Privacy policy

Effective date: 17 September 2026

Your trust matters to us. This Privacy Policy explains how Meliza’s Limited collects, uses, shares and protects personal information when you visit our website, place an order, subscribe to our emails, contact us, make a wholesale or tasting enquiry, attend an event, submit content or otherwise interact with us.

We only use personal information where we have a lawful reason and aim to collect no more information than we need. This policy applies to our UK online store and our related customer, wholesale, event and marketing activities.

Please also read our Cookie Policy and website Terms and Conditions.

Who we are

Meliza’s Limited is the controller of the personal information covered by this policy. This means we decide why and how that information is used.

Detail

Information

Company number

15060883

Privacy contact

info@melizas.com

Website

www.melizas.com

 Personal information we collect

Depending on how you interact with us, we may collect the following information:

  • Identity information, such as your name and, for business contacts, your role or job title.

  • Contact information, such as your email address, telephone number, billing address, delivery address and business address.

  • Order and transaction information, such as products purchased, order value, discounts, delivery method, refund history and transaction references.

  • Payment-related information. Payments are handled by payment providers. We do not receive or store your full payment-card number or security code.

  •  Enquiry information, including messages and information submitted through contact, wholesale, tasting, sampling or event forms.

  • Marketing information, including newsletter subscriptions, consent records, preferences, email engagement and unsubscribe status.

  • Technical and usage information, including IP address, browser and device details, cookie identifiers, referral source, pages viewed, interactions, checkout activity and session information.

  • Preference and profile information, such as products saved to a wishlist, loyalty activity, rewards, referrals and inferred interests where those features are used.

  •  Content and media, such as reviews, recipes, photographs, videos, testimonials and social-media content you choose to share with us.

  • Business relationship information concerning retailers, wholesalers, hospitality customers, suppliers, creators, partners and professional contacts.

  • Fraud and security information, including payment checks, address verification results, device and network signals and order-risk indicators.

Information we do not normally request

We do not normally ask for health information or other special category information. Please do not send this through a general form unless it is genuinely necessary. If we need information about an allergy, accessibility requirement or dietary need for a tasting or event, we will explain why it is needed and, where required, ask for your explicit consent.

How we collect information

  • Directly from you when you place an order, subscribe, complete a form, contact us, attend an event, provide feedback or participate in a promotion.

  • Automatically when you use our website, through Shopify, cookies, pixels, local browser storage and analytics technologies, subject to your cookie choices.

  • From payment, delivery and technology providers when they confirm a transaction, delivery, risk result or service event.

  • From advertising and analytics platforms when they report campaign, audience or website performance.

  • From public business sources, such as a company website, professional directory or social-media profile, where we have a legitimate reason to contact a business or professional representative.

  • From another person or organisation where they make a legitimate referral or introduce us, and it is reasonable for us to use the information for that purpose.

How and Why We Use Personal Information 

The table below explains our main processing purposes. More than one lawful basis may apply where we use the same information for separate purposes.

Purpose

Information used

Why we use it

Lawful basis

Orders and fulfilment

Name, contact details, billing and delivery information, order and transaction details

To accept payment, confirm, prepare, deliver and manage an order; handle refunds or product issues

Contract; legal obligation for tax, accounting, food-safety and consumer-law records

Payments

Order value, transaction reference, billing details and payment status

To process and reconcile payments and refunds

Contract; legal obligation; legitimate interests in accurate financial administration

Customer service and complaints

Identity, contact details, order information, messages and evidence supplied

To answer questions, resolve issues, investigate complaints and protect legal rights

Contract; legal obligation; legitimate interests in customer care and dispute management

Contact, wholesale and tasting enquiries

Name, business details, contact information, location, products of interest and message

To assess and respond to enquiries, qualify opportunities, arrange samples or tastings and take requested steps before an agreement

Steps before contract; legitimate interests in developing and managing business relationships

International delivery enquiries

Contact details, requested products and quantities, destination and correspondence

To assess whether a non-UK order can be accepted and provide delivery arrangements

Steps before contract; legitimate interests in responding to requested opportunities

Service communications

Contact and order details

To send receipts, order confirmations, fulfilment updates, safety notices and responses

Contract; legal obligation; legitimate interests in providing reliable service

Newsletters and marketing

Name, email address, consent, preferences and email engagement

To send news, offers, product stories and relevant updates

Consent; where legally permitted, legitimate interests and the electronic-marketing soft opt-in

Abandoned checkout, cart or browse messages

Email address, products viewed or selected and checkout activity

To remind an eligible subscriber or customer about unfinished activity

Consent or electronic-marketing soft opt-in where applicable; legitimate interests in relevant customer communications

Website analytics and improvement

Cookie identifiers, IP address, device, browsing and interaction information

To understand website use, diagnose issues and improve navigation, content and conversion

Consent for non-essential storage and access technologies; legitimate interests in analysing appropriately collected information

Advertising and measurement

Hashed contact identifiers, cookie and device identifiers, browsing, purchase and conversion events

To measure campaigns, attribute conversions, retarget consenting visitors and build relevant audiences

