Privacy policy

1. ABOUT THIS POLICY

The Hello Cup Company Limited ("we", "us", "our") is committed to protecting your personal information. This policy explains what data we collect, why we collect it, how we use and share it, how long we keep it, and what rights you have.

We comply with the New Zealand Privacy Act 2020. For customers located in the United Kingdom, we also comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For customers in the European Economic Area (EEA), we comply with the EU GDPR.

 

2. WHAT INFORMATION WE COLLECT

2.1 Information you give us

When you place an order or create an account we collect:

  • Name and billing/shipping address
  • Email address and phone number
  • Payment details (processed securely - see Section 5)
  • Order history and preferences

2.2 Information collected automatically

When you browse our website we automatically collect:

  • IP address and device/browser type
  • Pages visited, referring URLs, and clickstream data
  • Cookie and tracking data (see Section 7)

2.3 A note on sensitive data

Period care products relate to personal health. While we do not ask you to disclose medical information, your purchasing activity on our site may indirectly reflect aspects of your health. We treat all such data with heightened care and do not use it for profiling or sell it to third parties.

 

3. WHY WE COLLECT YOUR DATA & OUR LEGAL BASIS

Under the UK GDPR and EU GDPR we are required to have a lawful basis for processing your personal data. The table below sets out our purposes and the legal basis for each.

Purpose

  • Fulfilling your order: Processing payments, shipping, returns and customer service. Legal basis: Performance of a contract (Article 6(1)(b) UK/EU GDPR).
  • Fraud prevention and security: Protecting against fraudulent transactions and account abuse. Legal basis: Legitimate interests (Article 6(1)(f) UK/EU GDPR).
  • Legal compliance: Meeting our obligations under tax, consumer protection and other applicable laws. Legal basis: Legal obligation (Article 6(1)(c) UK/EU GDPR).
  • Email marketing: Sending you promotional emails about new products and offers. Legal basis: Consent (Article 6(1)(a) UK/EU GDPR). You may withdraw consent at any time - see Section 8.
  • Website analytics: Understanding how visitors use our site so we can improve it. Legal basis: Legitimate interests (Article 6(1)(f) UK/EU GDPR), subject to your cookie consent.

 

4. HOW WE SHARE YOUR INFORMATION

4.1 Third-party service providers

We share your data only with trusted third-party processors who need it to provide services to us. These providers are contractually bound to protect your data and may not use it for their own purposes.

Shopify Inc. (United States) - our e-commerce platform. Shopify stores and processes order, customer and payment data on our behalf. We have a Data Processing Agreement (DPA) in place with Shopify. Privacy policy: shopify.com/legal/privacy

Klaviyo Inc. (United States) - our email marketing platform. We share your email address and order data with Klaviyo to send transactional and marketing emails. Privacy policy: klaviyo.com/legal/privacy

Google LLC (United States) - we use Google Analytics to analyse website traffic. Google Analytics collects anonymised usage data via cookies. Privacy policy: policies.google.com/privacy

Payment processors: Payments are processed by Shopify Payments or other PCI-DSS compliant gateways. We do not store your card details on our systems.

Shipping and logistics partners: We share your name and delivery address with our courier and fulfilment partners to complete your order.

4.2 Other disclosures

We may also disclose your personal information:

  • If required to do so by law or a regulatory authority
  • To enforce our Terms of Service or protect the rights, property or safety of Hello Period, our customers or others
  • In connection with a business sale or merger, in which case the new owner will be bound by terms at least as protective as this policy

4.3 We do not sell your data

We do not sell, rent or trade your personal information to any third party for their own marketing purposes.

 

5. PAYMENT SECURITY

All payment transactions are encrypted using SSL/TLS. Card data is processed by our payment gateway and encrypted to PCI-DSS standards. We do not store credit card numbers on our servers. Our payment processors comply with PCI-DSS requirements as managed by the PCI Security Standards Council.

 

6. INTERNATIONAL DATA TRANSFERS

Hello Period is based in New Zealand. When you shop with us, your data may be transferred to and processed in the United States (by Shopify, Klaviyo, and Google) and potentially other countries where our service providers operate.

