Privacy Policy

Milu operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a shopping experience (the "Services"). Milu is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

We sell to customers in the United States, New Zealand and Australia. Depending on where you live, different privacy laws apply to you, and some of the rights described below will apply to you and not to others. The country-specific rights are set out in "Rights by country" further down this page.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described here.

What we collect

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information collected anonymously or that has been de-identified so that it cannot identify or be reasonably linked to you. Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process the following:

• Contact details including your name, billing address, shipping address, phone number and email address.
• Payment information including payment card details, financial account information, transaction details, form of payment and payment confirmations. Card numbers are processed by our payment providers and are not stored by us.
• Account information including your username, password, preferences, subscription settings and delivery schedule.
• Transaction information including items you view, add to your cart, purchase, return, exchange, subscribe to or cancel, and your order history.
• Communications with us including anything you tell us in emails, contact forms, product reviews or customer support conversations.
• Information you volunteer about yourself including anything you choose to share with our team about your health, your symptoms or your reasons for taking our products.
• Device information including your device, browser, network connection, IP address and other unique identifiers.
• Usage information including how and when you interact with or navigate the Services.

Where it comes from

We may collect personal information from the following sources:

• Directly from you when you create an account, place an order, subscribe, contact us, or otherwise provide us with your information.
• Automatically through the Services from your device when you visit our site, including through cookies and similar technologies.
• From our service providers when we engage them to enable certain technology, or when they collect or process information on our behalf.
• From our partners or other third parties including advertising and analytics partners.

How we use it

Depending on how you interact with us and which Services you use, we may use personal information for the following purposes:

• Providing and improving the Services. To perform our contract with you, process payments, fulfil and ship your orders, manage your subscription and delivery schedule, remember your preferences, send notifications about your account, handle returns and refunds, enable reviews, and improve how the store works.
• Marketing and advertising. To send marketing and promotional communications by email, text message or post, and to show you online advertising on our site or elsewhere, including based on what you have previously viewed or purchased. You can opt out at any time.
• Security and fraud prevention. To authenticate your account, provide a secure payment experience, and detect, investigate or act on possible fraudulent, illegal or malicious activity. If you register an account, you are responsible for keeping your credentials safe. Please do not share your password with anyone.
• Communicating with you. To provide customer support, respond to your questions, and maintain our relationship with you.
• Legal reasons. To comply with applicable law or valid legal process, including requests from law enforcement or regulators, to participate in litigation or civil discovery, and to enforce or investigate potential breaches of our terms or policies.

Health information

We do not ask you for health information in order to sell you a product, and you never have to give us any. We are a dietary supplement company, not a healthcare provider.

If you choose to tell us something about your health, for example when you email our team about how a product is working for you or leave a product review, we treat that as sensitive information. We use it only to answer you and to keep a record of the conversation. We do not use it to target advertising to you, and we do not sell it. In New Zealand and Australia, health information carries additional protections under local law, which we apply to that information regardless of where you live.

Who we share it with

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Those circumstances may include:

• With Shopify, and with vendors and other third parties who perform services on our behalf, such as IT management, payment processing, data analytics, customer support, cloud storage, fulfilment, warehousing and shipping.
• With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalised advertising with third-party services based on your online activity across different merchants and websites. These partners use your information in accordance with their own privacy notices. Depending on where you live, you may have a right to tell us not to share information about you for targeted advertising.
• When you direct, request or otherwise consent to our disclosure of information to third parties, such as to ship you an order, or through your use of social media widgets or login integrations.
• With our affiliates or otherwise within our corporate group.
• In connection with a business transaction such as a merger, acquisition or insolvency; to comply with legal obligations including subpoenas, search warrants and similar requests; to enforce our terms or policies; and to protect or defend the Services, our rights, and the rights of our customers or others.

