Privacy policy

Controller

Odd Hours is the controller of personal data collected through oddhours.site. All privacy correspondence is handled at support@oddhours.site.

Data collected

• Technical data gathered automatically when a page loads: IP address, user agent, device and browser characteristics, referring address, pages viewed and timestamps.
• Correspondence data: the email address of a sender and whatever a message contains.
• Order data, where digital material is purchased: name, email address, country, and the transaction identifier supplied by the payment processor. Card numbers and banking credentials are handled by the payment processor and are never received or stored by Odd Hours.
• Measurement data from analytics and advertising tools, including identifiers set by those tools for attribution and audience measurement.

Purposes and legal bases

• Operating and securing the site, and preventing abuse — legitimate interests under the GDPR; legitimate interests of the controller under the LGPD.
• Responding to correspondence — legitimate interests, or steps taken at the request of the data subject prior to a contract.
• Processing orders, delivering purchased material and handling refunds — performance of a contract.
• Meeting tax, accounting and other legal obligations — compliance with a legal obligation.
• Analytics and advertising measurement — consent, where consent is required in the applicable jurisdiction.

Cookies and similar technologies

The site uses cookies and comparable storage for two purposes: measuring traffic, and attributing visits that arrive from advertising. Browser settings can block or delete this storage; blocking it does not restrict access to any article.

Where advertising platforms set their own identifiers, those platforms act as independent or joint controllers for that processing, under their own published terms.

Sharing

Data is disclosed to hosting and content-delivery providers, analytics and advertising platforms, payment processors, and email providers, each processing only what its function requires. Data is also disclosed where a legal obligation, judicial order or regulatory request requires it. Personal data is not sold.

International transfer

Infrastructure and service providers operate outside Brazil and outside the European Economic Area, so personal data may be transferred to and processed in other countries. Transfers rely on the mechanisms available under Article 33 of the LGPD and Chapter V of the GDPR, including standard contractual clauses where applicable.

Retention

Correspondence is retained while a matter is open and for up to 24 months afterwards. Order records are retained for the period required by Brazilian tax and commercial law, which is generally five years. Technical logs are retained for up to 12 months. Analytics and advertising data follow the retention settings of the platform concerned. Data no longer needed for any stated purpose is deleted or anonymised.

Rights

Under the LGPD, data subjects may confirm the existence of processing, access their data, correct incomplete or inaccurate data, request anonymisation, blocking or deletion of unnecessary or excessive data, request portability, obtain information about sharing, be informed of the consequences of refusing consent, and withdraw consent. Under the GDPR, data subjects may request access, rectification, erasure, restriction, portability, and may object to processing based on legitimate interests.

Requests go to support@oddhours.site and are answered within the period set by the applicable law. Identity is confirmed before a request is actioned, which may require a limited further exchange.

Complaints

A complaint about this processing may be made to the Brazilian National Data Protection Authority (ANPD) or, for data subjects in the European Economic Area or the United Kingdom, to the relevant national supervisory authority.

Minors

This site is directed at adults. It is not intended for anyone under 18, and personal data is not knowingly collected from anyone under 18. Where such data is identified, it is deleted.

Changes

This policy may be updated. The date at the head of the page records the current version, and material changes are noted on the corrections page.