to this shop. We will identify the provider and update this notice before enabling payments.
- Delivery providers and professional advisers: where required to deliver an order, keep accounts, handle a dispute or meet our legal obligations. Delivery providers receive the contact and address information necessary for the delivery.
We may also disclose information where required by law or necessary to establish, exercise or defend legal claims.
Provider information: Oracle, Cloudflare, Mailjet.
6. International processing
Although our main hosting server is in the UK, our cloud, security, email and payment providers may process information in other countries. Where processing involves a restricted international transfer, the applicable arrangements use UK adequacy regulations or contractual safeguards, such as standard contractual clauses with the UK Addendum, as appropriate. Contact us for information about the arrangements relevant to your data and how to obtain a copy of the applicable safeguards. Provider terms include Mailjet’s data processing agreement and the privacy information linked above.
7. Cookies and external services
WordPress and WooCommerce use cookies and similar storage for functions such as login, basket contents and shopping sessions. Their use depends on which features you use. Typical examples include:
wordpress_test_cookie: checks whether the browser accepts cookies; normally lasts for the browser session.wordpress_logged_in_*andwordpress_sec_*: maintain authenticated sessions; normally up to two days, or up to two weeks when Remember Me is selected, unless you log out earlier.woocommerce_cart_hashandwoocommerce_items_in_cart: support basket contents; normally session cookies.wp_woocommerce_session_*: links a browser to its shopping session; normally up to two days.
Cloudflare and payment services may use additional storage or technical checks for security and to provide a service you request. You can manage cookies in your browser, although blocking necessary cookies may prevent login, basket or checkout features from working.
This site currently loads fonts through Google Fonts. Your browser contacts Google to obtain font files, which can disclose your IP address and browser information. Google privacy information.
If you use reviews or another feature displaying profile pictures, WordPress may send a hash derived from your email address to Gravatar to check for an associated avatar. See Automattic’s privacy information.
We do not currently operate an optional analytics or advertising campaign through a website plugin. If we introduce optional tracking that requires consent, we will provide the required choice and update this notice.
8. How long information is kept
Retention depends on why the information is needed:
- Enquiries and business correspondence: for handling the enquiry and any related ongoing customer or supplier relationship, and for resolving associated complaints or claims.
- Orders and financial records: for fulfilment, returns and disputes, and the applicable statutory accounting and tax record period. Information that is not needed for those purposes can be removed earlier.
- Customer accounts: while the account is used and needed to provide the service. You can ask us to close an account; separately required transaction records may still be retained.
- Security and delivery logs: while needed to operate the service or investigate a security or delivery problem, subject to the relevant service’s rotation and retention settings. Relevant evidence may be retained for an active investigation.
- Backups: access-restricted rolling copies, replaced on their normal backup cycle. Information deleted from the live service may remain temporarily in a backup until that copy expires.
When deciding retention, we consider whether the issue is resolved, whether a relationship is ongoing, legal record-keeping duties and any outstanding dispute. Ask us if you need information about the period applicable to a particular record.
9. Your rights and choices
Depending on the circumstances and lawful basis, you can request access to your personal information, correction, deletion, restriction of processing or a portable copy. You can withdraw consent at any time where we rely on it, without affecting the lawfulness of earlier processing. Some records may need to be retained for legal reasons.
Your right to object: you can object to processing based on legitimate interests, taking account of your situation. You can object to direct marketing at any time.
Send requests or privacy complaints to [email protected], or write to the postal address above. We may need proportionate information to verify your identity. We normally respond within one month; where an extension is permitted, we will explain it.
You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.
10. Security and changes
We use encrypted connections, restricted administrative access, protected password storage and operational security controls to reduce the risk of unauthorised access. No internet service can be guaranteed completely secure. We do not make solely automated decisions producing legal or similarly significant effects about you; technical anti-abuse checks may temporarily restrict suspicious requests.
We update this notice when our services or processing change. The date at the top shows the latest revision. See our Contact page for the current business contact details.