Privacy policy

Last updated: 19 October 2026

Merenlo | United Kingdom

At Merenlo, we take the protection of your personal information seriously.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you visit www.merenlo.co.uk, browse our products, place an order, contact customer support, track a shipment, subscribe to marketing communications or otherwise interact with our online store.

Merenlo currently accepts new orders for delivery within the United Kingdom, including England, Scotland, Wales and Northern Ireland.

This policy is intended to provide transparency about our processing of personal information under applicable data-protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

As our legal operator is established in the Netherlands, the EU General Data Protection Regulation (EU GDPR) may also apply to relevant processing activities. Existing customers retain any applicable rights relating to previous orders.

1. Who Is Responsible for Your Personal Information?

Merenlo is operated by BJ-Ecom B.V., which acts as the data controller for the personal information processed in connection with the Merenlo online store.

Data Controller

BJ-Ecom B.V.
J.L. van Rijweg 50
2713 JA Zoetermeer
Netherlands

Company registration (KvK): 89168402
VAT identification number: NL864899269B01

Store: Merenlo
Website: https://www.merenlo.co.uk
Email: support@merenlo.co.uk

As data controller, BJ-Ecom B.V. determines the purposes and means of processing personal information for the activities described in this policy.

Where an external provider independently determines the purposes and means of particular processing activities, that provider may also act as an independent controller under applicable law.

2. Personal Information We Collect

The information we process depends on how you interact with Merenlo.

2.1 Identity and contact information

This may include:

Full name
Email address
Telephone number
Billing address
Delivery address
Information provided when contacting customer support

2.2 Order and transaction information

This may include:

Order number
Products ordered
Selected sizes, colours and quantities
Purchase amounts and currency
Order dates and status
Delivery instructions where provided
Order history
Cancellation and return requests
Refund and exchange information

2.3 Payment information

Payments are processed through Shopify Payments and other supported payment providers made available at checkout.

Merenlo may receive payment-related information such as:

Payment status
Transaction reference
Payment method type
Transaction amount
Refund status
Limited card or payment-account information made available by the payment provider

Merenlo does not store complete payment-card numbers in its own customer-service records.

Payment providers may process additional information in accordance with their own legal responsibilities and privacy notices.

2.4 Technical and website information

When you visit our website, we may receive or process:

IP address
Browser type and version
Device type and operating system
Approximate location derived from technical information
Website pages visited
Referral sources
Session and interaction information
Cookie and similar technology identifiers
Consent and privacy preferences
Website performance and diagnostic information

Optional tracking information is processed subject to applicable consent and privacy requirements.

2.5 Marketing and advertising information

Where applicable and permitted, this may include:

Email subscription status
Marketing preferences
Marketing-email engagement
Website interactions relevant to advertising
Campaign referral information
Advertising or attribution identifiers
Purchase and conversion events
Information used to measure advertising effectiveness

2.6 Delivery and tracking information

For shipping and order tracking, we may process:

Recipient details
Delivery address
Carrier and shipment references
Tracking number
Shipment status
Delivery events
Relevant communications about delivery problems

We do not require you to provide personal information unrelated to a legitimate order, customer-service or other lawful business purpose.

3. Where We Obtain Personal Information

We obtain personal information from several sources.

Directly from you: when you place an order, complete checkout, contact us, submit a return request or subscribe to marketing.

From our ecommerce platform: Shopify may provide order, account, transaction and website information needed to operate the store.

From payment providers: payment confirmation, transaction status and information needed for payment administration.

From fulfilment and shipping partners: information required to dispatch, track or investigate a delivery.

From marketing and analytics services: website activity, campaign measurement and engagement information where legally permitted.

Automatically from your device: technical information collected through website functionality, cookies, scripts and similar technologies.

We may combine relevant information from these sources where necessary and lawful for the purposes described below.

4. Why We Use Your Personal Information

We process personal information for the following purposes.

Purpose	Applicable lawful basis
Processing orders, payment and delivery	Performance of a contract
Managing cancellations, returns and refunds	Contract and legal obligations
Responding to customer enquiries	Contract or legitimate interests, depending on the enquiry
Maintaining transaction and accounting records	Legal obligation
Operating and securing the website	Legitimate interests, contract or legal obligation, as applicable
Preventing fraud and investigating misuse	Legitimate interests or legal obligation, as applicable
Providing order tracking	Contract or legitimate interests
Sending marketing emails	Consent or another legally permitted basis, subject to electronic-marketing rules
Optional analytics and advertising tracking	Consent where required
Advertising attribution and conversion measurement	Consent or another applicable lawful basis, subject to tracking rules
Handling legal claims and disputes	Legitimate interests or legal obligation
Recording cookie choices	Legal obligation and legitimate interests, as applicable

Where we rely on legitimate interests, those interests include maintaining an effective online store, protecting our customers and systems, preventing fraud, administering our business and resolving customer disputes.

