You can find our full policy here:

Introduction

Chocolate Moments Ltd (Company number 11195884) are committed to being transparent about how we collect and process your personal data and meeting our legal obligations.

This Privacy Notice sets out the company’s commitment to data protection and individual rights and obligations in relation to the

General Data Protection Regulation (2016) (GDPR) and the UK Data Protection Act (2018).

Chocolate Moments Ltd is the “data controller” for the purposes of data protection law and are registered with the Information Commissioner’s Office. (ICO)

We may update and change this Privacy Notice from time to time and we advise that you regularly check this page to ensure you are happy with the changes; we will however notify you of any significant alterations.

Lawful reasons to using your personal data

There several reasons we may collect and use your personal data which the law on data protection allows us to, including:

Consent

We will always request your consent when we collect and process your personal data

For example, when you sign up to receive our newsletters, you will need to tick the opt-in box.  Contractual obligations: For us to fulfil our contractual obligations to you we will need to use your personal data. For example, for us to deliver a product to you we will need your personal data including name and address. Legal or regulatory obligation

For example, we will need to pass and process your personal data to law enforcement if there is any involvement in fraud or criminal activity.

Legitimate Interests

Legitimate Interest means the interest of our business in conducting and managing our

business to enable us to give you the best service/product and the best and most secure

experience.

For example, we may send you promotional offers based on your past purchase history

What personal data do we collect?

We may collect the following information about you:

Personal data including name, job title, date of birth and company name

Contact data including email address, telephone number, postal address and postcode

Payment details such as bank account or credit card numbers

IP addresses

Information gathered using cookies in your web browser (See Cookie Policy)

If you connect, comment or provide feedback on our social media channels including

Facebook, Twitter, Instagram and LinkedIn we will see your username

How do we collect your personal data?

We use a number of methods to collect data from you and about you including:

New account customer forms

Product enquiries via the website, email or by phone

Visiting us at an exhibition or exchanging business cards

Engaging with us on social media

Passing details via virtual networking meetings

Purchasing a product from us

Opting in to receive our newsletter

How and why do we use your personal data?

At the time of providing personal data we will advise you why we are collecting it and how it will be

used. At any time, you can change how you wish us to use your data.

How and why we use your data include:

To set you up as a new customer and commence trading

To deliver our products to you

For example, we use third party carriers to deliver our products to you, in which case we will need to

supply them your details including name, address and contact details. If we cannot pass on your details,

then we cannot fulfil our contractual obligations to you.

To respond to any product enquiries or issues. For example, you may get in contact by phone, email or website. For us to find out details of the issue and help identify the solution we will need to follow up by contacting you directly. To send you communication via email, newsletters and other important business information. We will only send marketing communication if you have actively opened communications in the last 2 years or you have opted-in to receive communications.

For example, we will send newsletters that include product updates, new products and promotions.

We will also send active customers business related information regarding products and pricing.

You are free to opt-out at any point; details are available on all our newsletters.

Please note that if there is a legitimate business reason for us to communicate with you and to

ensure we can fulfil our business contract with you we may send you communications required by

law or which are necessary to inform you about our changes to the services we provide you.

For example, updates to this Privacy Notice, price changes, corporate updates, amendments to our

Terms & Conditions and legally required information relating to your orders. These Essential Business

Information emails will not include any promotional content and do not require prior consent when

sent by email. If we do not use your personal data for these purposes, we would be unable to comply

with our legal obligations.

To follow up any comments or queries that you have left on one of our social media channels

For example, if you show an interest in a product that we have promoted on one of our social media

channels, we will pass your details to one of our representatives to follow up and provide more

details to you

If you fail to provide personal data that we have requested either under the terms of contract with

you or required by law, we may not be able to supply our products to you.

Protecting your personal data

Chocolate Moments Ltd has several GDPR compliant processes and procedures as follows:



All Chocolate Moments employees have received training in GDPR and how to handle your

personal data



Access to your personal data is restricted to the relevant employees that are required to

process your data



Where hard copies are created, these are securely kept.



