Last updated: 16 July 2026

This privacy policy explains how Mushi Cosmetics ("Mushi", "we", "us") collects, uses and protects your personal data when you visit mushicosmetics.com, place an order, or contact us. We are the data controller for the personal data described in this policy, and we process it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or your data, contact us at support@mushicosmetics.com.

What we collect

• Identity and contact details — your name, email address, phone number, billing and delivery address.
• Order and payment information — the products you buy, order history, and payment details. Payments are processed securely by our payment providers; we never see or store your full card number.
• Account information — if you create a customer account, your login details and saved preferences.
• Communications — emails and messages you send us, including refund and cancellation requests.
• Technical and usage data — IP address, browser and device type, and how you use our site, collected through cookies and similar technologies.

How and why we use your data

• To fulfil your order (contract): processing payment, delivering your products, sending order and dispatch confirmations, and providing tracking.
• To provide customer support (contract / legitimate interests): responding to your questions, refund requests and membership cancellations.
• To manage subscriptions and memberships (contract): processing recurring orders until you cancel.
• To send marketing (consent / legitimate interests): emails about products and offers, only where permitted. You can unsubscribe at any time via the link in any marketing email.
• To improve our store (legitimate interests): analytics that help us understand how the site is used.
• To meet legal obligations (legal obligation): tax, accounting and fraud-prevention requirements.

Who we share your data with

We never sell your personal data. We share it only with service providers who help us run the store:

• Shopify — the platform that hosts our store and processes orders.
• Payment providers — to take payment securely.
• Fulfilment and delivery partners — to pack, ship and deliver your order.
• Order tracking services — to power our Track your order page.
• Marketing and analytics providers — where you have not opted out.

Each provider only receives the data they need to perform their service and is required to protect it.

International transfers

Some of our service providers are located outside the UK, including in the EEA, the United States, and China, where our products are manufactured and dispatched from. Whenever your data is transferred outside the UK, we ensure appropriate safeguards are in place, such as contracts incorporating standard data protection clauses recognised under UK law.

How long we keep your data

We keep your data only as long as needed for the purposes above: order records are kept for as long as required by UK tax and accounting law (generally 6 years), and marketing data is kept until you unsubscribe or ask us to delete it.

Cookies

We use cookies and similar technologies to keep your basket working, remember your preferences, and understand how the site is used. You can manage cookies through your browser settings, and manage sharing preferences on our Your privacy choices page.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted ("right to be forgotten");
• restrict or object to our processing, including for direct marketing;
• receive your data in a portable format; and
• withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email support@mushicosmetics.com. We'll respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Children

Our store is not intended for children under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy from time to time. The latest version will always be published on this page with the date above.