We consider your rights and interests before relying on this basis.

Where consent is required, you may withdraw it without affecting processing that was lawful before withdrawal.

5. Ecommerce Platform and Payment Processing

Merenlo uses Shopify to operate its online store.

Shopify supports functions including:

Website hosting and ecommerce infrastructure
Product browsing and shopping carts
Checkout
Order administration
Customer communications
Store security and technical functionality

We use Shopify Payments to support payment processing, payment verification and related transaction-security functions.

Other payment providers may be involved depending on the payment method available and selected at checkout.

We process the information necessary to administer your purchase, while payment providers may process additional information under their own applicable terms and privacy notices.

6. Analytics, Advertising and Attribution

Merenlo uses the following confirmed technologies for website measurement, advertising and attribution.

Google Tag Manager

Google Tag Manager helps manage and deploy website tags used for measurement and marketing-related functions.

The personal information processed depends on the particular tags and services configured through it.

Google Tag Manager itself should not be understood as making every connected tracking service strictly necessary.

Google Analytics

Google Analytics is used to understand website traffic, visitor interactions and store performance.

Depending on the configuration and permissions in place, analytics data may include website events, device information, page interactions and technical identifiers.

Merenlo's optional Google Analytics tracking is intended to operate through the applicable consent-management process.

Google Ads

Google Ads is used for advertising and measuring advertising performance.

Where enabled and legally permitted, related technology may process information about campaign visits, advertising interactions, purchases and conversion events.

Advertising-related tracking and audience features are subject to applicable consent and data-protection requirements.

Wetracked.io

Wetracked.io supports advertising attribution and conversion measurement.

Depending on the configured integration and applicable permissions, it may process or receive information relating to orders, conversions, campaign attribution and website interactions.

Attribution or conversion tracking that involves non-essential identifiers or personal information is subject to applicable legal requirements.

Your choices

Where consent is required for these technologies, you can choose whether to permit the relevant categories through Merenlo's consent-management interface.

You also have the right to object to the processing of personal information for direct marketing, including related profiling.

7. Email Marketing — Omnisend

Merenlo uses Omnisend for email-marketing activities.

Where permitted, Omnisend may help us:

Manage email subscriptions
Send promotional emails and store updates
Maintain marketing preferences
Understand email engagement
Manage subscriber lists
Support relevant email-marketing campaigns

We send marketing emails where we have a valid legal basis and comply with applicable electronic-marketing requirements.

For example, this may involve consent or, where all legal conditions are satisfied, an applicable existing-customer marketing exception.

You can unsubscribe from marketing emails at any time by:

Using the unsubscribe link in a marketing email; or
Contacting support@merenlo.co.uk.

Unsubscribing from marketing does not prevent necessary transactional emails about an existing order, delivery, refund, cancellation, security matter or legal obligation.

Our confirmed marketing setup concerns email marketing. This policy does not represent SMS marketing as an active Merenlo service.

8. Shipment Tracking — Track123

Merenlo uses Track123 to provide shipment-tracking information and related order-delivery functionality.

Depending on the integration, Track123 may process information including:

Order reference
Shipment number
Tracking number
Carrier information
Delivery status
Shipment events
Relevant customer or recipient details

This processing supports the fulfilment of customer orders and enables customers to access available delivery updates.

You can access our tracking service through:

Track Your Order

Tracking information may also be supplied by delivery and logistics providers involved in the shipment.

9. Cookies and Consent Management — Pandectes

Merenlo uses Pandectes for cookie-consent and preference management.

Cookies and similar technologies may be used for:

Shopping carts and checkout
Website security
Remembering your preferences
Consent management
Website functionality
Analytics and performance measurement
Advertising and conversion tracking

Strictly necessary technologies

Certain technologies are required to provide services you request, such as cart, checkout, security and consent-management functionality.

These may operate without consent where an applicable legal exemption permits it.

Optional technologies

Other technologies may be used for analytics, advertising, marketing, conversion tracking or optional preferences.

Where consent is legally required, these technologies must not be used for their optional purposes before valid consent has been obtained.

Some narrowly defined UK legal exemptions may apply to certain statistical or functional technologies where all applicable conditions are satisfied.

These exemptions do not automatically permit advertising tracking.

Merenlo's optional Google Analytics and advertising measurement activities are managed through its applicable cookie-consent arrangements.

