Privacy policy

Last updated: 23 September 2026

This Privacy Policy explains how SWAG HAIR LIMITED, trading as OMMARRA ("OMMARRA", "we", "us", "our"), collects, uses, discloses and protects your personal data when you visit www.ommarra.com (the "Site"), place an order, make a warranty claim or otherwise interact with us.

We are committed to complying with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the "PDPO"). This policy also serves as our Personal Information Collection Statement.

1. Personal data we collect

Depending on how you interact with us, we may collect:

a. Information you give us

  • Identity and contact details: name, email address, telephone number, delivery and billing address;
  • Order details: products purchased, order history, order value, delivery instructions;
  • Payment information: payment method and transaction reference. Full card numbers are processed directly by our payment providers and are not stored by us;
  • Account details, if you create an account: login email and password (stored in encrypted form);
  • Warranty and repair information: product serial number, description of the fault, photos or videos you send us;
  • Communications: the content of emails, messages, reviews, survey responses and social media interactions with us;
  • Marketing preferences.

b. Information collected automatically

  • Device and browsing information: IP address, browser type, operating system, device identifiers, referring website, pages viewed, time spent on pages, and how you interact with the Site;
  • Location information inferred from your IP address (country or city level);
  • Cookies and similar technologies (see Section 8).

c. Information from third parties

  • Delivery status from our couriers;
  • Payment confirmation and fraud-screening results from our payment providers;
  • Where you interact with our advertisements or content on social media platforms, information those platforms provide to us in accordance with their own privacy policies and your settings.

Providing personal data to us is voluntary. However, if you do not provide the data marked as required at checkout, we will not be able to process your order or deliver products to you.

2. How we use your personal data

We use your personal data for the following purposes:

  • Processing and fulfilling your orders, including payment processing, delivery, and sending order and dispatch confirmations;
  • Providing customer service, including responding to enquiries, handling warranty claims and repairs, and resolving disputes;
  • Managing your account and verifying your identity;
  • Fraud prevention and security, including screening transactions and protecting the Site;
  • Improving the Site and our products, including analysing how the Site is used and gathering feedback;
  • Direct marketing, only with your consent as described in Section 3;
  • Complying with legal and regulatory obligations, including record-keeping requirements under Hong Kong tax and company law, and responding to lawful requests from authorities;
  • Establishing, exercising or defending legal claims.

We will not use your personal data for any purpose other than those stated above, or a directly related purpose, without your consent unless permitted or required by law.

3. Direct marketing

3.1 We would like to use your name, email address and telephone number to send you news and offers about OMMARRA hair styling and hair care products, accessories, new releases, events and promotions, by email, SMS or instant messaging.

3.2 We will only do so with your consent. You can give consent by ticking the marketing box at checkout or subscribing on the Site. We will not treat a pre-ticked box or your silence as consent.

3.3 You may withdraw your consent and opt out at any time, free of charge, by clicking the "unsubscribe" link in any marketing email, replying "STOP" to any marketing SMS, adjusting your account preferences, or emailing us at cs@ommarra.com. We will stop sending marketing communications to you as soon as practicable after receiving your request. Every marketing email and SMS we send includes an unsubscribe facility, in accordance with the Unsolicited Electronic Messages Ordinance (Cap. 593). Service communications relating to your order or warranty claim (such as dispatch confirmations and safety notices) are not marketing and will continue.

3.4 Abandoned checkout and back-in-stock messages. If you begin a checkout and do not complete it, we will send you a reminder only if you have consented to marketing communications. If you ask to be notified when a product is back in stock, we will send you that notification only; we will not use your details for other marketing unless you have consented.

3.5 We do not sell your personal data. We will not provide your personal data to any third party for that third party's own direct marketing purposes.

4. Who we share your personal data with

We disclose personal data only to the extent necessary for the purposes described above, to:

  • E-commerce platform provider: our Site is hosted on Shopify, which stores your account, order and browsing data on our behalf;
  • Payment providers (for example Shopify Payments, credit card networks, PayPal, Apple Pay, Google Pay, Alipay or other providers offered at checkout) to process payments and screen for fraud;
  • Couriers, logistics providers and customs authorities to deliver your orders (including preparing customs declarations for international shipments) and handle returns for repair;
  • Email, SMS and marketing platforms that send communications on our behalf;
  • Analytics and advertising partners (for example Google Analytics, Meta and similar services), which may collect information through cookies and similar technologies to help us measure and improve the Site and our advertising (see Section 8);
  • Customer service and IT service providers that support our operations;
  • Professional advisers, including lawyers, accountants and insurers, where necessary;
  • Government, regulatory or law enforcement authorities, where required by law or a court order;
  • A purchaser or prospective purchaser of all or part of our business, subject to appropriate confidentiality obligations.

