Privacy policy

Last updated: 15th July 26

This Privacy Policy explains how Megumi Sabo collects, uses, stores and shares personal information when you:

• Visit our website.
• Purchase a product.
• Create or use an account.
• Contact us.
• Subscribe to email or SMS marketing.
• Interact with our advertisements.
• Engage with us through social media.
• Enter a competition, promotion or survey.

We are committed to handling personal information fairly, lawfully and transparently.

1. Who We Are

The data controller responsible for your personal information is:

Full legal business name: Megumi Sabo LTD
Trading name: Megumi Sabo

In this Privacy Policy, “Megumi Sabo”, “we”, “us” and “our” refer to the business identified above.

2. The Personal Information We Collect

The information we collect depends on how you interact with us.

Identity information

This may include:

• Your name.
• Your title.
• Your date of birth or age where relevant.
• Your account username.

Contact information

This may include:

• Your email address.
• Your telephone number.
• Your billing address.
• Your delivery address.
• Your social media username.

Order and transaction information

This may include:

• Products purchased or viewed.
• Order number.
• Purchase date.
• Order value.
• Delivery method.
• Returns, refunds and complaints.
• Discount or promotional codes used.
• Limited payment information supplied by our payment provider.

We do not normally receive or store your complete payment card number.

Account information

Where customer accounts are available, we may collect:

• Your login information.
• Your saved addresses.
• Your order history.
• Your preferences.
• Your account activity.

Marketing information

This may include:

• Whether you have agreed to receive email marketing.
• Whether you have agreed to receive SMS marketing.
• When and how consent was obtained.
• Messages sent to you.
• Whether a message was delivered, opened or clicked.
• Products or promotions you appear to be interested in.
• Your unsubscribe or opt-out choices.
• Your communication preferences.

Website and device information

This may include:

• Internet Protocol address.
• Browser type and version.
• Device type.
• Operating system.
• Time zone.
• Approximate location.
• Pages visited.
• Links clicked.
• Products viewed.
• Cart activity.
• Checkout activity.
• Referral source.
• Session identifiers.
• Cookie identifiers.
• Advertising identifiers.
• Website error and performance information.

Advertising information

When you interact with our advertisements or visit our website after seeing an advertisement, we may collect or receive information such as:

• The advertisement you viewed or clicked.
• The campaign associated with your visit.
• Whether you viewed a product, added an item to your basket or completed an order.
• Cookie or device identifiers.
• Conversion and attribution information.
• Audience or interest categories generated by advertising platforms.

Customer service information

This may include:

• Emails, messages and other correspondence.
• Enquiries and complaints.
• Call notes.
• Information you provide when requesting support.
• Photographs or videos supplied in relation to a damaged or defective product.

Social media information

If you interact with us through a social media platform, we may receive:

• Your public profile information.
• Your username.
• Your comments, reactions or messages.
• Information you choose to share with us.

Reviews and user-generated content

We may collect reviews, photographs, videos, testimonials and other content you submit.

Competition and promotion information

Where you enter a competition or promotion, we may collect your contact details, entry details, eligibility information and prize-delivery details.

3. How We Collect Information

We collect personal information:

Directly from you

For example, when you:

• Place an order.
• Create an account.
• Contact us.
• Subscribe to marketing.
• Complete a form.
• Enter a promotion.
• Submit a review.
• Respond to a survey.

Automatically

We may automatically collect information when you use our website through cookies, pixels, tags, software development kits and similar technologies.

From service providers

We may receive information from providers that support:

• Website hosting.
• Ecommerce transactions.
• Payment processing.
• Delivery.
• Email marketing.
• SMS marketing.
• Analytics.
• Customer support.
• Fraud prevention.
• Advertising.

From advertising and social media platforms

We may receive aggregated, pseudonymised or identifiable information from platforms such as Meta where you interact with our advertisements or social media accounts.

From publicly available sources

Where appropriate and lawful, we may receive business contact information from public websites, social media profiles or public records.

4. How We Use Personal Information

We may use personal information for the following purposes.

To process and deliver orders

This includes:

• Confirming your order.
• Processing payment.
• Packaging and delivering products.
• Providing delivery updates.
• Processing returns and refunds.
• Preventing fraudulent transactions.

Our lawful bases are normally performance of a contract and compliance with legal obligations.

