Chocolicious Ltd. ("Chocolicious", "we", "us", "our") respects your privacy and is committed to protecting your personal data. This policy explains what data we collect, how we use it, and your rights under the UK GDPR, EU GDPR and applicable US state privacy laws.
1. Data we collect
- Identity and contact data: name, company, job title, email, phone number.
- Commercial data: order history, product preferences, credit references.
- Technical data: IP address, browser type, device information, cookies.
- Correspondence: any messages or documents you send to us.
2. How we use your data
- To process orders and deliver Goods.
- To provide customer service and account management.
- To send transactional communications and (with consent) marketing emails.
- To meet legal, tax and regulatory obligations.
- To prevent fraud and secure our systems.
3. Legal basis for processing
We process personal data on the following legal bases: (a) performance of a contract; (b) compliance with legal obligations; (c) legitimate interests (running our business, marketing to existing customers); and (d) consent (for direct marketing to prospects).
4. Data retention
We retain personal data only as long as necessary for the purposes described in this policy, and in line with statutory retention requirements — typically six years for transactional records, and up to two years for marketing prospects after last engagement.
5. Third-party sharing
We share personal data only with trusted third parties who help us operate our business, including logistics providers, payment processors, IT service providers, professional advisors and regulators. All third parties are bound by contractual confidentiality and data protection obligations.
6. International data transfers
As a business operating across the US, UK and EU, we may transfer personal data internationally. Where data is transferred outside the UK or EEA, we rely on adequacy decisions, Standard Contractual Clauses or other lawful transfer mechanisms.
7. Cookies
Our website uses cookies to improve your experience and analyse traffic. See our Cookie Policy for full details.
8. Your rights
- Access — request a copy of your personal data.
- Rectification — correct inaccurate data.
- Erasure — request deletion (subject to legal retention).
- Restriction — limit how we use your data.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests or direct marketing.
- Withdraw consent — where processing is based on consent.
9. How to contact us about data
To exercise any of the rights above, or if you have questions about this policy, email chocoliciousamz@gmail.com or write to Data Protection, Chocolicious Ltd., 20 Wenlock Road, London N1 7GU, UK.
10. How to complain
If you are not satisfied with our response, you may lodge a complaint with the UK Information Commissioner's Office (ico.org.uk), your local EU supervisory authority, or your relevant US state attorney general.