Consent for advertising technologies and associated personalisation

Wishlist

Selected product identifiers, browser local storage and session tokens

To remember products a visitor asks the browser to save

Providing a user-requested function; legitimate interests in offering useful site features

Reviews and user content

Name or chosen display name, review, recipe, image, video and related correspondence

To assess, publish and promote genuine customer experiences and community content

Consent where sought; contract for agreed content use; legitimate interests for genuine reviews, subject to your rights

Events, markets and general imagery

Registration details and photographs or footage

To organise events, document our activities and communicate our work

Contract or steps before contract for registration; legitimate interests for proportionate general event coverage; consent for interviews, testimonials and person-focused promotional content

Competitions, sampling and promotions

Identity, contact details, entry information, eligibility and fulfilment details

To administer participation, select entrants or winners and deliver prizes or samples

Performance of promotion terms; legitimate interests in fair administration; consent for separate marketing

Fraud prevention and security

Order, payment, address, device, network and risk information

To protect customers, our store and payment systems; detect suspicious activity; review risky orders

Recognised legitimate interest in preventing or investigating crime where applicable; legitimate interests in security; legal obligation

Legal and regulatory compliance

Relevant customer, transaction, communication and business records

To meet tax, accounting, consumer, food-safety, regulatory and legal requirements and respond to lawful requests

Legal obligation; legitimate interests in establishing, exercising or defending legal claims

Retailers, suppliers, creators and partners

Professional identity, contact, role, organisation, correspondence and agreement information

To develop, enter into and manage commercial and professional relationships

Contract or steps before contract; legitimate interests in running and growing our business

 Marketing communications

We distinguish marketing from communications required to provide a service.

Order confirmations, dispatch updates, refund information, safety notices and direct responses to enquiries are not general marketing.

We use Shopify’s email and automation tools to manage newsletter subscriptions and marketing communications.

Where double opt-in is enabled, you must confirm your subscription through the verification email before the marketing subscription becomes active.

You can unsubscribe from marketing at any time by:

  • Using the unsubscribe link in a marketing email

  • Changing an available preference setting

  • Emailing contact@melizas.com

Your right to object to direct marketing is absolute.

Unsubscribing from marketing will not prevent us from sending essential communications about an order, complaint, refund or enquiry.

We retain a minimal suppression record after you unsubscribe so that we can respect your decision and avoid adding you back to marketing by mistake.

 Cookies and similar technologies

Our website uses cookies, pixels, tags and local browser storage. Some are necessary for checkout, security, consent choices and requested website functions. Optional technologies support analytics, website improvement, advertising and campaign measurement.

Our current technology environment includes Shopify, Google Analytics, Google Ads, Meta, TikTok and Microsoft Clarity. The final wishlist and loyalty applications remain subject to live-site confirmation. Optional analytics and advertising technologies are controlled through Shopify’s customer-privacy system and should not operate until the required consent has been given. You can reject optional technologies and later change your choice through the cookie settings available on our website.

If a wishlist function is enabled and stores choices locally in your browser, those choices normally remain until you remove them, clear your browser storage or the browser removes them. We will update this wording after the final application has been tested.

Our separate Cookie Policy provides the current cookie names, providers, purposes and durations. Because website technology changes, we update that inventory when the live configuration or an application changes.

 Who we share Personal information with

We share information only where needed for the purposes described in this policy. Recipients may include:

  • Shopify International Limited and affiliated Shopify companies, which host and operate our store, checkout, forms, customer records, email tools and related commerce services.

  • Payment providers, including Shopify Payments and PayPal, and supported wallet or card providers selected at checkout.

  • The delivery, courier or fulfilment provider appointed for an order. We provide only the information required for delivery and related support, which may include the customer’s name, delivery address, contact details, order details and delivery instructions.

  • Website and customer-experience providers. LoyaltyLion Ltd and the final wishlist provider will be named here only if they remain active and process customer information after live-site testing.

  • Analytics and advertising providers, including Google, Meta, TikTok and Microsoft, subject to the relevant consent and privacy settings.

  • Professional advisers and operational service providers, such as accountants, insurers, IT support, legal advisers and secure data-management providers.

  • Regulators, courts, law-enforcement bodies, tax authorities and other public bodies where disclosure is required or permitted by law.

  • A prospective buyer, investor, funder or adviser where necessary for a genuine business transaction, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal information for money. Some advertising platforms may describe certain targeted-advertising disclosures as ‘sharing’ under their own terminology or overseas privacy laws. In the UK, we use optional advertising technologies only in line with the consent choices presented on our website.

 International transfers

Our online checkout currently accepts UK delivery addresses only. However, some of our technology, payment, analytics and advertising providers operate internationally. 

Where personal information is transferred internationally, we require an appropriate legal mechanism. Depending on the country and provider, this may include:

  • UK adequacy regulations

  • The UK International Data Transfer Agreement

  • The UK Addendum to approved Standard Contractual Clauses

  • Another lawful transfer safeguard

You may contact us at contact@melizas.com if you would like information about the safeguard used for a particular transfer.

 How Long We Keep Personal Information 

We retain personal information only for as long as it is reasonably needed for the purpose for which it was collected.