To provide customer service

This includes:

• Responding to enquiries.
• Investigating complaints.
• Resolving delivery or product issues.
• Managing returns and refunds.
• Keeping records of customer interactions.

Our lawful bases may be performance of a contract, compliance with legal obligations and our legitimate interests in providing effective customer support.

To manage our website and accounts

This includes:

• Creating and administering customer accounts.
• Maintaining website security.
• Diagnosing technical problems.
• Preventing misuse.
• Maintaining website functionality.

Our lawful bases may be performance of a contract and our legitimate interests in operating a secure and effective website.

To send service communications

We may send non-marketing communications such as:

• Order confirmations.
• Dispatch and delivery updates.
• Payment information.
• Product safety notices.
• Changes affecting your order.
• Responses to customer service requests.
• Important changes to our policies.

These communications are necessary to provide the service you have requested and are not optional marketing messages.

To send email marketing

Where permitted, we may send emails about:

• New products.
• Product restocks.
• Recipes and preparation guidance.
• Educational content.
• Offers and discounts.
• Events.
• Competitions.
• Brand news.
• Abandoned baskets or incomplete checkouts.

We will normally rely on your consent.

In limited circumstances, we may rely on the soft opt-in where:

• We obtained your contact details during a sale or genuine sales negotiation.
• We market our own similar products.
• We gave you a clear opportunity to opt out when your information was collected.
• We include a clear opt-out option in every subsequent message.

You may unsubscribe at any time using the link in an email or by contacting us.

To send SMS marketing

Where you have given appropriate consent, we may send marketing text messages about:

• Product launches.
• Restocks.
• Offers and promotions.
• Abandoned baskets.
• Events.
• Competitions.
• Brand updates.

Consent to SMS marketing is not a condition of purchasing from us.

You may opt out at any time by following the instructions in the message, such as replying STOP, or by contacting us.

Standard network charges may apply depending on your mobile provider.

To personalise our communications

We may use your order history, browsing activity, marketing engagement and preferences to personalise:

• Product recommendations.
• Email content.
• SMS content.
• Website content.
• Promotional offers.
• Advertising audiences.

Our lawful bases may be consent or our legitimate interests, depending on the data and technology involved.

To advertise our products

We may use advertising services, including Meta advertising, to:

• Display advertisements.
• Measure advertisement performance.
• Understand whether an advertisement led to a website visit or purchase.
• Create audiences for advertising.
• Retarget website visitors, where consent has been provided where required.
• Exclude existing customers from certain campaigns.
• Find audiences with similar characteristics to existing customers.

Where advertising technology accesses or stores information on your device, we will request consent unless an applicable legal exception applies.

To measure website and marketing performance

We may analyse:

• Website visits.
• Traffic sources.
• Product views.
• Basket activity.
• Purchases.
• Email opens and clicks.
• SMS engagement.
• Advertisement conversions.
• Campaign performance.

This helps us understand how our website and marketing are performing.

Depending on the technology used, we may rely on consent or our legitimate interests.

To prevent fraud and protect our business

We may process information to:

• Verify transactions.
• Detect suspicious activity.
• Enforce our Terms and Conditions.
• Protect customers and our systems.
• Establish, exercise or defend legal claims.

Our lawful bases may be our legitimate interests and compliance with legal obligations.

To meet legal and regulatory obligations

We may use and retain information where necessary for:

• Tax and accounting requirements.
• Product safety obligations.
• Food traceability.
• Responding to lawful requests from authorities.
• Consumer protection requirements.
• Legal disputes.

Our lawful basis is compliance with a legal obligation.

5. Our Lawful Bases

Depending on the circumstances, we process personal information under one or more of the following lawful bases:

Contract

Processing is necessary to enter into or perform a contract with you, such as processing an order.

Legal obligation

Processing is necessary to comply with a legal requirement, including tax, accounting, consumer protection and product safety obligations.

Legitimate interests

Processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights.

Our legitimate interests may include:

• Operating and improving our business.
• Providing customer service.
• Protecting our website and customers.
• Understanding business performance.
• Preventing fraud.
• Maintaining appropriate business records.
• Promoting our products in a proportionate and lawful manner.

Consent

We may rely on your consent for activities such as:

• Email marketing.
• SMS marketing.
• Non-essential advertising cookies.
• Certain analytics technologies.
• Certain forms of personalisation.

