Our Cookies Policy is set out below, at the end of this Privacy Policy.

PURPOSE OF THIS PRIVACY POLICY

Last updated: September 2026

1. INTRODUCTION

Chocolate & Co (“we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy.

This Privacy Policy explains how we collect, use, and protect your personal data when you:

• visit our website

• purchase products or services

• contact us

• apply or are referred to our programmes

• engage with our support services

We recognise that some individuals we work with may be in vulnerable situations. We are committed to handling all personal data with care, dignity, and respect.

2. WHO WE ARE

Chocolate & Co is a registered charity in England & Wales (No. 1209385).

Contact details:
Address: 4 Mansfield House, Lowther Street, York, YO31 7NB
Email: admin@chocolateandco.org
Website: www.Chocolateandco.org

We are the data controller responsible for your personal data.

We do not have a statutory requirement to appoint a Data Protection Officer. However, for any data protection queries, please contact us using the details above.

3. THE DATA WE COLLECT

We may collect the following types of personal data:

Standard personal data

• Identity data (name)

• Contact data (address, email, phone number)

• Transaction data (orders, purchases)

• Technical data (IP address, device information)

• Usage data (how you use our website)

• Profile data (account details, preferences)

• Marketing preferences

Sensitive (special category) data

Where relevant to our programmes, we may collect:

• Mental health information

• Physical health information

• Information relating to substance use or recovery

We only collect this where:

• it is necessary to support you, and

• you have provided explicit consent, or

• it is required for safeguarding or substantial public interest purposes

Criminal offence data

We may collect information about criminal convictions where necessary to:

• ensure a safe and supportive environment

• assess suitability for participation in our programmes

This data is processed in accordance with:

• Article 10 UK GDPR

• Schedule 1 of the Data Protection Act 2018

• Our internal Appropriate Policy Document

4. HOW WE COLLECT YOUR DATA

We collect personal data through:

Direct interactions

When you:

• complete forms (including referral forms)

• contact us

• make purchases

• create an account

• participate in programmes

 Automated technologies

When you use our website, we may collect Technical and Usage Data through:

• cookies

• analytics tools

(See Section 13 – Cookies)

5. HOW WE USE YOUR DATA (LAWFUL BASIS)

We only process personal data where we have a lawful basis to do so.

6. MARKETING

We may send you marketing communications if:

• you have given consent, or

• you have purchased from us and have not opted out

You can stop receiving marketing at any time by:

• clicking the unsubscribe link

• contacting us directly

We do not sell your personal data.

7. SHARING YOUR DATA

We may share your personal data with trusted third parties where necessary, including:

• Payment providers (e.g. Worldpay)

• Delivery providers (e.g. Royal Mail, DPD)

• IT and cloud service providers

• Email and communications platforms

• Analytics providers

• Professional advisers (where required)

Where sensitive or criminal data is involved:

• access is strictly limited

• sharing is minimised and controlled

We require all third parties to process your data securely and lawfully.

8. INTERNATIONAL TRANSFERS

Some of our service providers may be based outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations

• International Data Transfer Agreements (IDTAs)

• Standard contractual clauses

9. DATA SECURITY

We implement appropriate technical and organisational measures to protect your data, including:

• restricted access to sensitive data

• staff training on confidentiality and safeguarding

• secure storage systems

Information relating to health, vulnerability, or criminal history is handled with additional safeguards and limited access.

10. DATA RETENTION

We retain personal data only for as long as necessary.

Typical retention periods:

• Programme/referral data: duration of engagement + defined safeguarding period

• Transaction data: up to 7 years (legal requirements)

• Marketing data: until consent is withdrawn

• Website analytics: as set out in our Cookie Policy

Sensitive data is reviewed regularly and deleted when no longer required.

11. YOUR RIGHTS

Under UK GDPR, you have the right to:

• Access your personal data

• Request correction

• Request deletion

• Restrict processing

• Object to processing

• Data portability

• Withdraw consent at any time

Where processing is based on safeguarding or legal obligations, some rights may be limited.

To exercise your rights, contact us using the details above.

12. COMPLAINTS

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: https://www.ico.org.uk
Telephone: 0303 123 1113

We encourage you to contact us first so we can try to resolve your concern.

 13. COOKIES

We use cookies and similar technologies to:

• operate our website

• analyse usage

• improve performance

• support marketing

We will request your consent before placing non-essential cookies.

You can manage your preferences through our cookie banner or browser settings.

For full details, see our Cookie Policy.

14. THIRD-PARTY LINKS

Our website may contain links to other websites. We are not responsible for their privacy practices.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. The latest version will always be available on our website.