Privacy Policy
Last updated: 20 July 2026
This Privacy Policy explains how Michele Gregio, trading as M.Gregio, collects, uses, stores and shares your personal information when you visit our website, contact us or place an order.
Michele Gregio, trading as M.Gregio, is the data controller responsible for the personal information described in this policy.
You can contact us at:
Email: [email protected]
Postal address: 71d, Granville Avenue, Long Eaton, Nottingham, NG10 4HE.
Personal Information We Collect.
Depending on how you interact with us, we may collect:
• Your name;
• Your billing and delivery address;
• Your email address and telephone number;
• Your order, delivery, return and refund information;
• Details of any personalised design, colour or bead combination you request;
• Transaction information, including the amount paid, payment method and payment status;
• Messages, enquiries and other communications you send to us;
• Technical information such as your IP address, device, browser and website activity;
• Cookie preferences and information collected through cookies or similar technologies.
Payment card details are entered into and processed by Shopify, Shop Pay or another payment provider available at checkout. M.Gregio does not normally receive or store your full payment card number or card security code.
How We Collect Your Information.
We may collect personal information:
• Directly from you when you place an order, contact us, request a personalised piece or subscribe to marketing;
• Automatically when you visit and use our website;
• From Shopify, Shop Pay and other payment or checkout providers;
• From delivery providers in relation to the status of your parcel;
• From social media platforms when you contact us through one of our business accounts.
How and Why We Use Your Information.
To process and fulfil your order.
This includes accepting payment, preparing your order, arranging delivery, sending order updates and managing returns or refunds. Our lawful basis is that the processing is necessary to perform our contract with you.
To manage personalised orders.
We use the information you provide about your chosen design, colours and materials to discuss and create your personalised piece. Our lawful basis is taking steps at your request before entering into a contract and performing our contract with you.
To respond to enquiries and provide customer service.
Our lawful basis is the performance of a contract or our legitimate interest in communicating with customers and operating our business effectively.
To maintain financial, tax and business records.
Our lawful basis is compliance with our legal obligations.
To prevent fraud, misuse and security incidents.
Our lawful basis is our legitimate interest in protecting our customers, website and business, together with any applicable legal obligations.
To improve our website and customer experience.
Where this involves non-essential cookies or similar tracking technologies, we will ask for your consent where required.
To send marketing communications.
We will send marketing emails or messages only where we have an appropriate lawful basis and, where required, your consent. You may unsubscribe at any time.
Shopify, Shop Pay and Payment Processing.
Our checkout and payment services are provided by Shopify and may include Shop Pay and other payment methods displayed at checkout.
When you place an order, Shopify and the relevant payment provider may process information including your name, contact details, billing and delivery information, payment information, order details, device information and fraud-prevention information.
We receive the information reasonably necessary to process, fulfil and support your order.
If you choose to use Shop Pay, Shopify may also collect and use information as an independent data controller in accordance with Shopify's own Consumer Privacy Policy. Requests relating specifically to personal information held independently by Shop or Shop Pay may need to be submitted directly to Shopify.
Who We Share Your Information With.
We may share your personal information with trusted service providers where reasonably necessary, including:
• Shopify, Shop Pay and payment service providers;
• Royal Mail and other delivery or fulfilment providers;
• Website hosting, information technology and security providers;
• Email and customer communication providers;
• Accountants, legal advisers, insurers or other professional advisers;
• Government departments, regulators, law-enforcement bodies or courts where disclosure is required by law;
• Analytics or advertising providers, where these services are enabled and you have provided any consent required by law.
These organisations may process your information only for the purposes for which it has been shared, subject to their own legal responsibilities and contractual obligations.
M.Gregio does not sell or rent your personal information.
International Data Transfers.
Some of our service providers, including Shopify and its associated providers, may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, we rely on safeguards recognised under UK data protection law. These may include UK adequacy regulations, approved contractual safeguards or other lawful transfer mechanisms.
How Long We Keep Your Information.
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including satisfying legal, tax, accounting, warranty and dispute-resolution requirements.
Order, transaction and accounting records are generally retained for at least the period required by HM Revenue & Customs. For a self-employed business, this is normally at least five years after the relevant 31 January Self Assessment submission deadline.
General enquiries that do not result in an order will normally be retained for up to 24 months after our last communication, unless they are relevant to an ongoing order, complaint or legal matter.
Personalised-order details will normally be retained with the corresponding order record.
