Effective date: July 15, 2026

MLRSE Digital Marketing Services, trading as Club Melrose, is the personal information controller for the processing described in this Privacy Policy. This policy explains how we collect, use, store, disclose, and protect personal data when you visit clubmelrose.com, place an order, request personalization, submit payment confirmation, contact us, or otherwise use our services.

Personal data we process

• Identity and contact data: name, email address, phone number, billing and delivery address, and Instagram handle when you choose to provide it.
• Order and personalization data: products, sizes or options, order history, gift details, personalization instructions, form responses, reference images, mockups, approvals, returns, and support history.
• Payment and transaction data: amount, payment method, transaction reference, payment status, and payment confirmation or receipt. We do not ask for your PIN, password, or one-time password. Please redact account balances and unrelated transactions before sending a receipt.
• Account and communication data: customer-account details and messages sent by email, contact form, phone, or Instagram.
• Technical and usage data: IP address, device and browser information, cookie identifiers, pages viewed, cart activity, approximate location, and fraud or security signals collected by Shopify, our apps, and similar technologies.

How we collect personal data

We collect data directly from you through our Shopify store, checkout, customer account, contact channels, and Google Forms used for personalized orders. We also receive data automatically from your device and from service providers that support our store, payments, delivery, security, and communications.

Why we use personal data and our legal bases

• To perform our contract with you: create and manage orders, process or confirm payment, prepare personalized products, arrange delivery, provide updates, and handle returns, refunds, and support.
• To comply with law: maintain tax and accounting records, respond to lawful requests, protect consumer rights, and establish or defend legal claims.
• For legitimate business interests: secure the store, prevent fraud, troubleshoot services, improve products and customer experience, and produce aggregated business analytics, provided those interests do not override your rights.
• With consent: send optional direct marketing, use data for a new incompatible purpose, or process information where consent is otherwise required. You may withdraw consent at any time without affecting earlier lawful processing.

Who receives personal data

We disclose only the data reasonably needed for the relevant service. Recipients may include:

• Shopify, which hosts the store, checkout, customer accounts, security, analytics, and related commerce services;
• Easify Product Options and other Shopify apps enabled on the store to capture and process product options or support store functions;
• Google for Google Forms, Drive, and Gmail used for personalization requests, customer communications, and payment confirmations;
• Meta and Instagram when you contact us or approve mockups through Instagram;
• payment and financial service providers, including GCash, Maya, UnionBank, and any checkout payment provider you select;
• delivery, logistics, and fulfillment providers, including GoGo Xpress where used, to deliver or return orders;
• professional advisers, regulators, courts, law enforcement, or government agencies when disclosure is required or permitted by law; and
• a successor or buyer if the business is reorganized or transferred, subject to appropriate safeguards and notice where required.

These providers process data under their own privacy notices and contractual or legal duties. We do not authorize them to use Club Melrose customer data for unrelated purposes.

Shopify and Network Intelligence

Shopify processes information about your use of our store to provide hosting, checkout, security, analytics, and commerce features. Shopify Network Intelligence is enabled on our store. For certain features, Shopify may combine information about interactions with Club Melrose and other merchants to improve fraud prevention, analytics, and personalized services. Shopify may act as an independent controller for that processing. Learn more in the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal for requests concerning Shopify-controlled processing.

Cookies and similar technologies

Shopify and enabled apps use cookies and similar technologies that are necessary to operate checkout, remember preferences, secure the store, measure performance, and, where enabled and permitted, personalize content or advertising. You can use the privacy or cookie controls shown on the store where available and can also change browser settings. Blocking necessary cookies may prevent some store features from working.

International processing

Shopify and some other providers store or process data outside the Philippines, including in the United States and other countries where they or their subprocessors operate. We use providers with contractual, organizational, and technical safeguards and require lawful handling of transferred personal data.

Retention

• Order, invoice, payment-confirmation, tax, and accounting records are generally retained for 5 years from the applicable filing deadline or record entry, or longer when required for an audit, dispute, legal claim, or other legal obligation.
• Completed personalization forms, reference materials, mockups, approvals, and related support records are generally retained for up to 12 months after fulfillment or the last customer interaction, unless they are part of a record we must keep longer.
• Uncompleted personalization inquiries are generally deleted or anonymized within 90 days after the last interaction.
• Marketing contact data is retained until you unsubscribe, withdraw consent, or we determine it is no longer needed.
• Technical, security, and platform logs are retained according to operational need and the retention schedules of the service provider that controls them.

When the retention period ends, we delete, anonymize, or securely dispose of data unless preservation is required by law.

Security

We use reasonable organizational, physical, and technical safeguards, limit access to people and providers who need the data, use access controls and secure platforms, and review suspected incidents. No system is perfectly secure. Please do not send passwords, PINs, one-time passwords, full account statements, or other information we have not requested.

Your privacy rights

Subject to the Data Privacy Act of 2012 and other applicable law, you may request access to or a copy of your personal data, correction of inaccurate data, erasure or blocking, objection to processing, data portability, or withdrawal of consent. You may also complain and seek damages where provided by law.

To exercise a right, email hello.clubmelrose@gmail.com with the subject “Privacy Request” or call +63 947 994 5767. Tell us what you are requesting and the order or interaction involved. We may verify your identity and authority before acting, and we will respond within the period required by law.

Complaints

Please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the National Privacy Commission of the Philippines.

Changes to this policy

We may update this policy when our practices, providers, or legal obligations change. We will post the revised version here and update the effective date. We will provide additional notice when required by law.

Controller and privacy contact

MLRSE Digital Marketing Services, trading as Club Melrose
Email: hello.clubmelrose@gmail.com
Phone: +63 947 994 5767