Policies

Privacy Policy

Last updated: 1 November 2026

The Malu Club Limited ("The Mälu Club", "we", "us", "our") is committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, store and protect your personal information when you visit themaluclub.com, become a member, buy from our shop, store a car with us, attend or enquire about one of our events, or join our mailing list.

The Malu Club Limited is registered in England and Wales (company number 15059759), with its registered office at 71-75 Shelton Street, London, WC2H 9JQ. We are the data controller for the personal data described in this policy.

If you have any questions about this policy or how we handle your data, please contact us at info@themaluclub.com.

1. WHAT DATA WE COLLECT

Information you give us

  • Your name and contact details (email address, telephone number, postal address)
  • Billing and delivery addresses for shop orders, the delivery region you choose, and any personalisation you ask for (such as initials)
  • Membership details, including your membership number and the interests you tell us about
  • For car storage: details of your vehicle, its condition report and photographs, and your insurance details
  • Event bookings and enquiries, including the number of guests and any dietary or accessibility needs you choose to share
  • Anything else you tell us when you email, call or fill in a form on our website

Information collected automatically

  • Technical information such as your IP address, browser type and device, which our hosting provider records to run and protect the website

Information from third parties

  • Payment confirmations and transaction details from Stripe, our payment provider

We never see or store your full payment card details.

2. HOW WE USE YOUR DATA

  • Orders and payments: to process your order or membership payment, make and deliver your items, and handle returns and refunds
  • Membership: to administer your membership, issue your membership card and give you access to member events and benefits
  • Car storage: to store, care for and return your vehicle under our Car Storage Terms
  • Events: to manage your booking or enquiry and send you the information you need about the event
  • Customer service: to answer your questions and help you before and after a purchase
  • Legal and financial obligations: to keep accounting and tax records and to prevent fraud
  • Marketing: only with your consent, to tell you about our events, offers and new products. You can unsubscribe at any time

Legal basis for processing (UK GDPR)

  • Contract: processing your orders, membership, car storage and event bookings
  • Legitimate interests: answering enquiries, improving our service and preventing fraud
  • Legal obligation: financial record-keeping and compliance
  • Consent: marketing emails (you can withdraw your consent at any time)

3. PAYMENTS

All payments are handled by Stripe, a PCI-DSS compliant payment provider. When you pay:

  • You enter your card details directly on Stripe's secure checkout page; they are never sent to or stored by us
  • Stripe processes your payment data in line with its own privacy policy, available at stripe.com/gb/privacy
  • We receive confirmation of the payment together with your name, email, telephone number and the addresses you give at checkout, so that we can fulfil your order

4. WHO WE SHARE YOUR DATA WITH

We do not sell your personal data. We share it only where needed to provide our services:

  • Stripe: payment processing
  • Netlify: website hosting and our website forms
  • Couriers and makers: to make and deliver your order, including your name, delivery address and telephone number so the courier can deliver and, where needed, collect a signature
  • Event partners and venues: only what they need to deliver the event you have booked
  • Professional advisers: our accountants, lawyers and insurers, under strict confidentiality
  • Authorities: where the law requires it or to protect our legal rights

Some of these providers, such as Stripe and Netlify, may process data outside the UK. Where they do, they protect it with safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum.

5. HOW LONG WE KEEP YOUR DATA

  • Order, payment and membership records: 6 years, as required by UK tax law
  • Car storage records: for as long as we store your vehicle, then 6 years
  • Event guest information: up to 12 months after the event
  • Enquiries: 2 years from our last contact
  • Mailing list: until you unsubscribe

6. YOUR RIGHTS

Under UK GDPR you have the right to:

  • Access a copy of the personal data we hold about you
  • Ask us to correct data that is inaccurate or incomplete
  • Ask us to delete your data where there is no legitimate reason for us to keep it
  • Ask us to restrict how we use your data in certain circumstances
  • Receive your data in a structured, machine-readable format
  • Object to processing based on our legitimate interests, or to direct marketing
  • Withdraw your consent at any time, where we rely on consent

To use any of these rights, email info@themaluclub.com. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

7. COOKIES

Our website uses only the cookies needed for it to work and stay secure. We do not use advertising or tracking cookies, and we do not run analytics tools that follow you around the web. When you go to Stripe's checkout, Stripe sets its own cookies to process your payment securely and prevent fraud. Some pages show films hosted by YouTube in its privacy-enhanced mode; YouTube may store its own cookies or similar data in your browser when a film plays, under Google's privacy policy. You can control cookies through your browser settings.

8. KEEPING YOUR DATA SECURE

We take appropriate technical and organisational measures to protect your personal data, including encrypted (SSL/TLS) connections across our website, Stripe's PCI-DSS Level 1 payment platform, and restricting access to personal data to those who need it.

9. CHILDREN

Our website and membership are intended for adults. We do not knowingly collect personal data from anyone under 18.

10. CHANGES TO THIS POLICY

We may update this policy from time to time. Any changes will be posted on this page with a new "last updated" date. If we make significant changes, we will let members and customers know by email.

11. CONTACT US

The Malu Club Limited
71-75 Shelton Street, London, WC2H 9JQ
Company number 15059759, registered in England and Wales
Email: info@themaluclub.com
Telephone: 07496 472028