You may withdraw consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

Legal claims and vital interests

In rare circumstances, we may process information where necessary to protect a person’s vital interests or to establish, exercise or defend legal claims.

6. Email and SMS Marketing

We will not send marketing emails or SMS messages to individuals unless we have a lawful basis and meet applicable electronic marketing requirements.

Our marketing sign-up forms should:

• Clearly identify Megumi Sabo as the sender.
• Explain the types of messages you will receive.
• Use separate consent choices where appropriate.
• Avoid pre-ticked marketing boxes.
• Record when and how consent was obtained.
• Provide a clear way to unsubscribe.

You may withdraw from:

• Email marketing by selecting the unsubscribe link.
• SMS marketing by following the opt-out instructions in the message.
• Either channel by contacting us at [INSERT PRIVACY OR CUSTOMER SERVICE EMAIL].

Opting out of marketing will not prevent us from sending necessary order or service communications.

We may keep a minimal suppression record so that we can honour your opt-out request and avoid contacting you again through the relevant channel.

7. Meta Advertising

We may use services provided by Meta Platforms, including Meta Ads, the Meta Pixel and related conversion or measurement technologies.

Subject to your cookie choices, these technologies may allow us and Meta to:

• Recognise that your browser or device visited our website.
• Record actions such as viewing a product, adding an item to your basket or completing a purchase.
• Measure the performance of advertisements.
• Attribute purchases or other actions to campaigns.
• Show advertisements to previous website visitors.
• Build or refine advertising audiences.
• Limit how frequently an advertisement is shown.

Meta may process information under its own privacy terms and may combine information received from our website with information from other services.

Where we upload customer information to an advertising platform, such as an email address or telephone number for audience matching, we will only do so where we have an appropriate lawful basis. Information may be hashed before being transmitted, but hashing does not necessarily make the information anonymous.

You can control advertising cookies through our cookie consent tool and may also be able to adjust advertising preferences through your Meta account.

8. Cookies and Similar Technologies

Cookies are small files stored on your browser or device. We may also use pixels, tags, local storage and similar technologies.

Strictly necessary technologies

These technologies are required for essential website functions such as:

• Maintaining your shopping basket.
• Processing checkout.
• Securing the website.
• Remembering privacy choices.
• Preventing fraud.
• Enabling account login.

These technologies do not normally require consent where they are strictly necessary.

Analytics technologies

Analytics technologies help us understand how people use our website, including which pages are visited and whether errors occur.

Where required, we will only activate non-essential analytics after you provide consent.

Advertising technologies

Advertising technologies may be used to:

• Measure conversions.
• Attribute purchases to advertisements.
• Retarget website visitors.
• Personalise advertisements.
• Build advertising audiences.

We will request consent before using non-essential advertising technologies unless a legal exception applies.

Preference technologies

These technologies remember choices such as language, region and website preferences.

Managing cookies

You can manage non-essential cookies through the cookie banner or consent tool displayed on our website.

You can also configure your browser to block or delete cookies. Blocking some cookies may affect website functionality.

Further details about the specific cookies we use, their providers and durations should be provided through our cookie consent tool or a separate Cookie Policy.

9. Who We Share Information With

We may share personal information with carefully selected service providers that support our business.

These may include:

Ecommerce and hosting providers

For example, Shopify and associated service providers that host and operate our online store.

Payment providers

Payment providers process payments and may conduct fraud and security checks.

Delivery providers

We share your name, delivery address and contact details with couriers and fulfilment providers where necessary to deliver your order.

Email marketing providers

We may use an email service provider to store subscriber information, send campaigns and measure engagement.

Provider currently used: Klaviyo

SMS marketing providers

We may use an SMS platform to store subscriber information and send text messages.

Provider currently used: Klaviyo

Advertising providers

We may share information with advertising and social media platforms, including Meta, to deliver and measure advertising.

Analytics providers

We may use analytics providers to understand website and marketing performance.

Providers currently used: Meta, Google and Shopify

Professional advisers

We may share information with accountants, insurers, auditors, consultants and legal advisers where necessary.

Technology and security providers

We may share information with providers that support website security, fraud prevention, data storage, customer service and technical operations.

Authorities and regulators

We may disclose information where required by law or where reasonably necessary to protect customers, our business or the public.

Business transfers

If our business is sold, reorganised, merged or transferred, personal information may be shared with potential purchasers, advisers and the new owner, subject to appropriate safeguards.

