Privacy policy

Privacy Policy

Last Updated: 04 July 2026

Introduction

Milk and Moon ("we", "us", "our") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, disclose and protect your personal information when you visit our website, place an order, interact with us, or otherwise use our products and services.

Our website and online store are powered by Shopify, which provides the e-commerce platform through which we sell our products and services.

Milk and Moon complies with the Information Privacy Principles contained in the Privacy Act 2020 (New Zealand) and is committed to handling personal information in a transparent, responsible and secure manner.

By accessing our website or using our services, you acknowledge that you have read and understood this Privacy Policy.

Who We Are

Milk and Moon operates this website and related services, including the sale and delivery of curated gift boxes and associated products.

Contact Details

Milk and Moon
15 Hebron Road
Waiake, Auckland 0630
New Zealand

Email: hello@milkandmoon.co.nz

Information We Collect

We collect personal information that is reasonably necessary to provide our products and services, comply with legal obligations, protect our legitimate business interests, or where you have provided your consent.

Depending on how you interact with us, we may collect the following types of information.

Contact Information

· Name

· Billing address

· Delivery address

· Email address

· Telephone number

Order and Transaction Information

· Products purchased

· Order history

· Delivery instructions

· Gift messages

· Returns, refunds and exchanges

· Payment confirmations

Payment Information

Payments are processed through secure third-party payment providers.

Milk and Moon does not store complete credit card details on its own systems.

Account Information

If you create an account with us, we may collect:

· Username

· Password

· Account preferences

· Saved addresses

Communications

Information provided when you:

· Contact customer support

· Submit enquiries

· Participate in promotions or surveys

· Leave reviews or testimonials

· Communicate with us by email, social media, SMS, or other channels

Technical Information

When you use our website, we may automatically collect:

· IP address

· Browser type

· Device information

· Session information

· Website usage data

· Referring websites

· Location information derived from your IP address

Dietary Preferences and Allergy Information

Where necessary to fulfil an order or respond to an enquiry, we may collect information relating to dietary requirements, food preferences, allergies, or product preferences provided by you.

Customers are responsible for ensuring any information supplied is accurate and complete.

While we take reasonable care in selecting and describing products, some items are supplied by third-party manufacturers. Customers should always review ingredient information and product packaging before consumption.

Information About Gift Recipients

When you place an order for delivery to another person, you may provide us with personal information relating to the recipient, including:

· Name

· Delivery address

· Telephone number

· Email address

· Gift message

· Delivery instructions

By providing information about another individual, you confirm that you have the authority to provide that information and, where required, have informed them that their information will be provided to Milk and Moon for the purposes described in this Privacy Policy.

We use recipient information solely for processing, fulfilling, delivering and supporting orders, or as otherwise required by law.

Why We Collect Your Information

We may use your personal information to:

· Process and fulfil orders.

· Deliver products and services.

· Provide customer support.

· Administer refunds, returns and exchanges.

· Process payments.

· Verify transactions and prevent fraud.

· Improve our products, services and website.

· Manage customer accounts.

· Respond to enquiries.

· Conduct internal business analysis.

· Comply with legal obligations.

· Maintain business records.

· Send marketing communications where permitted by law.

If you choose not to provide certain information, we may not be able to provide some products, services, or features.

Marketing Communications

Where permitted by law, we may send promotional communications about our products, services, offers and events.

You may unsubscribe at any time by:

· Clicking the unsubscribe link in our emails.

· Contacting us directly.

We may continue to send non-promotional communications relating to orders, accounts, customer service matters, or legal obligations.

SMS Communications

Where permitted by law, we may communicate with you via SMS or other messaging platforms regarding orders, delivery updates, promotional offers or other services.

You may opt out of promotional SMS communications at any time by following the instructions in the message or contacting us directly.

Cookies, Analytics and Advertising Technologies

We use cookies and similar technologies to:

· Enable website functionality.

· Remember preferences.

· Improve website performance.

· Analyse website traffic.

· Understand customer behaviour.

· Measure advertising performance.

· Deliver relevant advertising and marketing communications.