Your personal data will be periodically reviewed and securely deleted when required.



Internal systems and information security guidelines are tested to meet appropriate

standards.

How long will we keep your personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes in which we

collected it for, including for the purposes of satisfying any legal, accounting, or reporting

requirements.

For example, details of orders are kept for 3 years. Invoices will be kept for 7 years for legal obligations

To determine the appropriate retention period for personal data, we consider the amount, nature,

and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of

that information.

Who will we share your personal data with?

We will sometimes need to share your personal data with our trusted third parties, these can

include:



Delivery couriers including, but not limited to, DPD, Hermes and Royal Mail



Our website hosts, Wix.



HM Revenue & Customs, regulators and other authorities acting as processors or joint

controllers based in the United Kingdom who require reporting of processing activities in

certain circumstances



Our accountants



Stripe payment systems via our website.

Your legal rights over your personal data

You have the rights under the data protection laws in relation to your personal data including:



Request access to your personal data

(commonly known as a ‘data subject access request’).

This enables you to receive a copy of the personal data we hold about you and to check that

we are lawfully processing it.



Request correction of the personal data that we hold about you

. This enables you to have

any incomplete or out of date data we hold about you corrected, though we may need to

verify the accuracy of the new data you provide to us.



Request erasure of your personal data.

This enables you to ask us to delete or remove

personal data where there is no Business or legal reason for us continuing to process it.



Object to processing of your personal data

where we are relying on a Legitimate Interest (or

those of a third party) and there is something about your situation which makes you want to

object to processing on this ground as you feel it impacts on your fundamental rights and

freedoms.



Request restriction of processing of your personal data

. This enables you to ask us to

suspend the processing of your personal data in the following scenarios: (a) if you want us to

establish the data's accuracy; (b) where our use of the data is unlawful but you do not want

us to erase it; (c) where you need us to hold the data even if we no longer require it as you

need it to establish, exercise or defend legal claims; or (d) you have objected to our use of

your data but we need to verify whether we have overriding legitimate grounds to use it.



Request the transfer of your personal data to you or to a third party

. We will provide to

you, or a third party you have chosen, your personal data in a structured, commonly used,

machine-readable format. Note that this right only applies to automated information which

you initially provided consent for us to use or where we used the information to perform a

contract with you.



Withdraw consent

at any time where we are relying on consent to process your personal

data. However, this will not affect the lawfulness of any processing carried out before you

withdraw your consent. If you withdraw your consent, we may not be able to provide certain

services to you. We will advise you if this is the case at the time you withdraw your consent.

Please email us at

maria@chocolate-moments.co.uk

if you wish to exercise any of these rights.



There will be no fee in most cases – You will not have to pay a fee to access your personal

data (or to exercise any of the other rights). However, we may charge a reasonable fee if

your request is clearly unfounded, repetitive or excessive. There is the possibility that we

will refuse to comply with your request in these circumstances.



What we may need from you – to protect your personal data we will ask you to verify

your identity before proceeding with your request to access your personal data (or to

exercise any of your other rights). This is a security measure to ensure that personal data

is not disclosed to any person who has no right to receive it. We may also contact you to

ask you for further information in relation to your request to speed up our response.

If you have authorised a third party to submit a request on your behalf, we will request

proof that they have your permission to do so.

Time limit to respond - We will respond to all legitimate requests within 1 month from

the date of receipt of your request. Occasionally it may take us longer if your request is

particularly complex or you have made a number of requests. In this case, we will notify

you and keep you updated. Where you are sending us a request via post rather than

email, we recommend you send it via recorded delivery to guarantee safe delivery.

Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate,

or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our data protection officer.

Alternatively, you can make a complaint to the Information Commissioner’s Office:



Report a concern online at

https://ico.org.uk/concerns/



Call 0303 123

1113



Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane,

Wilmslow, Cheshire, SK9

5AF

Contact us

If you have any questions, concerns or would like more information about anything

mentioned in this privacy notice, please contact our

Privacy Officer

:

Email : maria@chocolate-moments.co.uk

Tel : 07885625343