Milk Club Privacy Policy

This Privacy Policy explains how Milk Club Deliveries Ltd collects, uses and protects personal information.

Milk Club Deliveries Ltd is the data controller responsible for the personal information covered by this policy.

Company name: Milk Club Deliveries Ltd
Company number: 13660998
Contact address: Cheeks Farm, Bentley, Farnham, GU10 5HD
Registered office: 1 The Avenue, Bentley, Farnham, Surrey, GU10 5JA
Email: orders@milk.club

Last updated: 22 July 2026

Personal information we collect

We may collect and process the following information:

Identity information: Your name and title.
Contact information: Your delivery address, email address and telephone number.
Account information: Your account details, preferences and account history.
Profile image: An image you choose to upload to your account.
Delivery information: Delivery instructions, location pins and other information needed to find your delivery location.
Order information: Products ordered, quantities, delivery frequency, substitutions, payments, refunds and previous orders.
Communication information: Correspondence with us by email, telephone, text message, post, social media or another communication channel.
Marketing preferences: Whether you have agreed to receive marketing by email or SMS, how and when that choice was recorded, and any subsequent unsubscribe request.
SMS information: Your mobile number, messages sent to or received from you, delivery information, dates and times, links selected and interactions with our messages.
Technical information: Your IP address, device and browser type, and information about how and when you use our website, app or communications.
Payment information: Information about the status of payments and the payment token supplied by our payment processor. We do not receive or store your complete payment-card details.

How we obtain your information

Most personal information is provided directly by you when you:

Create or manage an account.
Place, change or cancel an order.
Provide delivery instructions.
Contact us.
Speak to one of our doorstep representatives.
Agree to receive marketing.
Use our website or app.

If registration begins during a doorstep conversation, our representative may enter the information you provide into our registration system. We will then send you a message asking you to confirm or complete your registration.

We may also receive personal information:

From a member of your household who is authorised to manage your deliveries.
From our website, app and technology providers.
From payment providers.
Where we acquire another delivery business and continue supplying its customers.
From publicly available sources where appropriate and lawful.

How we use personal information

We may use your information to:

Create and manage your Milk Club account.
Confirm or complete your registration.
Process and deliver your orders.
Take payments and issue refunds.
Communicate about your account, orders and deliveries.
Respond to questions, requests and complaints.
Plan delivery rounds and locate your delivery address.
Forecast stock and measure product and sales performance.
Improve our products, website, app and customer service.
Protect our customers, systems and business against misuse or fraud.
Maintain financial, tax and operational records.
Establish, exercise or defend legal claims.
Comply with legal and regulatory obligations.
Send marketing where we have the necessary consent or another lawful permission.

Registration and service messages

If you provide your mobile number, we may send messages necessary to confirm or complete your registration.

We may also send essential information about your account, orders, deliveries or interruptions to our service. These are service messages rather than marketing messages.

SMS marketing

If you specifically agree, we may use your mobile number to send occasional marketing messages about Milk Club products, offers, services and news.

For canvassed customers, our representative will explain what the messages will cover and ask whether you agree to receive them. We will record your choice.

Agreeing to receive marketing is optional. It is not a condition of registering, placing an order or receiving deliveries.

You can withdraw your consent at any time by following the unsubscribe instructions in a message, replying STOP where supported, or emailing orders@milk.club.

Withdrawing marketing consent will not affect essential registration, account, order or delivery messages.

Our lawful bases

Depending on why we are using your information, we rely on one or more of the following lawful bases:

Contract: To create and manage your account, process payments, fulfil orders and make deliveries.
Legitimate interests: To operate and improve our service, respond to enquiries, prevent fraud, plan delivery rounds, forecast stock and manage our business. We consider the possible effect on your rights before relying on legitimate interests.
Consent: To send marketing communications where consent is required and provide optional account features. You may withdraw your consent at any time.
Legal obligation: To maintain required records and comply with legal, tax, regulatory and law-enforcement requirements.
Legal claims: Where processing is necessary to establish, exercise or defend a legal claim.

Who we share information with

We may share relevant personal information with trusted organisations that help us operate our service, including:

Our ordering, account and delivery-management platform providers.
Mailchimp, which helps us manage and send email and SMS communications.
Elavon Opayo and other payment-service providers.
Website, hosting, cloud-storage, communications and IT-support providers.
Accountants, lawyers, auditors, insurers and other professional advisers.
Debt-recovery providers where an amount remains lawfully unpaid.
Regulators, courts, law-enforcement bodies and public authorities where required or permitted by law.
A purchaser or prospective purchaser in connection with a sale, transfer or reorganisation of all or part of our business.

These organisations may only use personal information for the relevant agreed purpose and must protect it appropriately.

We do not sell customer personal information.

Payment-card information

Payments are processed securely by Elavon Opayo.

Milk Club does not receive or store your complete payment-card details. Our payment provider supplies us with a payment token that allows payments to be requested without providing us with your complete card details.

International transfers

Some technology and communication providers may process or store information outside the UK.

Where personal information is transferred internationally, we take appropriate steps to ensure it is protected. These may include UK adequacy regulations, approved contractual safeguards or other measures permitted under UK data-protection law.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting and reporting requirements.

In general:

Account, order, payment and transaction records may be retained for up to six years after the end of the relevant relationship or accounting period.
Operational communications are retained only for as long as reasonably necessary to manage the account, enquiry, complaint or legal issue.
Marketing information is retained while you remain subscribed.
If you unsubscribe, we may retain limited information on a suppression list so that we can respect your request and avoid contacting you again.
Evidence of marketing consent may be retained for as long as reasonably necessary to demonstrate that consent was properly obtained.
Optional profile images can be removed when no longer required or when you delete or replace them.

Information may be retained for longer where required by law or where necessary in connection with a complaint, dispute or legal claim.

How we protect information

We use appropriate organisational and technical measures designed to protect personal information against unauthorised access, loss, misuse, disclosure or alteration.

Access is limited to people and service providers who need the information for an authorised purpose.

No internet-based system can be guaranteed to be completely secure. You should keep your account password confidential and tell us if you suspect unauthorised access.

Your data-protection rights

Depending on the circumstances, you may have the following rights:

Access: To ask for a copy of your personal information.
Rectification: To ask us to correct inaccurate or incomplete information.
Erasure: To ask us to delete your information in certain circumstances.
Restriction: To ask us to restrict how information is used in certain circumstances.
Objection: To object to processing based on legitimate interests or for direct marketing.
Data portability: To receive information you provided in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation, in certain circumstances.
Withdrawal of consent: To withdraw consent at any time where we rely on it.

You will not normally have to pay to exercise these rights. We normally have one month to respond, although data-protection law allows this period to be extended in some circumstances.

To exercise a right, email orders@milk.club. We may need to ask for information to confirm your identity.

Complaints

If you are concerned about how we use personal information, please contact us first at orders@milk.club so that we can investigate.

You may also complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

Changes to this policy

We may update this Privacy Policy when our business, services or legal obligations change.

The current version will be published on our website. Where a change is significant, we will take reasonable steps to bring it to your attention.