We may use third-party services including:

· Google Analytics

· Google Ads

· Meta Ads, including Facebook and Instagram advertising tools

· Klaviyo

· Shopify Analytics and related Shopify services

These providers may collect information using cookies, web beacons, tags, pixels and similar technologies.

Information collected may be used to:

· Analyse user behaviour.

· Improve our website and customer experience.

· Build audiences for remarketing campaigns.

· Deliver personalised advertisements across digital platforms.

You can control cookies through your browser settings. However, disabling cookies may affect website functionality.

Shopify and Third-Party Service Providers

Our store is hosted by Shopify.

We also engage trusted third-party providers to assist with:

· Website hosting

· Payment processing

· Fraud prevention

· Email communications

· Marketing services

· Analytics

· Order fulfilment

· Shipping and courier services

· Customer support

These providers may access personal information only as necessary to provide services on our behalf or as otherwise permitted by law.

For information about Shopify's privacy practices, please refer to Shopify's Privacy Policy.

Disclosure of Personal Information

We may disclose personal information to:

· Shopify and related service providers.

· Payment processors.

· Shipping and courier providers.

· Marketing and advertising providers.

· IT service providers.

· Professional advisers including lawyers, accountants and consultants.

· Government agencies, regulators, law enforcement bodies or courts where required by law.

We do not sell personal information to third parties.

Reviews, Testimonials and User Content

If you provide reviews, testimonials, feedback, photographs, social media content or other materials to us, you acknowledge that we may publish, display, reproduce or share that content in connection with our business, products, services, website, social media platforms and promotional activities.

Please do not include personal information that you do not wish to be publicly displayed.

Overseas Disclosure of Information

Some of our service providers may store or process personal information outside New Zealand.

Where personal information is transferred overseas, we take reasonable steps to ensure that recipients protect personal information in a manner comparable to the requirements of the Privacy Act 2020.

International Storage and Processing

Because we use Shopify and other cloud-based service providers, personal information may be stored or processed in:

· New Zealand

· Australia

· United States

· Canada

· Singapore

· Other jurisdictions in which our service providers operate

The countries involved may change from time to time depending on the locations of our service providers.

Security of Personal Information

We take reasonable steps to protect personal information against:

· Loss

· Misuse

· Unauthorised access

· Unauthorised disclosure

· Alteration

· Destruction

However, no method of electronic transmission or storage is completely secure and we cannot guarantee absolute security.

Retention of Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting and business record requirements.

Unless a longer retention period is required by law:

· Customer order and transaction records are generally retained for up to seven years.

· Marketing subscription records are retained until you unsubscribe or request deletion.

· Customer service records may be retained as reasonably necessary to support our business operations.

When personal information is no longer required, we will take reasonable steps to securely destroy, delete or de-identify it.

Privacy Breaches

If we become aware of a privacy breach involving personal information that is likely to cause serious harm, we will comply with our obligations under the Privacy Act 2020, including notifying affected individuals and the Office of the Privacy Commissioner where required.

Your Rights

Under the Privacy Act 2020, you have the right to:

Access Your Information

Request confirmation of whether we hold personal information about you and request access to that information.

Correct Your Information

Request correction of personal information that you believe is inaccurate, incomplete or out of date.

Withdraw Marketing Consent

Opt out of receiving promotional communications at any time.

To exercise these rights, please contact us using the details provided below.

We may need to verify your identity before responding to your request.

Children's Privacy

Our products and services are intended for adults.

We do not knowingly collect personal information from children under the age of 16 without appropriate parental or guardian involvement.

If you believe a child has provided us with personal information without appropriate consent, please contact us.

Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy or security practices of external websites and encourage users to review the privacy policies of those websites before providing personal information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations or services.

Any updates will be published on this website and the "Last Updated" date will be amended accordingly.

Continued use of our website and services following publication of changes constitutes acceptance of the updated Privacy Policy.

Contact and Complaints

If you have any questions, requests or concerns regarding this Privacy Policy or your personal information, please contact:

Privacy Officer
Milk and Moon
15 Hebron Road
Waiake, Auckland 0630
New Zealand