Privacy policy

Last updated: 26 October 2026

Who we are

Madeleine Thompson Limited is registered in Hong Kong under registration number 60466115-000-10-18-9. Our registered address is 42 Sassoon Road, House 6, Hong Kong. Contact our customer care team at info@mt-cashmere.com.

This notice explains how we use personal information when you browse, shop, contact us or subscribe to updates. Madeleine Thompson Limited is responsible for the information we process for our own business purposes. Some providers also process information for their own purposes, as described below and in their privacy notices.

Information we use

Contact and order information, such as your name, email, telephone number, delivery and billing addresses, purchases, returns and correspondence.
Account and preference information, including sign-in details handled through the account service, marketing choices and consent records.
Transaction and payment-status information received from our payment providers. Payment details are handled by the provider you choose; we do not need your full payment-card number to provide customer service.
Device and activity information, such as IP address, browser and device information, cookie identifiers, pages and products viewed, basket and checkout activity, purchases, referring websites and interactions with emails, subject to applicable consent requirements.

We receive information from you, from your interactions with our website, and from providers that help us operate the store, process payments, fulfil orders and measure marketing. Providing the information needed for payment and delivery is necessary to fulfil an order; marketing consent is optional.

Why we use it

Orders and customer service: to take payment, fulfil orders, manage returns and answer enquiries. We rely on performance of our contract with you or steps you request before a purchase.
Security and business administration: to prevent fraud, protect the website, manage complaints and maintain business records. We rely on legitimate interests in running a secure business, balanced against your rights, and legal obligations where applicable.
Legal and accounting requirements: to keep required tax and transaction records and respond to lawful requests, relying on our legal obligations.
Email marketing: to send collection news and offers when you subscribe or where otherwise permitted by law. Where consent is required, we rely on consent. You can unsubscribe at any time.
Analytics, personalisation and advertising: to understand store performance, personalise communications and measure or improve advertising. Where cookies, similar technologies or data processing require consent, we rely on your consent. We do not treat merely browsing the website as consent to advertising tracking.

Providers and data sharing

We share information needed for the relevant service with the following providers or categories of recipient:

Shopify: our store, checkout, customer accounts, order management, analytics and related commerce services. Shopify Network Intelligence is enabled and allows Shopify to use information from interactions with our store together with information from other merchants to provide enhanced services, including personalisation and advertising-related services. For these purposes Shopify may act as an independent controller. See the Shopify Consumer Privacy Policy and Shopify Privacy Portal for its practices and controls.
Klaviyo: mailing-list signup forms, subscriber preferences, email communications and marketing measurement. Depending on your activity and consent, this can include contact details, purchase history and email or website interactions. See Klaviyo's privacy notice.
Meta (Facebook and Instagram): advertising measurement and permitted advertising personalisation through connected tracking tools. Depending on your choices and the integration, information can include device and cookie identifiers, page and product views, basket and checkout events, purchase value and items purchased, and matching information where enabled. Meta may use information for its own purposes under its privacy policy.
Payment providers: including Shopify Payments and PayPal where selected, to process payments, refunds and security checks. They receive the information required for those transactions and may have their own legal obligations.
Fulfilment and delivery providers: warehouses and carriers receive the order and contact information needed to dispatch and deliver purchases and handle returns.
Service providers and advisers: providers supporting website operation, analytics, advertising campaigns, customer service, accounting and legal advice, with access limited to the purposes for which they assist us.

We may also disclose information where required by law, to establish or defend legal claims, or in connection with a business transfer subject to applicable protections. Third-party websites and services have their own privacy notices.

Cookies and your choices

Cookies, pixels and similar technologies can support essential store functions, remember preferences, measure website and email activity, and help measure advertising. Essential technologies support functions such as baskets, checkout, security and saving privacy choices. Optional analytics and advertising technologies are subject to consent where required by law.

Where a cookie banner or privacy-preferences control is displayed, you can accept, decline or choose optional categories there. You can withdraw consent using the available privacy controls or contact info@mt-cashmere.com for help. You can also delete or block cookies through your browser; doing so may affect store functions and does not by itself undo information already lawfully processed. Choices can be specific to a browser or device.

Unsubscribe from marketing emails using the link in any marketing email or by contacting info@mt-cashmere.com. This does not stop necessary order or service messages. Where email measurement is enabled, interactions such as opens and link clicks may be used to measure and improve communications, subject to applicable consent requirements. Meta and Shopify also provide controls for their own services through the links above.

International processing

We are based in Hong Kong and use providers in other countries. Information may be processed outside your country, including in Hong Kong and the United States. Our Shopify data-hosting setting is the United States, and Klaviyo describes its customer-data hosting as US-based. We do not represent that all information stays in the UK or EU.

Where UK or EEA transfer rules apply, the appropriate transfer mechanism depends on the recipient and destination. Provider arrangements may use an applicable adequacy decision, recognised data-privacy framework, or approved contractual safeguards, including relevant UK provisions. Shopify and Klaviyo describe these arrangements in their Shopify data-processing terms and Klaviyo data-processing agreement. Contact us for information about safeguards relevant to your data or how to obtain a copy.

How long we keep information

We keep information for as long as needed for the purpose for which it was collected, taking account of legal, accounting and dispute-resolution requirements. Order, invoice and tax records are generally retained for at least six years where required. Account information is kept while needed to provide the account and related services. Marketing information is kept while you remain subscribed or as otherwise permitted; we may retain a limited suppression record after unsubscribing so we can respect your choice. Enquiry and technical records are kept for the period needed to resolve the enquiry, secure our services or measure the relevant activity, rather than indefinitely for unrelated purposes.

Your rights

Depending on the law that applies, you may request access, correction, deletion, restriction or portability of your information. You may object to processing based on legitimate interests and you can object to direct marketing at any time. You may withdraw consent without affecting processing lawfully carried out before withdrawal. Certain information may need to be retained to meet legal obligations or resolve claims.

Send requests to info@mt-cashmere.com. We may need proportionate information to verify your identity. We normally respond to UK and EU rights requests within one month, or explain any lawful extension. Where local law gives you a right to opt out of sale or sharing for targeted advertising, you can contact us to exercise it and use any applicable privacy controls made available on the store.

You can complain to the UK Information Commissioner's Office, your local EU data-protection authority or, where applicable, the Hong Kong Privacy Commissioner for Personal Data. We would also welcome the opportunity to address your concern directly.

Security, children and updates

We use appropriate safeguards to protect personal information, but no online service can guarantee absolute security. Keep your sign-in details secure. Our store is not directed at children, and we do not knowingly collect children's information for marketing. Contact us if you believe a child has provided information that should be removed.

We will date updates to this notice and provide additional notice or seek fresh consent where required. For questions, contact info@mt-cashmere.com or use our contact page.