We may retain information for longer where an unresolved complaint, legal claim, product-safety issue, investigation or regulatory requirement makes this necessary.

Information

Normal retention period or criterion

Orders, invoices, payments and accounting records

Generally six years from the end of the financial year to which the record relates

Customer-service messages, returns and complaints

Two years after resolution, or longer if a dispute, safety issue or legal claim remains open

Contact, wholesale and tasting enquiries

Two years after the last meaningful contact, unless a continuing relationship or legal need requires longer

Event, sampling and general promotion enquiries

Normally 12 months after the activity ends, unless an order or continuing relationship follows

Marketing subscription records

Until you unsubscribe, withdraw consent or we determine that the record is no longer active or useful; inactive records are reviewed at least every 24 months

Suppression and objection records

A minimal record for as long as reasonably necessary to honour the unsubscribe or objection

Consent evidence

For as long as we rely on the consent and for an appropriate evidential period afterwards

Birthday information 

Until you remove the birthday preference, withdraw the relevant marketing consent or the associated customer record is no longer active or required. 

Google Analytics user and event data

Two months under the current GA4 configuration; standard aggregated reporting may not be affected by that setting

Microsoft Clarity session recordings and heatmap telemetry

Normally 30 days under the current configuration, subject to Microsoft’s service rules

Wishlist browser storage

Until you remove the item, clear browser storage or the browser removes the stored data

Reviews, recipes, photographs, videos and testimonials 

For as long as the content remains relevant and is being used lawfully.Content use is reviewed at least every two years and earlier where permission is withdrawn and consent is the applicable basis.

Competition and giveaway information

Normally six months after completion, except winner, tax or dispute records that must be retained longer

Fraud, security and risk records

For the provider’s documented period and as long as reasonably necessary to investigate, prevent or respond to risk
10. Fraud checks automated analysis and profiling

Shopify Payments and related payment services may use automated tools to assess transactions for fraud and security risks.

These tools may consider:

  • Address-verification results

  • Card-security results

  • Transaction patterns

  • IP location

  • Device and network information

  • Previous fraud or risk indicators

An order may receive a low, medium or high risk rating for review.

Meliza’s may use these indicators to determine whether an order requires further checking before dispatch.

We do not intend to make decisions that have a legal or similarly significant effect on you solely through our own automated processing.

If a payment provider declines a payment or an order is held for review, you may contact us and ask for the matter to be reviewed.

 Children and Customer Content 

Our website and services are not directed towards children, and we do not knowingly collect personal information directly from children.

Orders and general enquiry forms should be completed by an adult.

If we discover that we have collected a child’s information inappropriately, we will take reasonable steps to delete it.

Customers must not submit identifiable images, videos or personal information about a child unless they have appropriate authority from the child’s parent or legal guardian.

If you believe that content involving a child has been shared with us inappropriately, contact us at info@melizas.com.

 Security 

We use proportionate organisational and technical measures intended to protect personal information against:

  • Loss

  • Misuse

  • Unauthorised access

  • Unauthorised disclosure

  • Alteration

  • Destruction

These measures include:

  • Restricted administrative access

  • Authenticated Shopify collaborator access

  • Payment handling through established payment providers

  • Secure website connections

  • Masking of sensitive fields in session-analysis tools

  • Staff access limited to genuine business needs

No online service can guarantee absolute security.

If we identify a personal-data breach, we will investigate it and notify affected individuals and the Information Commissioner’s Office where the law requires us to do so.

 Your Data Protection Rights and Complaints 

Depending on the circumstances and the lawful basis involved, you may have the right to:

  • Ask for access to the personal information we hold about you.

  • Ask us to correct information that is inaccurate or incomplete.

  • Ask us to delete information where there is no lawful reason to continue holding it.

  • Ask us to restrict how information is used in certain circumstances.

  • Object to processing based on legitimate interests.

  • Object at any time to the use of your information for direct marketing.

  • Ask to receive certain information in a structured, commonly used and machine-readable format, or have it transferred where applicable.

  • Withdraw consent at any time where we rely on consent. This does not affect processing already carried out lawfully before withdrawal.

  • Ask for human review and challenge a qualifying decision made solely by automated means.

Withdrawing consent does not affect processing that was carried out lawfully before the withdrawal.

To exercise a right, email contact@melizas.com and explain what you are requesting.

We may ask for information needed to verify your identity and protect your personal information.

There is normally no fee. However, the law permits a reasonable fee or refusal in limited circumstances involving requests that are manifestly unfounded or excessive.

We will respond within the period required by law.

Complaints

Please contact us first if you are concerned about how we have used your information. Email contact@melizas.com. We will acknowledge and investigate the complaint and communicate the outcome without undue delay in accordance with applicable requirements.

You also have the right to complain to the UK Information Commissioner’s Office.

Information Commissioner’s Office
 Telephone: 0303 123 1113
 www.ico.org.uk/make-a-complaint

 Changes to this policy

We review this policy when our services, applications or legal obligations change. We will publish the updated version on our website and change the effective date above. If a change materially affects how we use information, we will take reasonable steps to bring it to the attention of affected people and seek new consent where required.