We require service providers to process information securely and only for agreed purposes.

10. International Transfers

Some of our service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure it is protected.

These steps may include:

• Transferring information to a country recognised as providing an adequate level of protection.
• Using approved contractual protections.
• Relying on an applicable UK data transfer mechanism.
• Applying supplementary technical and organisational safeguards where appropriate.

You may contact us for further information about the safeguards used for a particular transfer.

11. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, product safety and dispute-resolution requirements.

Indicative retention periods are:

• Order and transaction records: Normally up to six years after the end of the relevant financial period, or longer where legally required.
• Customer service correspondence: Normally up to six years after the matter is resolved, depending on its nature.
• Marketing consent records: For as long as we send marketing and for an appropriate period afterwards to demonstrate compliance.
• Marketing suppression records: For as long as necessary to ensure we continue to honour an opt-out.
• Website analytics information: According to the settings and retention periods used by the relevant provider.
• Competition information: For the duration of the competition and an appropriate period afterwards.
• Account information: For as long as the account remains active and for an appropriate period after closure.
• Fraud and security information: For as long as reasonably necessary to protect our business and users.

We may retain information for longer where necessary for an investigation, legal dispute or regulatory requirement.

Information may be anonymised so it can no longer identify you. We may retain anonymous information indefinitely.

12. How We Protect Information

We use reasonable technical and organisational measures designed to protect personal information against:

• Unauthorised access.
• Accidental loss.
• Destruction.
• Alteration.
• Unlawful disclosure.
• Misuse.

These measures may include:

• Restricted staff access.
• Password and account controls.
• Encrypted website connections.
• Secure service providers.
• System monitoring.
• Data minimisation.
• Staff training.
• Backup and recovery measures.

No internet transmission or storage system can be guaranteed to be completely secure.

You are responsible for keeping account passwords confidential and should contact us promptly if you believe your account or information has been compromised.

13. Your Data Protection Rights

Depending on the circumstances, you may have the right to:

Access

Request a copy of the personal information we hold about you.

Correction

Ask us to correct inaccurate or incomplete information.

Erasure

Ask us to delete personal information where there is no lawful reason for us to continue holding it.

Restriction

Ask us to restrict how we use your information in certain circumstances.

Objection

Object to processing based on legitimate interests.

You have an absolute right to object to the use of your personal information for direct marketing.

Data portability

Request certain information in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation where technically feasible.

Withdraw consent

Withdraw consent where we rely on consent.

Human review

Ask for human involvement where a decision producing legal or similarly significant effects is based solely on automated processing, where this right applies.

These rights are not absolute and may be subject to legal exceptions.

We may need to verify your identity before acting on a request.

We will not normally charge a fee, although a reasonable fee may apply where a request is manifestly unfounded, excessive or repetitive, where permitted by law.

14. Automated Decision-Making and Profiling

We may use limited profiling to:

• Personalise marketing.
• Recommend products.
• Segment customers.
• Measure advertising.
• Detect suspicious transactions.

We do not currently intend to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Fraud-prevention or payment providers may use automated tools when assessing transactions. Contact us if you would like more information about a specific decision.

15. Children’s Information

Our website and products are not directed at children under 13.

We do not knowingly collect personal information directly from children under 13 without appropriate consent or another lawful basis.

Individuals under 18 should only place an order with the involvement and permission of a parent or legal guardian.

Contact us if you believe a child has provided personal information to us inappropriately.

16. Third-Party Websites

Our website may contain links to websites operated by third parties.

We do not control those websites and are not responsible for their privacy practices. You should review the privacy information provided by each third party before supplying personal information.

17. Social Media

When you interact with us on social media, both we and the relevant social media platform may process information about you.

The platform may act as an independent controller of your personal information and may use it according to its own privacy policy.

Avoid sending sensitive or confidential information through public comments or social media messages.

18. Complaints

Please contact us first if you have a concern about how we use your personal information.

We will investigate your complaint and respond within a reasonable period.

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data protection regulator.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

You can find current contact and complaint information through the ICO’s official website.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to:

• Our services.
• The technologies we use.
• Our service providers.
• Our marketing activities.
• Applicable law or regulatory guidance.

The latest version will be published on our website with the updated date.

Where a change materially affects how we use personal information, we will take appropriate steps to bring it to your attention.