Managing your choices

Pandectes provides the store's cookie-preference interface.

You can review the available consent choices and change your optional preferences through the cookie-preference controls provided on the website.

You may also manage or delete cookies through your browser settings, although doing so can affect certain website features.

Read our Cookie Policy for more information.

10. Other Service Providers and Recipients

To operate Merenlo, we may disclose relevant personal information to third parties involved in legitimate business activities.

These may include:

Shopify: ecommerce operations and hosting
Shopify Payments: payment administration
Google Tag Manager: management of tracking technologies
Google Analytics: website analytics
Google Ads: advertising and conversion measurement
Omnisend: email marketing
Track123: shipment tracking
Wetracked.io: advertising attribution
Pandectes: consent and preference management
Delivery and fulfilment providers: preparing, transporting and delivering orders
Relevant payment providers: processing the payment method selected at checkout
Professional advisers: accounting, legal or other professional services where necessary
Public authorities: where disclosure is legally required

We share information relevant to the purpose of the service, subject to applicable data-protection requirements.

Some recipients process personal information on our instructions, while others may act as independent controllers for specific activities.

We do not describe advertising disclosures as necessarily identical to ordinary operational disclosures. The lawful basis, consent requirements and recipient responsibilities depend on the particular activity.

11. International Processing and Data Transfers

Merenlo is operated by a company established in the Netherlands and serves customers in the United Kingdom.

Personal information may be processed or accessed across national borders in connection with ecommerce operations, payments, customer support, analytics, marketing and order fulfilment.

Depending on the service provider and activity, processing may take place within or outside the United Kingdom and European Economic Area.

Where applicable data-protection laws restrict an international transfer, an appropriate legal transfer mechanism must be used.

Depending on the circumstances, applicable mechanisms may include:

UK adequacy regulations
EU adequacy decisions
The UK International Data Transfer Agreement
The UK Addendum to EU Standard Contractual Clauses
European Commission Standard Contractual Clauses
Other transfer mechanisms or exceptions permitted by the applicable law

The correct mechanism depends on the particular transfer, recipient, destination and legal framework.

We do not claim that every international transfer uses the same safeguard.

You may request further information about safeguards relevant to your personal information by emailing support@merenlo.co.uk.

12. How Long We Keep Personal Information

We retain personal information for periods determined by the purpose of processing and any applicable legal or regulatory requirements.

Different categories of information may need to be retained for different periods.

Orders and transaction records

Order, payment, invoice and related business records may be retained for the period required by applicable accounting, tax, consumer-protection and record-keeping obligations.

Customer-service correspondence

Support enquiries and related records are retained for as long as reasonably needed to resolve the matter, administer the customer relationship, comply with legal obligations or establish and defend legal claims.

Marketing information

Marketing subscription and engagement information is retained while relevant to lawful marketing activities, subject to withdrawal of consent, unsubscribe requests, objections and applicable deletion requirements.

Limited suppression information may be retained where necessary to ensure that an unsubscribe or objection continues to be respected.

Analytics and tracking information

Retention depends on the purposes, settings and applicable restrictions associated with the relevant analytics, advertising and attribution services.

Consent records

Cookie-preference and consent-related information may be retained where necessary to manage preferences, demonstrate compliance and maintain appropriate records.

We assess retention based on necessity, applicable legal obligations and the rights of individuals.

Where information is no longer required, it should be deleted or anonymised as appropriate, subject to applicable legal requirements.

13. Your Data-Protection Rights

Depending on the applicable law and the circumstances of processing, you may have the following rights.

Right of access: request confirmation of whether we process your personal information and obtain access to relevant information.

Right to rectification: request correction of inaccurate personal information and completion of incomplete information where appropriate.

Right to erasure: request deletion of personal information where the legal conditions for deletion are met.

Right to restriction: request that certain processing be restricted where applicable.

Right to data portability: receive certain information in a structured, commonly used and machine-readable format and, where applicable, request its transmission to another controller.

Right to object: object to processing based on legitimate interests in appropriate circumstances.

Right to object to direct marketing: object at any time to the processing of your personal information for direct marketing, including related profiling.

Right to withdraw consent: withdraw previously provided consent where consent is the lawful basis for processing.

Rights concerning automated decisions: exercise any applicable rights and safeguards relating to solely automated decisions that produce legal or similarly significant effects.

These rights are subject to the conditions and exceptions set out in applicable data-protection legislation.

To submit a request, contact:

support@merenlo.co.uk

We may ask for information reasonably necessary to verify your identity before disclosing or changing personal information.

We will respond within the time limits required by applicable law, normally within one month for UK GDPR rights requests, subject to lawful extensions or exceptions.

