Last updated: June 1, 2026

Overview

This Privacy Policy explains how CALM SPARK LTD, Company No. 16313151, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Omini Box", "we", "us", or "our") collects, uses, shares, and protects personal information when you visit www.ominibox.shop, purchase products, use checkout, contact support, or interact with our Services.

For the purposes of UK GDPR, EU GDPR, and similar data-protection laws, CALM SPARK LTD is the data controller for personal information processed through the Omini Box Store, except where a third-party provider acts as an independent controller for its own services.

Personal information we collect

Depending on how you use the Services, we may collect or process the following categories of personal information:

Contact and identity details: name, email address, phone number, billing address, shipping address, company/customs fields where required, and customer-support details.
Order and transaction information: products viewed, cart contents, orders, pre-orders, deposits, balance payments, refunds, returns, promotions, shipping status, and customer-service history.
Payment information: payment method type, transaction identifiers, payment status, fraud-prevention signals, and limited payment details made available by Stripe, PayPal, or other payment providers. We do not intentionally store complete card numbers on our own systems.
Shipping and customs information: delivery address, recipient details, phone number, customs identifiers required by certain destination countries, carrier information, tracking details, and import or clearance data needed to fulfill an order.
Device and usage information: IP address, browser, device type, pages visited, referring URLs, approximate location, logs, security events, and interactions with site features.
Cookies and local storage: cart identifiers, cookie-consent choices, affiliate or referral codes, welcome-message preferences, and similar browser storage.
Communications: messages you send to us, email preferences, and operational email delivery information.

Sources of personal information

We collect information directly from you, automatically from your browser or device, from our self-hosted Medusa ecommerce backend, from Sanity content-management workflows where relevant, and from service providers such as payment processors, shipping providers, email providers, analytics and security providers, and hosting or infrastructure providers.

How we use personal information

We use personal information to operate the store, process orders and payments, provide shipping and customs documentation, manage pre-orders and balance payments, prevent fraud, secure the Services, provide customer support, send transactional emails, manage promotions or affiliate attribution, improve product pages and site performance, comply with legal obligations, enforce our terms, and protect our rights and users.

Where UK or EU data-protection law applies, our lawful bases may include performance of a contract, compliance with legal obligations, our legitimate interests in operating and securing an ecommerce business, consent for non-essential analytics or marketing cookies where required, and establishment or defense of legal claims.

Cookies, analytics, and privacy choices

We use essential cookies and local storage to operate checkout, cart, consent, security, and site preferences. Examples may include Medusa cart cookies, the medusa_cookie_consent preference, referral or affiliate cookies, and welcome-message preferences.

Cloudflare Web Analytics may be used to understand aggregate site performance and usage when enabled and permitted by your consent settings. Cloudflare describes this product as privacy-first web analytics. We also may use Cloudflare Turnstile or similar anti-abuse tools to protect checkout and forms.

Stripe, PayPal, and other payment services may set cookies or collect device and transaction signals for payment processing, authentication, fraud prevention, compliance, and checkout functionality. These payment-related technologies may be necessary to complete a transaction.

You can use the cookie banner or the Privacy Choices button in the footer to reject non-essential analytics cookies on the current browser. We do not currently sell personal information or use cross-context behavioral advertising pixels on the site. If we add advertising pixels or targeted advertising tools in the future, we will update this policy and the related choices.

How we disclose personal information

We disclose personal information only as needed for the purposes described in this policy, including to:

Commerce and backend providers: our self-hosted Medusa backend and related ecommerce infrastructure.
Payment providers: Stripe, PayPal, banks, card networks, and payment-method providers for payment processing, authentication, fraud prevention, disputes, refunds, and legal compliance.
Fulfillment and shipping providers: 4PX, carriers, customs brokers, and logistics partners to calculate shipping, prepare customs documents, ship orders, and provide tracking.
Email and communications providers: Resend and related email infrastructure to send order confirmations, balance requests, fulfillment notices, refund notices, support replies, and other operational messages.
Hosting, infrastructure, and security providers: Railway, Cloudflare, S3-compatible storage providers, logging, monitoring, anti-abuse, and security services.
Content and operations providers: Sanity and other tools used to manage site content, product pages, operational workflows, and support.
Authorities or third parties where required: courts, regulators, law enforcement, tax authorities, customs authorities, professional advisers, or parties involved in a business transfer where legally permitted or required.

International transfers

We operate an international ecommerce store. Your personal information may be processed in the United Kingdom, United States, European Economic Area, China, and other countries where we, our providers, payment processors, shipping partners, or infrastructure providers operate. Where required, we rely on recognized transfer mechanisms such as adequacy decisions, standard contractual clauses, equivalent safeguards, or other lawful transfer bases.

Retention

We retain personal information for as long as reasonably necessary to provide the Services, process orders, handle returns and disputes, comply with tax, accounting, customs, payment, and legal obligations, prevent fraud, enforce agreements, and maintain business records. Retention periods vary depending on the type of information and the purpose for processing it.

Your rights and choices

Depending on where you live, you may have rights to access, know, correct, delete, restrict, object to, or receive a portable copy of your personal information. You may also have the right to withdraw consent where processing is based on consent, opt out of certain sharing or targeted advertising where applicable, and avoid discrimination for exercising privacy rights.

California and certain other U.S. residents may have rights to know, correct, delete, and opt out of sale, sharing, or targeted advertising as defined by applicable law. We do not currently sell personal information or use cross-context behavioral advertising pixels on the site.

UK and EEA residents may also have the right to complain to a data-protection authority. In the UK, you may contact the Information Commissioner's Office. In the EEA, you may contact your local supervisory authority.

To exercise privacy rights, contact us at ominibox.shop@gmail.com. We may need to verify your identity and may ask for information needed to process your request. You may also authorize an agent where allowed by law.

Marketing communications

If we send promotional email, you may unsubscribe using the instructions in that email or by contacting us. We may still send transactional or service messages, such as order confirmations, payment requests, shipping notices, security notices, and support replies.

Children's privacy

The Services are not directed to children, and we do not knowingly collect personal information from children under the age required by applicable law. If you believe a child has provided personal information to us, contact us so we can take appropriate action.

Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure. Please avoid sending sensitive payment information or confidential data through unsecured support channels.

Third-party websites and services

The Services may link to or integrate third-party websites, apps, platforms, payment services, shipping services, social platforms, videos, or software ecosystems. Their privacy practices are governed by their own policies, not this Privacy Policy.

Legacy migration data

Some product, page, order, or content records may include data imported from prior storefront systems as part of historical migration or operational continuity. We process any such legacy migration data under this Privacy Policy and only for appropriate business, support, legal, or operational purposes.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised date. Material changes will be handled as required by applicable law.

Contact

For questions about this Privacy Policy or to exercise privacy rights, contact ominibox.shop@gmail.com.

CALM SPARK LTD
Company No. 16313151
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom