Privacy policy

We keep your data like we keep our ingredient list: short and honest. This policy explains what personal data TALO MALO collects, why, and your rights under UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

Who we are

Talo Malo is a trading name of Tupa Enterprises Ltd, a company registered in Scotland (company number SC717344). Registered office: 1 Cambuslang Court, Cambuslang, Glasgow, G32 8FH. Trading address: Unit 11 Telford Court, Clydebank Business Park, Clydebank, G81 2NR. Tupa Enterprises Ltd is the data controller for the personal data described here. Contact: hello@talomalo.co.uk

What we collect and why

  • Name, email, delivery and billing address, phone (if given) and order details: to take, deliver and support your order, including changes, returns and refunds. Lawful basis: contract.
  • Payment details: taken and processed by our payment providers (Shopify Payments / Shop Pay, PayPal). We don't see or store your full card details. Lawful basis: contract.
  • Order and tax records: to meet our legal and accounting obligations. Lawful basis: legal obligation.
  • Messages you send us (email, the website contact form, the video submission form): to reply and deal with your request. Lawful basis: legitimate interests.
  • Reviews you leave (name, rating, review text and any photos): to publish reviews on our site via Judge.me. Lawful basis: consent (you choose to leave a review).
  • Founding 100 claim details: to run the offer, including checking one jar per household. Lawful basis: contract.
  • Device and browsing data (pages viewed, IP address, browser, cookies): to run the site securely, understand how it's used and measure marketing. Lawful basis: strictly necessary for the site to work; consent for analytics and marketing.

Who we share it with

  • Shopify: our online store platform, checkout, payments and store analytics.
  • Payment providers: Shopify Payments / Shop Pay and PayPal, to take payment.
  • Royal Mail: to deliver your order and send tracking updates.
  • Judge.me: product reviews and review request emails. Its pixel (the only tracking pixel installed on our site) measures how reviews are viewed and used.
  • Google Fonts: loads our website fonts; your browser connects to Google's servers, which receive your IP address.
  • Authorities, when the law requires it.

We don't sell your personal data.

International transfers

Some of these providers process data outside the UK. Where they do, we rely on the safeguards UK law allows, such as UK adequacy regulations or the UK International Data Transfer Agreement / Addendum.

How long we keep it

  • Order and accounting records: 6 years, as HMRC requires.
  • Customer service messages: 2 years.
  • Reviews: until you ask us to remove them.

Cookies (PECR)

We use cookies that are strictly necessary for the site and checkout to work. Analytics and marketing cookies or pixels are only used with your consent, which you can change at any time through the "Cookie preferences" link in our website footer.

Marketing

We only send marketing emails if you've opted in, and every email has an unsubscribe link. Order and delivery emails aren't marketing and will still be sent.

Your rights

Under UK GDPR you can ask to access, correct, delete or restrict your data, object to how we use it, ask for a copy to take elsewhere, and withdraw consent at any time. Email hello@talomalo.co.uk and we'll respond within one month. If you're not happy, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes

We'll update this policy if what we do changes. The latest version is always on this page. Last updated: 7 October 2026.