Service providers acting on our behalf are contractually required to process your personal data only on our instructions and to protect it appropriately.

5. Transfer of personal data outside Hong Kong

Some of our service providers (including Shopify and our payment, email and analytics providers) store or process data on servers located outside Hong Kong, including in the United States, Canada, the European Union and Singapore. Where we transfer your personal data outside Hong Kong, we take reasonable steps to ensure it is protected to a standard comparable to the PDPO, including through contractual safeguards with the recipient.

6. How long we keep your personal data

We keep personal data only for as long as necessary for the purpose for which it was collected, or as required by law. In general:

  • Order and transaction records: at least 7 years from the end of the financial year in which the transaction took place, to meet Hong Kong tax and accounting record-keeping requirements;
  • Warranty and repair records: for the duration of the warranty period and any repair warranty, plus a reasonable period to deal with any claim;
  • Account data: for as long as your account is active, and for a reasonable period after closure;
  • Marketing data: until you withdraw consent or we no longer have a reason to contact you;
  • Website analytics data: in accordance with the retention settings of the relevant analytics provider.

When personal data is no longer needed, we delete or anonymise it securely.

7. Security

We use appropriate technical and organisational measures to protect your personal data against unauthorised or accidental access, processing, erasure, loss or use, including encryption of data in transit (TLS/SSL), access controls, and reliance on payment providers that are PCI DSS compliant. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

8. Cookies and similar technologies

8.1 The Site uses cookies, pixels and similar technologies to operate the Site (for example keeping items in your cart and remembering your login), to analyse traffic and performance, and to measure and personalise advertising.

8.2 You can control cookies through your browser settings, and manage certain advertising preferences through the tools provided by Google, Meta and other advertising platforms. Disabling essential cookies may affect the functioning of the Site.

8.3 Where required, we will ask for your consent to non-essential cookies through a banner or preference tool on the Site.

9. Your rights

Under the PDPO you have the right to:

  • Access your personal data held by us and receive a copy;
  • Correct personal data that is inaccurate;
  • Withdraw consent to direct marketing at any time (Section 3.3);
  • Be informed of the kinds of personal data we hold and the purposes for which we use it.

To exercise these rights, contact us at cs@ommarra.com. We may need to verify your identity before responding. We will respond within 40 days as required by the PDPO. We may charge a reasonable fee to cover the cost of complying with a data access request, as permitted by law.

9A. Customers outside Hong Kong

If you are located outside Hong Kong, the data protection laws of your country or region (for example the EU or UK General Data Protection Regulation) may give you additional rights, such as the right to request erasure of your personal data, to restrict or object to certain processing, to data portability, and to lodge a complaint with your local supervisory authority. Where those laws apply to our processing of your data, we will honour those rights. To exercise them, contact us at cs@ommarra.com. Our legal bases for processing under such laws are: performance of our contract with you (orders, delivery, warranty); our legitimate interests (site security, fraud prevention, analytics, improving our products); your consent (direct marketing, non-essential cookies); and compliance with legal obligations (record-keeping, tax).

10. Children

Our products are suitable for use by persons aged 12 and over, and we accept orders from customers under 18 only with the consent of a parent or legal guardian (see Section 1 of our Terms of Service). Where a customer is under 18, we collect only the personal data needed to process and deliver the order and to provide warranty service, and we will not use that data for direct marketing. We do not knowingly collect personal data from anyone under 12. If you are a parent or guardian and believe a child has provided us with personal data without your consent, please contact us at cs@ommarra.com and we will delete it.

11. Third-party websites

The Site may contain links to third-party websites and social media platforms. We are not responsible for the privacy practices or content of those third parties. Please review their privacy policies before providing them with personal data.

12. Changes to this policy

We may update this policy from time to time. The updated version will be posted on the Site with a revised "Last updated" date. Where a change materially affects how we use your personal data, we will take reasonable steps to notify you.

13. Contact us

If you have any questions about this policy, or wish to exercise your rights, please contact:

SWAG HAIR LIMITED, trading as OMMARRA Attention: Data Protection / Customer Service Email: cs@ommarra.com

If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).