For transfers of UK personal data to countries not covered by an adequacy decision, we rely on the UK International Data Transfer Agreement (IDTA) or equivalent Standard Contractual Clauses (SCCs) put in place by our processors. Shopify's DPA includes appropriate transfer mechanisms for UK and EEA data.

Under the NZ Privacy Act 2020 (Information Privacy Principle 12), we take reasonable steps to ensure offshore recipients of your data protect it in a manner comparable to New Zealand standards.

 

7. COOKIES

Cookies are small data files placed on your device. We use them to:

  • Keep your shopping cart active across pages
  • Remember your preferences
  • Analyse site traffic via Google Analytics
  • Support marketing and retargeting (with your consent)

When you first visit our site you will see a cookie consent banner. You can accept all cookies, reject non-essential cookies, or manage your preferences. Essential cookies (required for the shop to function) cannot be switched off.

To manage or withdraw your cookie consent at any time, use the cookie preferences link in the footer of our website or adjust your browser settings. Note that disabling cookies may affect site functionality.

 

8. EMAIL MARKETING

We will only send you marketing emails if you have opted in. Each marketing email contains an unsubscribe link. You can also withdraw your consent at any time by:

  • Clicking 'Unsubscribe' in any marketing email
  • Emailing us at hello@helloperiod.com

Withdrawing consent does not affect our ability to send you transactional emails about orders you have placed.

 

9. DATA RETENTION

We keep your personal data only as long as necessary for the purposes described in this policy, or as required by law. Our general retention periods are:

  • Customer account data: Retained while your account is active and for 3 years after your last purchase, after which it is deleted or anonymised.
  • Order records: Retained for 7 years to meet tax and accounting obligations under NZ law.
  • Marketing preferences and email history: Retained while you remain subscribed. Unsubscribe records are kept indefinitely to honour your preferences.
  • Analytics data: Aggregated, anonymised analytics data may be retained indefinitely as it cannot identify individuals.

 

10. YOUR RIGHTS

10.1 New Zealand customers

Under the NZ Privacy Act 2020 you have the right to:

  • Request access to personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your information (subject to legal retention obligations)
  • Be notified if your information is involved in a privacy breach that poses a risk of serious harm

10.2 UK customers (UK GDPR)

In addition to the above, if you are based in the UK you have the right to:

  • Data portability - receive your data in a structured, machine-readable format
  • Restrict processing - ask us to pause processing while a complaint is investigated
  • Object to processing based on legitimate interests
  • Not be subject to solely automated decision-making that significantly affects you
  • Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113

10.3 EEA customers (EU GDPR)

EEA customers have equivalent rights under the EU GDPR and may lodge a complaint with their local supervisory authority.

10.4 How to exercise your rights

To exercise any of the above rights, please contact us using the details in Section 13. We will respond within 20 working days (as required by the NZ Privacy Act 2020) or within one calendar month (as required by the UK/EU GDPR), whichever is sooner.

We may need to verify your identity before actioning a request. We will not charge a fee unless your request is manifestly unfounded or excessive.

 

11. SECURITY

We take reasonable technical and organisational measures to protect your personal information from unauthorised access, loss, misuse, disclosure, alteration or destruction. These include SSL/TLS encryption for data in transit and AES-256 encryption for stored card data.

No method of transmission over the internet is completely secure. We follow PCI-DSS requirements and industry-standard security practices, but we cannot guarantee absolute security.

11.1 Data breach notification

If we become aware of a data breach that poses a risk of serious harm, we will notify the NZ Privacy Commissioner and affected individuals as required by the Privacy Act 2020. We will also notify relevant supervisory authorities and individuals in the UK and EEA where required by UK/EU GDPR.

 

12. LINKS TO OTHER WEBSITES

Our website may contain links to third-party websites. Once you leave helloperiod.com, this Privacy Policy no longer applies. We encourage you to read the privacy policies of any sites you visit.

 

13. CHANGES TO THIS POLICY

We may update this policy from time to time. The "Last updated" date at the bottom of this page will always reflect the current version. Where we make material changes -particularly changes that affect how we use your data or your rights - we will notify affected customers by email.

 

14. CONTACT US

For any privacy-related questions, requests or complaints:

  • Privacy contact: Kat Sprowell
  • Company: The Hello Cup Company Limited
  • Email: kat@helloperiod.com
  • Website: helloperiod.com

Last Updated: June 2026