Marketing information will be retained until you unsubscribe or withdraw your consent. We may keep a minimal suppression record to ensure that we respect your request not to receive further marketing.
Cookie retention periods vary according to the type of cookie and are described in our cookie information or cookie settings.
Cookies and Similar Technologies.
Our website uses essential cookies and similar technologies that are necessary for functions such as security, checkout, remembering the contents of your shopping bag and processing payments.
Our website may also use optional analytics, personalisation or advertising cookies where these features are enabled. Where consent is required, these technologies will be used only after you have made your choice through the cookie banner or cookie settings.
You may change or withdraw your cookie choices at any time through the cookie settings available on our website.
Marketing Communications.
We will not add you automatically to a general marketing list simply because you place an order.
Where you have agreed to receive marketing, we may contact you about new products, collections, events and other M.Gregio news.
You may unsubscribe at any time by using the unsubscribe option in the message or by contacting us. Unsubscribing from marketing will not prevent us from sending service messages relating to an existing order.
Your Data Protection Rights.
Depending on the circumstances, you may have the right to:
• Request access to the personal information we hold about you;
• Ask us to correct inaccurate or incomplete information;
• Ask us to erase your personal information;
• Ask us to restrict how we use your information;
• Object to certain uses of your information, including direct marketing;
• Request the transfer of certain information to you or another organisation;
• Withdraw consent at any time where we rely on consent.
These rights are not absolute and may be subject to legal exceptions. For example, we may need to retain certain order and transaction records to comply with tax or legal obligations.
To exercise your rights, contact us at [email protected]. We may need to verify your identity before responding to your request.
Security.
We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
Automated Decision-Making.
M.Gregio does not make decisions about customers based solely on automated processing where those decisions produce legal or similarly significant effects.
Shopify, payment providers and fraud-prevention providers may use automated systems to identify potentially fraudulent or unauthorised transactions in accordance with their own privacy policies.
Complaints.
Please contact us first if you have any questions or concerns about how we use your personal information, and we will do our best to resolve the matter.
You also have the right to make a complaint to the Information Commissioner's Office, the United Kingdom's data protection supervisory authority.
Changes to This Policy.
We may update this Privacy Policy when our services, providers or legal obligations change. The latest version will always be published on this website, together with the date on which it was last updated.
This Privacy Policy explains how Michele Gregio, trading as M.Gregio, collects, uses, stores and shares your personal information when you visit our website, contact us or place an order.
Michele Gregio, trading as M.Gregio, is the data controller responsible for the personal information described in this policy.
You can contact us at:
Email: [email protected]
Postal address: 71d, Granville Avenue, Long Eaton, Nottingham, NG10 4HE.
Personal Information We Collect.
Depending on how you interact with us, we may collect:
• Your name;
• Your billing and delivery address;
• Your email address and telephone number;
• Your order, delivery, return and refund information;
• Details of any personalised design, colour or bead combination you request;
• Transaction information, including the amount paid, payment method and payment status;
• Messages, enquiries and other communications you send to us;
• Technical information such as your IP address, device, browser and website activity;
• Cookie preferences and information collected through cookies or similar technologies.
Payment card details are entered into and processed by Shopify, Shop Pay or another payment provider available at checkout. M.Gregio does not normally receive or store your full payment card number or card security code.
How We Collect Your Information.
We may collect personal information:
• Directly from you when you place an order, contact us, request a personalised piece or subscribe to marketing;
• Automatically when you visit and use our website;
• From Shopify, Shop Pay and other payment or checkout providers;
• From delivery providers in relation to the status of your parcel;
• From social media platforms when you contact us through one of our business accounts.
How and Why We Use Your Information.
To process and fulfil your order.
This includes accepting payment, preparing your order, arranging delivery, sending order updates and managing returns or refunds. Our lawful basis is that the processing is necessary to perform our contract with you.
To manage personalised orders.
We use the information you provide about your chosen design, colours and materials to discuss and create your personalised piece. Our lawful basis is taking steps at your request before entering into a contract and performing our contract with you.
To respond to enquiries and provide customer service.
Our lawful basis is the performance of a contract or our legitimate interest in communicating with customers and operating our business effectively.
To maintain financial, tax and business records.
Our lawful basis is compliance with our legal obligations.
To prevent fraud, misuse and security incidents.
Our lawful basis is our legitimate interest in protecting our customers, website and business, together with any applicable legal obligations.
To improve our website and customer experience.
