What we collect when you shop with EcoModa, why we hold it, and how to get it back or deleted.
Last updated 12 June 2026
We collect what we need to take your order, deliver it and support you afterwards. We never sell your data and we do not share it with advertisers without your consent. You can see, export or delete everything we hold from your account settings, and marketing email is opt-in only.
EcoModa Ltd, 14 Bell Yard, London EC4A 1AB, is the data controller for personal information collected through our website and app. For any data protection question, get in touch with us here.
Name, email, delivery and billing address, phone number, sizing preferences, and anything you write to support.
What you bought, returned or had repaired, order value, and take-back credits issued.
Device type, app version, approximate location from your IP, and which pages you viewed.
Delivery status from carriers, and fraud signals from our payment processor.
Card numbers never reach our servers. Payments are processed by our payment provider, and we store only the last four digits and the card brand.
Essential cookies keep you signed in and hold your bag between visits; these cannot be turned off. Analytics and advertising cookies only run if you accept them in the banner, and you can change that choice at any time from the cookie settings link in the footer.
We do not use cross-site tracking pixels for profiling, and we honour Global Privacy Control signals.
We share data only with the suppliers who make the service work: our payment processor, carriers, warehouse, email platform and customer support tool. Each is contractually bound to use it only on our instructions.
No customer list, email address or purchase history is sold, rented or traded. The only other case where we would disclose data is a legal obligation, or a merger where the buyer takes on this same policy.
Order records are held for seven years to meet tax rules. Account details are kept while your account is open and for 24 months after your last order, then deleted or anonymised. Support conversations are kept for three years, marketing consent records for as long as you stay subscribed plus two years.
You can ask for a copy of your data, correct it, have it deleted, restrict or object to how we use it, and take it elsewhere in a portable file. Most of this is self-service under Account, Privacy. Anything else we answer within 30 days, free of charge.
Withdrawing marketing consent is one tap in the app or one click in any email, and does not affect order updates, which we must still send.
Data is encrypted in transit and at rest, access is limited to staff who need it, and we review our suppliers annually. Where a supplier is outside the UK or EEA, transfers are covered by standard contractual clauses.
If a breach affects you, we will tell you and the regulator within 72 hours of becoming aware of it.
Our service is not intended for under-16s and we do not knowingly collect their data. If you believe a child has an account, contact us and we will remove it.
We update this policy as the business changes. Material changes are emailed to account holders at least 14 days before they take effect, and the date at the top always reflects the current version.