Privacy policy

Last updated: 13 October 2026

Who we are

TUM.co.nz ("TUM", "we", "us") is run by The Mewburn Group, trading as TUM.co.nz, 185 Morrin Road, St Johns, Auckland 1072, New Zealand. This policy explains how we collect, use, share and protect personal information when you use tum.co.nz, TOM (our online personal shopper) and our subscriptions. We follow the New Zealand Privacy Act 2020.

What we collect

  • When you check out: your name, email, phone number, delivery and billing addresses, what you buy, delivery instructions and any order notes. Card payments are processed by our payment providers; we do not see or store your full card number.
  • If you create an account or a subscription: your account details, order history and subscription settings.
  • If you sign up for marketing: your email address and/or mobile number, and what you have signed up for.
  • When you browse our website: information about your device and visit, such as IP address, browser, pages viewed, searches, products added to cart and how you arrived, collected through cookies, pixels and similar tools (see "Cookies, pixels and advertising").
  • If you contact us: what you tell us and our replies.
  • If you use TOM: see "TOM and allergy information".

How we use it

  • To process, pack, deliver and support your orders and subscriptions, and to send order confirmations.
  • To send reminders about a checkout you started but did not finish, using the email you entered at checkout.
  • To send news and offers by email or text, only if you have chosen to receive them. You can unsubscribe at any time using the link in our emails or by replying STOP to our texts.
  • To understand how our website is used and improve it.
  • To measure our advertising and show TUM ads on other websites and apps.
  • To prevent fraud, and to meet legal obligations such as keeping tax records.

TOM and allergy information

TOM uses your answers only to build your basket. They are not saved to an account, and TOM's server discards them after use.

If you give TOM allergies and go to checkout, they are recorded in a separate allergy field on your cart, and on your order if you place it. This is health information. We use it only to help prepare your order, never for marketing. It is kept with your order until it is removed (see 'How long we keep it'), and is intended to be seen only by our authorised packing staff on the order page and printed packing slip. We keep it separate from the ordinary order note.

A packing instruction is not a guarantee that a product is free from an allergen, particularly for allergies TOM does not check. Please always check product labels. More detail: How TOM uses your information (shown in TOM).

Who we share it with

We share only what each provider needs:

  • Shopify: runs our online store, checkout, customer accounts and order records.
  • Payment providers: process payments. Our checkout currently offers card payments, PayPal, Afterpay and express options such as Shop Pay and Google Pay. If you choose to save your details with Shop, Shop's own terms and privacy policy apply.
  • Our own drivers and courier partners: receive your name, address, phone number and delivery notes so they can deliver your order.
  • Klaviyo: sends our marketing emails and texts, and checkout reminders. It receives details of your orders from our store.
  • Appstle: manages subscriptions.
  • Google (Analytics and Ads) and Meta (Facebook and Instagram): see "Cookies, pixels and advertising".
  • Recipe Kit: provides the recipes on our website.
  • Vercel: hosts TOM.

We do not sell your personal information. We may also share information where the law requires it, or to prevent fraud or protect our rights.

Information sent overseas

TOM's server is in Australia. Most of our other providers, including Shopify, Klaviyo, Google and Meta, store or process information in other countries, including the United States and Canada. Where a provider holds information only to provide a service to us, it is acting on our behalf, and we remain responsible for it under the Privacy Act. Google and Meta may also use information collected by their tools on our website for their own purposes, as described in their own privacy policies. Those countries may not have privacy laws equivalent to New Zealand's.

Cookies, pixels and advertising

Cookies are small files stored by your browser. Pixels are small pieces of code that report what happens on a page.

  • Essential cookies run the cart, checkout and your account.
  • Analytics: Shopify and Google Analytics record how visitors use our site.
  • Advertising: Google Ads and Meta receive information about your visit, such as pages viewed, items added to cart and purchases, so we can measure our ads and show TUM ads to people likely to be interested. Klaviyo receives similar information to support our emails and texts.

These tools run when you visit our website, whether or not you have signed up for marketing. Ticking or unticking the marketing boxes at checkout controls emails and texts only. To limit tracking you can:

How long we keep it

We keep order records for at least 7 years, as New Zealand tax law requires. Where you give TOM allergy information and place an order, we use it to help our packing team prepare your order. We normally remove this allergy information 90 days after delivery. If delivery is not recorded, we use the fulfilment or cancellation date instead. For orders that are not completed, we remove it about 180 days after the order is placed. We keep the rest of the order record as described above. We keep marketing details until you unsubscribe, plus a record that you unsubscribed. Unused carts expire within 30 days. TOM's technical logs are kept for up to 30 days. We keep other information only as long as we need it for the purposes above, and then delete or anonymise it.

Keeping it safe

We use established providers that protect information with encryption, and we limit staff access to what each person needs for their role. No system is completely secure. If a privacy breach is likely to cause serious harm, we will tell you and the Privacy Commissioner as the law requires. We will never ask for your password or full card number by email or phone.

Your rights

You can ask to see the personal information we hold about you and ask us to correct it. You can also ask us to delete information we do not need to keep. Email admin@tum.co.nz or write to us at the address above. We will respond as soon as we can, and within 20 working days.

If you are not happy with how we handle your information, please tell us so we can put it right. You can also complain to the Office of the Privacy Commissioner: privacy.org.nz.

Changes

We may update this policy. We will post the new version here with the date it changed.

Contact

admin@tum.co.nz · The Mewburn Group T/A TUM.co.nz, 185 Morrin Road, St Johns, Auckland 1072, New Zealand