Privacy Policy

Last updated: 19 October 2026

Milo Moreau Limited operates the Milo Moreau online store and website, including its content, features, products, and services (the “Services”). Our store is hosted by Shopify.

This Privacy Policy explains how we collect, use, disclose, and otherwise process personal data when you visit or use our Services, place an order, or contact us.

Where applicable data protection law requires it, Milo Moreau Limited is the controller of your personal data. Shopify and other service providers may process personal data on our behalf. Shopify may also process certain data as an independent controller under its own privacy terms. Shopify

1. Personal Data We Collect

The personal data we collect depends on how you use the Services. It may include:

• Contact details: your name, email address, phone number, billing address, and delivery address.
• Order and transaction details: products viewed, added to your cart, purchased, returned, exchanged, or cancelled; order history; delivery details; and communications about an order.
• Payment details: payment method and transaction information. Payments are processed by payment providers. We may receive payment confirmations and limited payment details, but we do not necessarily receive or store full payment-card information.
• Account details: username, password, and account preferences, if you create an account.
• Messages you send us: information you include when contacting customer support or otherwise communicating with us.
• Device and usage data: information such as your IP address, browser type, device identifiers, network information, and how you interact with the website.
• Cookie and similar technology data: information collected through cookies and similar technologies, as described in our cookie settings and the section below.

We do not intentionally request sensitive personal data for ordinary shopping.

2. How We Collect Personal Data

We may collect personal data:

• Directly from you, when you place an order, create an account, contact us, or otherwise provide information.
• Automatically through the Services, including through your device, browser, cookies, and similar technologies.
• From service providers, such as Shopify, payment processors, delivery providers, and technical service providers that help operate the store.
• From business or marketing partners, where you interact with them or where you have given any required permission.

3. How We Use Personal Data

We use personal data for the following purposes, where applicable:

• To provide the Services and fulfil orders, including processing payments, arranging delivery, managing accounts, handling returns and exchanges, and providing customer support.
• To operate and improve the store, including saving your preferences, understanding how the Services are used, and improving products and the shopping experience.
• To communicate with you, including responding to enquiries and sending order, delivery, account, or service messages.
• For marketing, such as sending promotional emails or showing advertising. We will obtain consent where required by law. You can unsubscribe from promotional emails at any time using the link in the email. You may still receive non-promotional messages about orders or your account.
• For security and fraud prevention, including verifying transactions, protecting accounts, and detecting or investigating suspected fraud or misuse.
• To comply with legal obligations and establish, exercise, or defend legal claims.

4. Legal Bases for Processing in the EEA

If the GDPR applies to our processing, we rely on one or more of these legal bases, depending on the purpose:

• Contract: processing needed to take steps at your request, fulfil your order, or provide account or customer services.
• Legal obligation: processing needed to comply with applicable laws, such as tax, accounting, or record-keeping requirements.
• Legitimate interests: processing needed to operate, secure, and improve our business, prevent fraud, and handle customer enquiries, provided those interests are not overridden by your rights.
• Consent: processing based on your consent, such as certain marketing or non-essential cookies. You can withdraw consent at any time. Withdrawal does not affect processing that took place before you withdrew it.

The GDPR requires a controller to explain the purposes and legal bases for processing, along with other information about data use and transfers. EUR-Lex

5. Cookies and Similar Technologies

Our website and Shopify may use cookies and similar technologies to operate the store, remember preferences, understand website activity, and support marketing or advertising.

Where required by law, non-essential cookies and similar technologies will only be used after you give consent. You can manage your choices through the cookie banner or [insert link to cookie settings]. Blocking some cookies may affect how parts of the website work.

The cookies and technologies actually used can depend on your Shopify settings and the apps installed in the store. The European Data Protection Board explains that cookie consent requirements may apply under both the GDPR and ePrivacy rules. European Data Protection Board

6. How We Disclose Personal Data

We may disclose personal data, where necessary, to:

• Shopify, which hosts and supports our online store.
• Payment providers, to process payments and prevent fraud.
• Delivery and fulfilment providers, to prepare and deliver orders and handle returns.
• Technical and business service providers, such as providers of hosting, analytics, customer support, security, or cloud services.
• Marketing and advertising providers, where we use those services and have a lawful basis to do so.
• Authorities or other parties, when required by law or when reasonably necessary to protect rights, safety, or the Services.
• A successor or transaction partner, if our business is involved in a sale, restructuring, or similar transaction.

Service providers that process personal data on our behalf are expected to handle it under appropriate contractual terms. Some providers, including Shopify, may separately process certain data under their own privacy policies and legal responsibilities. Shopify provides information about its data processing and privacy practices on its website. Shopify

7. International Data Transfers

Milo Moreau Limited is registered in Hong Kong. Personal data may therefore be transferred to, stored in, or accessed from Hong Kong and other countries where Shopify or our service providers operate.

When the GDPR applies and personal data is transferred outside the European Economic Area to a country without an applicable adequacy decision, we will use an appropriate transfer mechanism where required, such as the European Commission’s Standard Contractual Clauses, and take any additional steps required by law. You may contact us to ask for further information about applicable safeguards.

8. Data Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, fulfil orders, meet legal and accounting obligations, resolve disputes, and enforce agreements.

The retention period depends on the type of data, why it was collected, and any applicable legal requirements. When personal data is no longer needed, we will delete it or take steps to anonymise it where appropriate.

9. Your Rights

Depending on where you live and subject to applicable legal conditions and exceptions, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data.
• Request restriction of processing.
• Object to certain processing, including processing based on legitimate interests or for direct marketing.
• Receive certain personal data in a portable format or ask us to transmit it to another organisation.
• Withdraw consent where processing is based on consent. Withdrawal does not affect processing that took place before withdrawal.
• Lodge a complaint with your local data protection supervisory authority.

You can exercise these rights by contacting us using the details below. We may need to verify your identity before responding. You will not be treated unfairly for exercising your rights.

Shopify may be responsible for responding to requests about personal data it processes as an independent controller. You can also review Shopify’s privacy information and submit relevant requests through its privacy portal at https://privacy.shopify.com/en.

10. Children’s Data

Our Services are not intended for children who are not legally able to make purchases or use the Services under the laws that apply where they live. We do not knowingly collect personal data from children in breach of applicable law. If you believe a child has provided us with personal data, contact us so we can review the matter and take appropriate steps.

11. Third-Party Websites

Our Services may contain links to websites or platforms operated by third parties. Their privacy practices are governed by their own policies. We are not responsible for the privacy, security, or content of third-party services that we do not operate.

12. Security

We use reasonable safeguards designed to protect personal data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our practices, services, or legal requirements. We will post the updated version on this page and revise the “Last updated” date. Where required by law, we will provide additional notice.

14. Contact Us

For questions about this Privacy Policy or to exercise your data protection rights, contact:

Milo Moreau Limited
Email: support@milomoreau.com
Unit B5, 11th Floor, Wing Was Building
No. 677 Kings Road, Quarry Bay
Hong Kong Island, Hong Kong