Back

Privacy Policy

Last updated: 17 October 2026

This Privacy Policy explains how O.H. OrthoHouse Ltd collects, uses, shares and protects your personal data when you visit our website, shop online, contact us or visit our shop in Engomi. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the applicable data protection law of the Republic of Cyprus.

1. Who We Are

The controller of your personal data is:

  • O.H. OrthoHouse Ltd
  • 27B, 25th March Street, Engomi, 2408 Nicosia, Cyprus
  • Telephone: +357 22 66 06 88
  • Email: info@orthohouse.com.cy

We operate an online shop at orthohouse.com.cy, built on the Shopify platform, and a physical shop in Engomi, Nicosia.

2. What Data We Collect

Account and order data

When you create an account or place an order, we collect your name, email address, telephone number, billing and delivery address, order details, purchase history and any account login details.

Contact and enquiries

When you contact us by email, telephone, contact form, social media or live chat, we collect your name, contact details and the content of your message.

Payment data

Card payments are processed by Shopify Payments and other payment processors. We receive limited payment information (such as payment status, payment method and the last digits of a card), but we do not receive or store your full card details.

Delivery data

To deliver your order, we use your name, delivery address, telephone number and, where relevant, delivery instructions.

Health-related information you choose to share

When you ask us for fitting, product advice or support with an application to the Department for Social Inclusion of Persons with Disabilities (ΤΚΕ), you may share information about your health, condition, measurements or mobility needs. This is special category data under the GDPR. We process it only to provide the service you request and with your explicit consent.

Newsletter and marketing preferences

If you subscribe to our newsletter, SMS messages or loyalty programme, we collect your email address and/or mobile number, your subscription preferences, loyalty points and rewards activity, and information about how you interact with our messages.

Device and usage data, and cookies

When you visit our website, we and our partners collect information such as your IP address, browser and device type, pages viewed, referring website and actions taken on the site, using cookies and similar technologies (see Section 4).

3. Purposes and Legal Bases

We use your personal data for the following purposes, based on the following legal bases:

  • Performance of a contract: to process and deliver your orders, manage your account, handle returns, rentals and warranty matters, and respond to your requests before you buy.
  • Legal obligation: to keep invoices and accounting records, meet tax obligations and respond to lawful requests from authorities.
  • Legitimate interests: to run, secure and improve our website and shop, prevent fraud, answer general enquiries, and keep internal records. When we rely on legitimate interests, we balance them against your rights and interests.
  • Consent: to send you marketing emails and SMS messages, to use non-essential cookies for analytics and advertising, and to process health-related information you share with us. You can withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

4. Cookies and Tracking

Our website uses cookies and similar technologies. Some are strictly necessary for the website and checkout to work. Others are used only with your consent:

  • Analytics: we use Google Analytics to understand how visitors use our website so we can improve it.
  • Advertising and remarketing: we use Google Ads (including remarketing) and the Meta (Facebook) Pixel to measure the effectiveness of our advertising and to show you relevant ads on other websites and platforms.
  • Marketing and loyalty: Klaviyo and Smile.io may use cookies to support newsletter sign-up, personalised messages and the loyalty programme.

You can accept or reject non-essential cookies through the cookie banner when you first visit our website, and you can change your choice at any time. You can also delete or block cookies in your browser settings, use the Google Analytics opt-out browser add-on, and manage your ad preferences in your Google and Meta account settings.

For more details, please see our Cookie Policy.

5. Who We Share Data With

We share personal data only where necessary, with:

  • Shopify, which hosts our online shop and processes data on our behalf;
  • Payment processors, including Shopify Payments, to process your payments;
  • Couriers and postal services, including Akis Express and ACS Courier in Cyprus, and the postal service for international orders;
  • Google (Google Analytics and Google Ads) and Meta (Facebook Pixel), for analytics and advertising, where you have consented;
  • Klaviyo, for our email newsletter, marketing and SMS messages (if you have subscribed);
  • Smile.io, to run our loyalty points and rewards programme;
  • Our live chat provider, to handle messages you send through the website chat;
  • The Department for Social Inclusion of Persons with Disabilities (ΤΚΕ), only when you ask us to support your application;
  • Professional advisers, such as accountants, auditors and lawyers;
  • Public authorities, such as tax authorities, courts or the police, when required by law.

We do not sell your personal data.

6. International Transfers

Some of our service providers (for example Shopify, Google, Meta, Klaviyo and Smile.io) may process personal data outside the European Economic Area (EEA). Where this happens, we make sure appropriate safeguards are in place, such as an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, where applicable) or the European Commission's Standard Contractual Clauses.

7. How Long We Keep Your Data

  • Orders and invoices: we keep order, invoice and accounting records for the period required by Cypriot tax and accounting law.
  • Marketing data: we keep your marketing contact details until you unsubscribe or withdraw your consent.
  • Enquiries: we keep enquiries and related correspondence for as long as needed to handle them and any follow-up.
  • Health-related information: we keep it only for as long as needed to provide the requested service, or until you withdraw your consent, unless we must keep it longer by law.
  • Customer accounts: we keep your account until you ask us to close it, subject to the records we must keep by law.

8. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including secure (encrypted) connections on our website, access controls limited to staff who need the data, and the use of reputable service providers. No method of transmission over the internet is completely secure, but we work to protect your data and will act promptly if a data breach occurs.

9. Your Rights Under GDPR

You have the right to:

  • Access the personal data we hold about you;
  • Rectification of inaccurate or incomplete data;
  • Erasure of your data, where there is no legal reason for us to keep it;
  • Restriction of processing in certain circumstances;
  • Data portability, to receive your data in a structured, commonly used format;
  • Objection to processing based on legitimate interests, and to direct marketing at any time;
  • Withdraw your consent at any time, where processing is based on consent.

To exercise your rights, please contact us using the details in Section 12. You can unsubscribe from marketing emails or SMS messages at any time using the link or instructions included in each message. We may ask you to confirm your identity before responding.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection, Cyprus (www.dataprotection.gov.cy).

10. Children

Our website and services are not directed at children under 16, and we do not knowingly collect personal data from them online. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us and we will take appropriate action.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the date of the last update shown below.

Last updated: 17 October 2026

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

  • O.H. OrthoHouse Ltd
  • 27B, 25th March Street, Engomi, 2408 Nicosia, Cyprus
  • Telephone: +357 22 66 06 88
  • Email: info@orthohouse.com.cy