Our relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit to the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you live. We also use certain Shopify enhanced features that make use of data and information obtained from your interactions with our store, with other merchants, and with Shopify. In those circumstances Shopify is responsible for the processing of your personal information, including for responding to requests to exercise your rights over that processing. To learn more, see the Shopify Consumer Privacy Policy.

Third party links

The Services may link to websites or platforms operated by third parties. If you follow a link to a site we do not control, you should review its privacy and security policies and other terms. We are not responsible for the privacy or security of those sites, or for the accuracy or reliability of information found on them. Information you post in public or semi-public places, including third-party social platforms, may be visible to others without limitation as to its use. Including a link does not by itself imply endorsement.

Children's data

The Services are not intended for children, and we do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. If you are the parent or guardian of a child who has given us their personal information, contact us using the details below and we will delete it. As at the last updated date of this policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable United States privacy laws) the personal information of anyone under 16.

Security and retention

No security measures are perfect or impenetrable, and we cannot guarantee perfect security. Information you send us may not be secure while in transit. We recommend you do not use unsecured channels to send us sensitive or confidential information.

How long we keep your personal information depends on why we hold it: whether we need it to maintain your account and subscription, to provide the Services, to meet legal or tax obligations, to resolve disputes, or to enforce our agreements and policies.

Your rights and choices

Depending on where you live, you may have some or all of the rights below. These rights are not absolute, may apply only in certain circumstances, and in some cases we may decline a request where the law permits.

• Access. Request access to the personal information we hold about you.
• Deletion. Request that we delete personal information we hold about you.
• Correction. Request that we correct inaccurate personal information.
• Portability. Request a copy of your personal information and ask us to transfer it to a third party, in certain circumstances and with certain exceptions.
• Opting out of sale, sharing or targeted advertising. Depending on where you live, you may have the right to opt out of the "sale" or "sharing" of your personal information, or of processing for targeted advertising, as those terms are defined in applicable privacy laws. If you visit our site with the Global Privacy Control signal enabled, and depending on where you are, we will treat that as an opt-out request for that device and browser. If we can link the signal to a Shopify account, we will apply the opt-out to that account too. See globalprivacycontrol.org. We do not recognise other "Do Not Track" signals.
• Marketing preferences. You can unsubscribe from promotional email at any time using the link in any message we send. If you opt out, we will still send non-promotional messages about your account, your subscription and your orders.

You can exercise any of these rights where indicated on the Services, or by contacting us using the details at the bottom of this page. We will not discriminate against you for exercising them. We may need to verify your identity before acting on a request, as permitted or required by law. Where the law allows, you may appoint an authorised agent to make a request on your behalf; we will require proof of that authorisation and may still need to verify your identity directly. We respond within the timeframe required by applicable law.

Rights by country

International transfers

We may transfer, store and process your personal information outside the country you live in. We are based in New Zealand, we use a fulfilment partner in the United States, and our service providers operate in a number of countries. That means information about United States and Australian customers may be transferred to and held in New Zealand, and information about New Zealand customers may be transferred to and held in the United States and elsewhere.

Where we transfer personal information out of New Zealand, we take reasonable steps to ensure the recipient protects it in a way comparable to the Privacy Act 2020. Where we transfer personal information out of Australia, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. If we transfer personal information out of the European Economic Area or the United Kingdom, we rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses, or equivalent contracts issued by the relevant UK authority, unless the destination country has been found to provide an adequate level of protection.

Complaints

If you have a complaint about how we handle your personal information, contact us using the details below and we will look into it. Depending on where you live, you may also have the right to appeal our decision, or to take your complaint to your local privacy regulator: the Office of the Privacy Commissioner in New Zealand, the Office of the Australian Information Commissioner in Australia, your state attorney general in the United States, or your data protection authority in the UK or EEA.

Changes to this policy

We may update this Privacy Policy from time to time, to reflect changes in our practices or for other operational, legal or regulatory reasons. We will post the revised policy on this page, update the "Last updated" date, and give notice where applicable law requires it.