Privacy policy

Last updated: March 20, 2026

Mediterranean Week (“Mediterranean Week,” “we,” “us,” or “our”) provides digital Mediterranean meal plans, subscription services, customer account access, and related content through our website and online store (the “Services”). Our store is hosted on Shopify, and we use Klaviyo for certain email communications and marketing activities. Shopify and Klaviyo each publish their own privacy information and process certain data in connection with the services they provide to us.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, create an account, purchase a plan, subscribe, receive emails from us, contact us, or otherwise use the Services.

By using the Services, you acknowledge that you have read this Privacy Policy.

1. What personal information we collect

Depending on how you interact with us, we may collect the following personal information:

  • Contact information, such as your name, email address, phone number, and billing address.
  • Order and subscription information, such as the plan you purchase, order history, subscription status, renewals, cancellations, failed payments, and account access information.
  • Account information, such as your customer login, preferences, and customer tags or access permissions associated with your account.
  • Payment information, such as billing details, transaction confirmations, and payment-related status information. Payment card information is processed by our payment providers and is not stored by us in full.
  • Communications, including information you send to us through our contact form or by email.
  • Technical and usage information, such as IP address, browser type, device information, pages viewed, referral source, and how you interact with our website and emails.
  • Marketing information, such as whether you subscribed to marketing emails, opened an email, or clicked a link.

Under BC’s Personal Information Protection Act (“PIPA”), organizations may collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

2. How we collect personal information

We collect personal information:

  • Directly from you, when you place an order, create an account, subscribe, fill out a form, or contact us.
  • Automatically, through cookies and similar technologies when you browse or use the Services.
  • From service providers and platform partners, including Shopify, payment processors, subscription/account tools, and Klaviyo.
  • From transaction events, such as order confirmations, subscription starts, renewals, reactivations, cancellations, and payment failures.

3. How we use personal information

We use personal information to:

  • provide and operate the Services;
  • process orders, subscriptions, payments, renewals, and cancellations;
  • deliver and manage access to your weekly or monthly plan;
  • maintain customer accounts and customer account pages;
  • send transactional emails, including order confirmations, plan-access emails, renewal-related emails, cancellation emails, failed-payment emails, and support replies;
  • send marketing emails where permitted by law and where you have subscribed or otherwise consented;
  • improve our website, email flows, customer experience, and product delivery;
  • detect fraud, protect accounts, and secure the Services; and
  • comply with legal obligations and enforce our terms and policies.

BC PIPA requires valid notice and consent practices, and it prohibits requiring consent beyond what is necessary to provide the product or service. It also allows individuals to withdraw consent on reasonable notice, subject to legal and contractual limits.

4. Email communications and marketing

We may send two categories of email:

Transactional or service emails, such as order confirmations, access instructions, account notices, subscription management messages, failed-payment notices, cancellation confirmations, and customer support responses.

Marketing emails, such as product updates, educational content, promotional messages, and offers.

We use Klaviyo to manage some of our email communications and automations. Klaviyo acts as a service provider/processor in connection with customer data processed on our behalf under its data processing terms.

If we send commercial electronic messages to people in Canada, we aim to comply with CASL, including consent, sender identification, and unsubscribe requirements.

You can unsubscribe from marketing emails at any time using the unsubscribe link included in those messages. Even if you unsubscribe from marketing, we may still send transactional or service-related emails.

5. Cookies and similar technologies

We and our service providers, including Shopify and Klaviyo, may use cookies, pixels, tags, and similar technologies to:

  • keep the website functioning properly;
  • remember preferences and account state;
  • understand website traffic and usage patterns;
  • measure campaign and email performance;
  • improve the Services; and
  • support marketing and retargeting where permitted.

You can usually manage cookies through your browser settings. Disabling some cookies may affect site functionality.

Shopify provides privacy and customer-privacy tools for merchants, but Shopify also states that automated settings are not a substitute for legal review and that merchants remain responsible for keeping policy content accurate.

6. Shopify

Our online store is hosted by Shopify. Shopify processes personal information in order to provide the ecommerce platform, checkout, customer account functionality, and related services we use to operate Mediterranean Week. Shopify also publishes its own consumer privacy policy and privacy controls.

Information you submit through our store may be processed by Shopify and its service providers in order to support purchases, accounts, store operations, and related platform features.

7. Klaviyo

We use Klaviyo for email automations, transactional and marketing messaging, and related customer communication workflows. Klaviyo may process customer data such as names, email addresses, IP addresses, cookie data, and interaction data as needed to provide its services to us under its contractual terms. Klaviyo states that customer personal data it processes on behalf of customers is handled under its Data Processing Agreement.

8. When we disclose personal information

We may disclose personal information to:

  • Shopify and apps, tools, and vendors that help us run the Services;
  • payment processors and subscription/account providers;
  • Klaviyo and related email service providers;
  • analytics, security, and fraud-prevention providers;
  • professional advisers where reasonably necessary;
  • government authorities, regulators, or law enforcement where required by law; and
  • a buyer or successor in connection with a business sale, merger, financing, or restructuring.

We do not sell your personal information in the ordinary sense of selling customer lists.

9. International processing

Some of our service providers may store or process personal information outside British Columbia or outside Canada, including in the United States. Klaviyo states that customer data is stored in the United States, and Shopify may also process data across jurisdictions in order to provide platform services.

As a result, your personal information may be accessible under the laws of those foreign jurisdictions.

10. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

  • provide the Services;
  • maintain customer accounts and subscription access;
  • keep business, accounting, tax, and legal records;
  • resolve disputes; and
  • enforce our agreements and policies.

BC PIPA requires organizations to protect personal information and to destroy it, or remove identifiers, once retention is no longer reasonable for legal or business purposes.

11. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, disclosure, or alteration. However, no method of internet transmission or electronic storage is completely secure.

BC PIPA requires organizations to make reasonable security arrangements to protect personal information in their custody or control.

12. Your rights

Subject to applicable law, you may request:

  • access to personal information we hold about you;
  • correction of inaccurate personal information;
  • information about how your personal information has been used or disclosed, where applicable; and
  • withdrawal of consent in certain circumstances, subject to legal or contractual limits and reasonable notice.

To make a privacy request, contact us at support@mediterraneanweek.com with the subject line Privacy Request.

BC PIPA requires organizations to designate a person to ensure compliance and make that person’s contact information available. It also gives individuals rights relating to access, correction, and withdrawal of consent.

13. Children

Our Services are not directed to children under the age of majority in their jurisdiction, and we do not knowingly collect personal information from children for independent use of the Services.

14. Third-party links

Our website or emails may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. You should review their policies before providing personal information to them.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, service providers, technology, or legal requirements. When we do, we will post the updated version and revise the “Last updated” date above.

16. Contact us

If you have questions, requests, or complaints about this Privacy Policy or our privacy practices, please contact:

Mediterranean Week

Privacy Officer

Email: support@mediterraneanweek.com

If you are not satisfied with our response and you are in British Columbia, you may contact the Office of the Information and Privacy Commissioner for British Columbia.