Where this involves non-essential cookies or similar tracking technologies, we will ask for your consent where required.
To send marketing communications.
We will send marketing emails or messages only where we have an appropriate lawful basis and, where required, your consent. You may unsubscribe at any time.
Shopify, Shop Pay and Payment Processing.
Our checkout and payment services are provided by Shopify and may include Shop Pay and other payment methods displayed at checkout.
When you place an order, Shopify and the relevant payment provider may process information including your name, contact details, billing and delivery information, payment information, order details, device information and fraud-prevention information.
We receive the information reasonably necessary to process, fulfil and support your order.
If you choose to use Shop Pay, Shopify may also collect and use information as an independent data controller in accordance with Shopify's own Consumer Privacy Policy. Requests relating specifically to personal information held independently by Shop or Shop Pay may need to be submitted directly to Shopify.
Who We Share Your Information With.
We may share your personal information with trusted service providers where reasonably necessary, including:
• Shopify, Shop Pay and payment service providers;
• Royal Mail and other delivery or fulfilment providers;
• Website hosting, information technology and security providers;
• Email and customer communication providers;
• Accountants, legal advisers, insurers or other professional advisers;
• Government departments, regulators, law-enforcement bodies or courts where disclosure is required by law;
• Analytics or advertising providers, where these services are enabled and you have provided any consent required by law.
These organisations may process your information only for the purposes for which it has been shared, subject to their own legal responsibilities and contractual obligations.
M.Gregio does not sell or rent your personal information.
International Data Transfers.
Some of our service providers, including Shopify and its associated providers, may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, we rely on safeguards recognised under UK data protection law. These may include UK adequacy regulations, approved contractual safeguards or other lawful transfer mechanisms.
How Long We Keep Your Information.
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including satisfying legal, tax, accounting, warranty and dispute-resolution requirements.
Order, transaction and accounting records are generally retained for at least the period required by HM Revenue & Customs. For a self-employed business, this is normally at least five years after the relevant 31 January Self Assessment submission deadline.
General enquiries that do not result in an order will normally be retained for up to 24 months after our last communication, unless they are relevant to an ongoing order, complaint or legal matter.
Personalised-order details will normally be retained with the corresponding order record.
Marketing information will be retained until you unsubscribe or withdraw your consent. We may keep a minimal suppression record to ensure that we respect your request not to receive further marketing.
Cookie retention periods vary according to the type of cookie and are described in our cookie information or cookie settings.
Cookies and Similar Technologies.
Our website uses essential cookies and similar technologies that are necessary for functions such as security, checkout, remembering the contents of your shopping bag and processing payments.
Our website may also use optional analytics, personalisation or advertising cookies where these features are enabled. Where consent is required, these technologies will be used only after you have made your choice through the cookie banner or cookie settings.
You may change or withdraw your cookie choices at any time through the cookie settings available on our website.
Marketing Communications.
We will not add you automatically to a general marketing list simply because you place an order.
Where you have agreed to receive marketing, we may contact you about new products, collections, events and other M.Gregio news.
You may unsubscribe at any time by using the unsubscribe option in the message or by contacting us. Unsubscribing from marketing will not prevent us from sending service messages relating to an existing order.
Your Data Protection Rights.
Depending on the circumstances, you may have the right to:
• Request access to the personal information we hold about you;
• Ask us to correct inaccurate or incomplete information;
• Ask us to erase your personal information;
• Ask us to restrict how we use your information;
• Object to certain uses of your information, including direct marketing;
• Request the transfer of certain information to you or another organisation;
• Withdraw consent at any time where we rely on consent.
These rights are not absolute and may be subject to legal exceptions. For example, we may need to retain certain order and transaction records to comply with tax or legal obligations.
To exercise your rights, contact us at [email protected]. We may need to verify your identity before responding to your request.
Security.
We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
Automated Decision-Making.
M.Gregio does not make decisions about customers based solely on automated processing where those decisions produce legal or similarly significant effects.
Shopify, payment providers and fraud-prevention providers may use automated systems to identify potentially fraudulent or unauthorised transactions in accordance with their own privacy policies.
Complaints.
Please contact us first if you have any questions or concerns about how we use your personal information, and we will do our best to resolve the matter.
You also have the right to make a complaint to the Information Commissioner's Office, the United Kingdom's data protection supervisory authority.
Changes to This Policy.
We may update this Privacy Policy when our services, providers or legal obligations change. The latest version will always be published on this website, together with the date on which it was last updated.