Privacy Policy

The data controller is MELVIN GLOBAL LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Not VAT registered. You can reach us at [YOUR SUPPORT EMAIL] or [YOUR PHONE NUMBER].

We do not need a Data Protection Officer under Article 37 GDPR because our core activity is selling goods, not large-scale monitoring or processing of special categories of data.

• Order data — name, delivery and billing address, email, phone number, ordered items and order number. Used to fulfil your contract with us (Article 6(1)(b) GDPR).
• Payment data — the payment details you enter at checkout. Card numbers are collected and processed by Stripe, not by us; we only receive a confirmation and a payment reference (Article 6(1)(b) GDPR).
• Account data — if you create a customer account, your login email and a hashed password, so we can show you your order history (Article 6(1)(b) GDPR).
• Newsletter data — your email address, only if you actively sign up, and only with your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time, for example by the unsubscribe link in every email.
• Usage data — IP address, browser and device information, and the pages you visit. Used to keep the site secure and to understand how the shop is used (Article 6(1)(f) GDPR, legitimate interest).
• Cookie data — technically necessary cookies for the cart and checkout, and analysis or marketing cookies only after you accept them (Article 6(1)(a) GDPR).
• Correspondence data — the content of messages you send us, so we can answer them (Article 6(1)(b) and (f) GDPR).

You are not legally obliged to provide any of this data. Without order and contact data, however, we simply cannot conclude or perform a contract with you.

We use Stripe as our payment processor. When you pay, Stripe Payments Europe, Ltd., 34/35 Fitzwilliam Street Upper, Dublin 2, D02 TN11, Ireland, collects and processes the payment data you enter. Stripe is our processor under Article 28 GDPR and is contractually bound to handle data only on our instructions.

Stripe also performs fraud and risk checks on our behalf, which is a legitimate interest under Article 6(1)(f) GDPR. Stripe may transfer data to its group companies in the United States and other countries on the basis of the European Commission's Standard Contractual Clauses. For the data Stripe collects in its own right, Stripe's own privacy policy applies in addition to this one.

• Shipping carriers — the name, delivery address and phone number needed to hand over your parcel.
• Payment providers — as described in section 3.
• Our hosting and shop platform — to deliver this website to you.
• Our accountant and tax adviser — to meet our bookkeeping and tax obligations (Article 6(1)(c) GDPR).
• Authorities — only where we are legally obliged, for example in a tax audit.

We never sell your personal data. Every provider we use is bound by a data processing agreement and is under an obligation of confidentiality.

Technically necessary cookies keep your cart and checkout working and are set on the legal basis of our legitimate interest in operating a functioning shop. Any cookie used for analysis, advertising or embedded third-party content is only set after you give consent in the cookie banner, and you can withdraw that consent at any time through your cookie settings or your browser.

If you add an analytics or advertising tool to this shop later — for example Google Analytics or Meta Pixel — you must add it to this policy and to the cookie banner at the same time.

Data may be transferred to the United States through Stripe and our hosting provider. Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses under Article 46 GDPR, and the recipient is under an obligation to apply European-level protection.

• Order and contract data: for as long as required by commercial and tax retention rules, which in the EU is normally six to ten years from the end of the relevant financial year.
• Newsletter subscriptions: until you unsubscribe or withdraw consent.
• Contact and support messages: until the matter is closed, then deleted unless a legal retention period applies.
• Usage and log data: up to twelve months, unless a security incident requires longer storage.
• Cookies: according to their stated lifetime; session cookies are deleted when you close your browser.

Once a retention period ends, the data is deleted or anonymised so it can no longer be traced back to you.

This shop is served over HTTPS, so data in transit is encrypted. Access to systems holding customer data is restricted to people who need it, and payment card data is never stored on our own servers.

• Access — the right to be told what data we hold about you and to receive a copy.
• Rectification — the right to have incorrect data corrected and incomplete data completed.
• Erasure — the right to have your data deleted, unless we are required to keep it.
• Restriction of processing — the right to have processing frozen in the situations listed in Article 18 GDPR.
• Data portability — the right to receive the data you gave us in a structured, machine-readable format, or to have it sent to another company.
• Objection — the right to object to processing based on legitimate interest, and always to object to direct marketing.
• Withdrawal of consent — the right to withdraw a consent you gave us, at any time, without affecting processing that already happened.
• Complaint — the right to complain to a supervisory authority, in particular the data protection authority of the EU country where you live, or the Information Commissioner's Office (ICO), United Kingdom. EU representative under Article 27 GDPR: [NAME AND ADDRESS OF YOUR EU REPRESENTATIVE].

To exercise any of these rights, email [YOUR SUPPORT EMAIL]. We answer free of charge within one month. If your request is clearly unfounded or excessive we may charge a reasonable fee or refuse it, and we may ask you to prove your identity first.

We do not make decisions about you based solely on automated processing that has legal or similarly significant effects on you. Stripe's fraud screening is carried out by Stripe under its own policy.

This shop is not aimed at children. We do not knowingly collect personal data from anyone under 16 without a parent's or guardian's consent. If you believe a child has given us data, write to [YOUR SUPPORT EMAIL] and we will delete it.

We may update this policy when our services or the law change. The version published on this page is always the current one; the date at the top shows when it was last reviewed.