Privacy Policy

Last updated: October 5, 2026

Your family's trust matters to us, and that includes how we handle your personal information. This policy explains what we collect, why, who we share it with, and the choices you have.

Contents: 1. Who we are · 2. What we collect · 3. Why we use it, and on what basis · 4. Who we share it with · 5. International transfers · 6. How long we keep it · 7. Cookies · 8. Marketing emails · 9. Your rights · 10. Children · 11. Security · 12. Changes to this policy · 13. Contact

1. Who we are

The Milky Box (themilkybox.com) is operated by The Milky Box, based in the Netherlands. We are the "controller" of your personal information, which means we decide how and why it is used.

Questions about privacy? Email us at hello@themilkybox.com.

2. What we collect

  • Order and account details: your name, shipping and billing address, email address, phone number, order history and subscription settings.
  • Payment details: your payment is processed by our payment providers. We don't see or store your full card number.
  • Communication: messages you send us by email or live chat, and photos you send when reporting a problem with an order.
  • Device and browsing data: your IP address, browser and device type, pages viewed and how you arrived at our store, collected through cookies and similar technologies (see section 7).
  • Marketing preferences: whether you've signed up for our emails and how you interact with them.

We don't collect information about your baby's health, and we ask you not to send us medical details. If you choose to share them, for example in a chat, we use them only to answer your question.

3. Why we use it, and on what basis

What we use it forLegal basis
Processing, shipping and delivering your orders and subscriptionsTo perform our contract with you
Customer service, reshipments, claims and refundsTo perform our contract with you
Keeping order and invoice recordsTo meet our legal obligations (tax and accounting law)
Preventing fraud and keeping our store secureOur legitimate interest in protecting our customers and business
Improving our store and understanding how it's usedYour consent (analytics cookies) or our legitimate interest
Sending marketing emails and offersYour consent, which you can withdraw at any time
Showing you relevant ads on other websitesYour consent (marketing cookies)

4. Who we share it with

We never sell your personal information. We share it only with service providers who help us run our store, and only what they need to do their job:

  • Our store platform: Shopify, which hosts our store and stores order data.
  • Payment providers: to process your payment securely.
  • Carriers: UPS, DHL, FedEx, Belgian Post, PostNL, Landmark Global, Canada Post and Canpar, to deliver your order.
  • Our fulfillment partners: our warehouses in the EU and, for Sprout Organic® orders, our fulfillment partner in Australia.
  • Customs authorities: in your country, as required for international shipping.
  • Marketing, loyalty and support tools: such as our email marketing, loyalty program, live chat, subscription, reviews and analytics providers.

We may also share information if the law requires it, to protect our rights or prevent fraud, or if our business is sold or merged, in which case the new owner would continue to protect it under this policy.

5. International transfers

We deliver to North America, South America, Asia and Australia, and some of our service providers are based outside the EU, for example in the United States, Canada and Australia. When your information is transferred outside the European Economic Area, we make sure it stays protected, for example through the European Commission's Standard Contractual Clauses or an adequacy decision, such as the EU–US Data Privacy Framework.

6. How long we keep it

  • Order and invoice records: 7 years, as Dutch tax law requires.
  • Account and subscription details: for as long as your account is active, and then up to 2 years.
  • Customer service messages: up to 2 years after your last contact.
  • Marketing data: until you unsubscribe or withdraw your consent.
  • Cookies: as described in our cookie banner and settings.

7. Cookies

We use cookies and similar technologies to make our store work, to remember your cart, and, with your permission, to understand how our store is used and to show you relevant ads.

  • Necessary cookies keep the store working (for example, your cart and checkout). They don't need consent.
  • Analytics and marketing cookies are only used if you accept them in our cookie banner. You can change your choice at any time through the cookie settings link in our footer.

8. Marketing emails

We only send marketing emails if you've signed up for them. Every email has an unsubscribe link, and you can also email us to stop receiving them. Order and shipping emails are not marketing, so you'll still receive those.

9. Your rights

Wherever you live, you can ask us to:

  • give you a copy of your personal information,
  • correct information that is wrong,
  • delete your information, unless we have to keep it by law (for example, invoices),
  • limit how we use it, or object to how we use it,
  • send your information to you or another company in a common format,
  • withdraw your consent at any time, without affecting what we did before.

Email hello@themilkybox.com and we'll respond within one month. We may ask you to confirm your identity first.

If you're not happy with how we've handled your request, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the data protection authority in your own country.

10. Children

Our store is for parents and caregivers. It isn't directed at children, and we don't knowingly collect personal information from anyone under 16.

11. Security

We protect your information with appropriate technical and organizational measures. Our store uses encrypted (HTTPS) connections, and card payments are handled by payment providers that meet the Payment Card Industry Data Security Standard (PCI-DSS). No method of transmission or storage is completely secure, but we work hard to protect your data.

12. Changes to this policy

We may update this policy from time to time. We'll post any changes on this page with a new "last updated" date, and let you know about important changes by email or on our website.

13. Contact

For any privacy question or request, email hello@themilkybox.com.