Who we are
Calmo · calmobaby.com · hello@calmobaby.com
We’re the “controller” of your personal data. That means we decide how it’s used, and we’re responsible for looking after it under the UK GDPR and the Data Protection Act 2018.
Questions about your data? Email hello@calmobaby.com with “Privacy” in the subject line. A member of the Calmo team will deal with it and reply within one month.
What we collect
| What | For example | When |
|---|---|---|
| Contact details | Your name, email address, and phone number if you give one | When you order, join the club, or get in touch |
| Delivery and billing details | Delivery address, billing address | When you order |
| Order history | What you bought and when, returns, refunds | When you order or send something back |
| Messages | Emails, contact form messages, and photos you send us of a faulty or damaged item | When you contact us |
| Reviews | Your review, star rating, and the name you post under | When you leave a review |
| Club membership | Points balance and, if you choose, your little one’s birthday month or age | When you join The Night Shift Club |
| Tester Panel applications | What you tell us about your household and the problems you’d like to fix | When you apply |
| Website data | Device and browser type, IP address, pages visited | When you use the site (optional cookies only with your consent) |
| Marketing preferences | Whether you’ve said yes to emails, and when | When you choose |
We don’t need health information about you or your child, so please don’t send it unless you have to (for example, to report a safety incident). If you do, we’ll only use it with your explicit consent, and only to deal with that issue. You can withdraw that consent at any time.
Why we use it
The law says we need a lawful basis for everything we do with your data. Here are ours.
| What we do | Lawful basis |
|---|---|
| Taking, delivering and returning your order, running the 60-night trial, and refunding you | Contract |
| Answering your messages | Contract (about an order), or legitimate interests (anything else) |
| Keeping accounting and tax records | Legal obligation |
| Contacting you about a safety issue or a recall | Legal obligation and legitimate interests |
| Preventing fraud and keeping the site secure | Legitimate interests |
| Inviting you to review a product you bought, and publishing reviews | Legitimate interests |
| Running The Night Shift Club: points, early access | Contract |
| Your little one’s birthday month or age, and sending your first-birthday gift | Consent (withdraw it any time) |
| Any health information you choose to send us | Explicit consent (withdraw it any time) |
| Running the Tester Panel | Contract, or steps you’ve asked us to take before one |
| Marketing emails | Consent (withdraw it any time) |
| Optional cookies: analytics and advertising | Consent (withdraw it any time) |
“Legitimate interests” means we have a genuine reason that doesn’t override your rights. You’d expect us to keep fraudsters out, for example. You can object to anything we do on this basis; see your rights.
Payments
Payments are handled by Shopify Payments (Visa, Mastercard, American Express, Apple Pay and Google Pay) and PayPal. You can read their privacy notices at shopify.com/legal/privacy and paypal.com. Your card details go straight to them. We never see or store your full card number.
The provider may use your details to check for fraud, under its own privacy notice. We receive confirmation that you’ve paid, plus limited details such as the card type and last four digits, so we can match refunds to the right payment.
Marketing emails
- We only send marketing emails if you’ve said yes. The box is never ticked for you.
- Every marketing email has an unsubscribe link at the bottom. One click and you’re off the list. Or just email us.
- Unsubscribing doesn’t affect emails about your orders, like confirmations, dispatch and tracking. You can also ask us to stop sending review invitations at any time.
- We don’t buy email lists, and we don’t share yours.
Children’s data
Calmo is for grown-ups. Our shop, The Night Shift Club and the Tester Panel are for adults, and we don’t knowingly collect personal data from children. If you think a child has given us their details, tell us and we’ll delete them.
The only information we hold about little ones is what a parent chooses to give us: an optional birthday month or age for The Night Shift Club and, if you apply, anything you tell us on a Tester Panel application. We use it to send your birthday gift, to match products to testers, and, if you’ve said yes to emails, to keep them relevant to your child’s age.
We only ask for the birthday month, never the full date of birth. You can change or delete it whenever you like.
How long we keep it
No longer than we need to. Here’s the plan:
| Data | How long |
|---|---|
| Orders, invoices and refunds | 6 years after the end of the financial year they relate to, because tax law requires it |
| Customer service messages | 2 years after your last contact with us |
| Club membership | While you’re a member, then 30 days after you leave |
| Your little one’s birthday month or age | Until you delete it or leave the club |
| Reviews | While they’re published, or until you ask us to remove yours |
| Tester Panel applications | 12 months |
| Marketing consent | Until you unsubscribe. After that we keep just your email address on a “do not email” list, so you’re never added back by mistake. |
| Cookies | See the cookie table |
Keeping it safe
The site uses encrypted connections (HTTPS). Only people who need your data to do their job can see it, and we only use providers who protect it properly. If something ever goes wrong and it puts you at risk, we’ll tell you and the ICO, as the law requires.
Your rights
Under UK data protection law, you have the right to:
- Access your data and get a copy of it.
- Correct anything that’s wrong or incomplete.
- Delete your data, where we don’t have to keep it.
- Restrict how we use it, for example while a complaint is looked into.
- Object to us using it on the basis of legitimate interests, and to marketing at any time.
- Take it with you in a format another company can use (data portability).
- Withdraw consent at any time, where we rely on it.
To use any of these, email hello@calmobaby.com with “Privacy” in the subject line. It’s free. We’ll reply within one month, and if a request is complicated we’ll tell you if we need longer. We may ask you to confirm who you are, so we don’t hand your data to someone else.
Complaints
If you’re unhappy with how we’ve handled your data, please tell us first. We’d like the chance to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk, or call 0303 123 1113.
Changes to this notice
If we change how we use your data, we’ll update this page. If the change is significant, we’ll email you about it as well.
Last updated: 25 October 2026