Privacy Policy

The Nourish Collective runs this store and website — along with all related content, features, tools, products, and services (the "Services") — to give customers in Malta and Gozo a curated shopping experience. We use Shopify as our platform to deliver these Services. This policy explains how we collect, use, and share your personal information when you browse, use, or buy something through our Services, or when you contact us. If anything in our Terms of Service conflicts with this Privacy Policy, this Privacy Policy takes priority when it comes to how we handle your personal information.

Please read this policy carefully. By using our Services, you're confirming that you understand how we collect, use, and share your information as described here.

Personal Information We Collect

"Personal information" means information that identifies you or could reasonably be tied back to you. It doesn't include anonymous or de-identified data. As a Malta- and Gozo-based store, we may collect:

• Contact details — name, billing/shipping address, phone number, email
• Financial information — card numbers, payment details, transaction records
• Account information — username, password, security questions, preferences
• Transaction history — items viewed, carted, wishlisted, purchased, returned, or exchanged
• Communications — anything you tell us, like in a support request
• Device information — browser, network, IP address, and other identifiers
• Usage data — how and when you interact with our Services

Where This Information Comes From

• Directly from you (creating an account, using the site, contacting us)
• Automatically, through your device and technologies like cookies
• From service providers who help us run the Services
• From partners or other third parties

How We Use Your Information

• Running and improving the Services: processing orders and payments, managing your account, arranging local delivery within Malta and Gozo, handling returns, enabling reviews, and personalizing recommendations
• Marketing: sending promotional emails, texts, or mail, and showing you targeted ads based on your activity
• Security: verifying your identity, preventing fraud, and keeping transactions safe. You're responsible for keeping your login details private
• Customer support: responding to you and maintaining our relationship
• Legal compliance: meeting our obligations under Maltese and EU law, responding to law enforcement, handling disputes, and enforcing our policies

Who We Share It With

• Shopify and other vendors who support our operations (IT, payments, analytics, support, storage, delivery)
• Marketing partners, including through Shopify's personalized advertising tools that may combine your activity across other merchants. You have the right to opt out of this
• Third parties when you ask us to (e.g., delivery providers or social media integrations)
• Parties involved in a business transaction (such as a sale of the business) or as needed to comply with law, enforce our terms, or protect our rights and users

Our Relationship with Shopify

Shopify hosts our Services and helps us process data to run and improve them smoothly. As with any Shopify-powered store, this may occasionally involve routine technical processing through Shopify's wider infrastructure. Shopify also offers optional enhanced features using aggregated data from across its merchant network, including ours. For those specific features, Shopify is responsible for handling your information and any related rights requests. You can learn more in Shopify's Consumer Privacy Policy, and you may be able to exercise rights directly through Shopify's Privacy Portal.

Links to Other Sites

We may link to third-party websites we don't control. We're not responsible for their privacy or security practices — review their policies separately before sharing information. Anything you post publicly (including on social platforms) may be seen and used by others outside our control. A link doesn't mean we endorse that site.

Children's Privacy

Our Services aren't meant for children, and we don't knowingly collect data from children under the age of majority. If your child has shared personal information with us, contact us to request its deletion. We currently have no knowledge of selling or sharing data belonging to anyone under 16.

Security and Data Retention

No system is completely secure, and information sent to us may not be protected in transit — avoid sending sensitive details through unsecured channels. How long we keep your data depends on factors like account maintenance, service delivery, legal obligations, and dispute resolution needs.

Your Rights

As a Malta-based customer, you're protected under the GDPR and Maltese data protection law. You have the right to:

• Access or know what data we hold about you
• Delete your data
• Correct inaccurate data
• Receive a copy of your data or have it transferred elsewhere
• Object to or restrict certain processing
• Withdraw consent at any time (without affecting past processing done under that consent)
• Manage your marketing preferences (you can unsubscribe anytime, though we may still send non-promotional account/order emails)

To exercise these rights, contact us using the details below, or visit Shopify's privacy page for rights related to Shopify's own processing. We won't penalize you for exercising your rights, though we may need to verify your identity first. You can also authorize someone else to act on your behalf, provided they can prove that authorization.

Complaints

If you're unhappy with how we've handled your data, contact us directly. You may also file a complaint with Malta's data protection authority, the Information and Data Protection Commissioner (IDPC).

Policy Updates

We may revise this policy periodically to reflect changes in our practices or legal requirements. Updates will be posted here with a new "Last updated" date, along with any additional notice required by law.

Contact Us

Questions about this policy or want to exercise your rights? Reach us at hello@thenourishcollective.net. As a sole trader, I am the data controller for your personal information under applicable law.