14. Direct Marketing Objections

You can object at any time to the use of your personal information for direct marketing.

This includes profiling connected to direct marketing.

To exercise this right:

Use the unsubscribe link in a promotional email.
Contact support@merenlo.co.uk.

Where you validly object to direct marketing, we will stop processing your personal information for that purpose.

We may retain limited suppression information where necessary to respect your objection and prevent further unwanted marketing.

15. Automated Processing and Profiling

Certain technical systems used in ecommerce may involve automated processing.

For example:

Payment providers may use automated checks to authorise or decline transactions.
Fraud-prevention systems may identify unusual or potentially unauthorised activity.
Advertising services may use information to measure campaigns or develop advertising audiences.
Marketing services may support subscriber segmentation and relevant email campaigns.

Not all automated processing is a decision with legal or similarly significant effects.

Where an applicable law provides specific rights or safeguards concerning significant solely automated decisions, those requirements must be respected.

If you have concerns about an automated outcome associated with your Merenlo purchase, contact support@merenlo.co.uk.

Payment providers may independently determine certain payment-authorisation decisions under their own legal responsibilities.

16. Security of Personal Information

We take the security of personal information seriously.

Appropriate technical and organisational measures are used to protect personal information against risks such as unauthorised access, accidental loss, misuse, alteration or unlawful disclosure.

The measures appropriate for particular information depend on the nature of the processing and the associated risks.

No online service or method of electronic transmission can be guaranteed to be completely secure.

If you believe that your personal information or Merenlo-related account information has been compromised, please contact us promptly.

17. Children's Privacy

Merenlo is a general online fashion store and is not directed specifically at children.

We do not knowingly seek to collect children's personal information for independent marketing purposes without an appropriate lawful basis.

If you believe personal information relating to a child has been provided or processed inappropriately, please contact support@merenlo.co.uk.

We will review the concern and take appropriate action in accordance with applicable law.

18. Data Protection Complaints

You have the right to raise a complaint about how your personal information has been handled.

You can make a data-protection complaint directly to Merenlo by contacting:

support@merenlo.co.uk

Please explain your concern and provide any relevant details that may help us investigate.

We will acknowledge a data-protection complaint within the period required by applicable UK law, normally within 30 days of receipt.

We will take appropriate steps to investigate the matter, keep you informed and communicate the outcome without undue delay.

You do not need to use a special form or legal terminology to submit a complaint.

You also have the right to raise a concern with the relevant supervisory authority.

For UK data-protection matters:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk

As BJ-Ecom B.V. is established in the Netherlands, the Dutch data-protection authority may also be relevant to processing governed by the EU GDPR.

Dutch supervisory authority:

Autoriteit Persoonsgegevens
Website: https://autoriteitpersoonsgegevens.nl

The applicable supervisory authority and complaint rights depend on the relevant processing and legal framework.

You are not required to surrender any statutory rights by contacting Merenlo first.

19. Information Required to Place an Order

Certain personal information is necessary to complete and fulfil a purchase.

For example, we generally require sufficient information to:

Identify the customer and order
Process payment
Arrange delivery
Send essential order communications
Administer any return, refund or cancellation

If you do not provide the information necessary for these purposes, we may be unable to complete or fulfil your order.

Providing personal information for optional marketing is not a condition of purchasing from Merenlo.

20. Third-Party Websites and Services

Our website may contain links or features provided by third parties.

When you use an external service or visit another website, that provider may collect or process personal information under its own privacy notice.

We encourage you to review the relevant privacy information before providing personal details to external services.

The fact that an external website is linked from Merenlo does not automatically mean that BJ-Ecom B.V. controls its independent data-processing activities.

21. Existing Customers and Previous Orders

Merenlo's current delivery market is the United Kingdom.

However, personal information relating to previous transactions may continue to be processed where necessary for order administration, accounting, returns, refunds, customer support, legal obligations or other lawful purposes.

Changes to our commercial delivery markets do not remove rights previously acquired by customers under applicable data-protection laws.

Where the EU GDPR applies to particular processing activities, the corresponding rights and obligations remain relevant.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

Our services and store operations
Applicable privacy legislation
Service providers
Marketing and tracking activities
Security and operational requirements
The way personal information is processed

The updated Privacy Policy will be published on this page with its revision date.

Where applicable law requires additional notice or consent for a material change, we will follow those requirements.

23. Contact Us About Privacy

For questions about this Privacy Policy, requests concerning your personal information, marketing objections or data-protection complaints, please contact:

Merenlo — Privacy Enquiries

Legal operator and data controller