Privacy & GDPR Policy

Last updated: 22 September 2026

Sam Joseph Chocolates respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how Sam Joseph Chocolates collects, uses, stores and protects your personal data when you visit our website, place an order, contact us, sign up to our mailing list, or otherwise interact with us.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable UK data protection and privacy legislation.

1. Who we are

Sam Joseph Chocolates is the organisation responsible for your personal data.

For the purposes of UK data protection law, Sam Joseph Chocolates is the data controller of the personal information we collect and use.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the contact details provided on our website.

2. What personal information we collect

Depending on how you interact with us, we may collect and process the following information:

Information you provide when placing an order

• Your name
• Billing and delivery address
• Email address
• Telephone number, where provided
• Details of the products you order
• Order history
• Delivery information
• Payment and transaction information

Information you provide when contacting us

• Your name
• Email address
• Telephone number, where provided
• The contents of your enquiry or message

Marketing information

If you choose to receive marketing from us, we may collect:

• Your name
• Email address
• Your marketing preferences
• Information about whether you open or interact with our marketing emails, where this information is provided by our email marketing service

Website information

When you use our website, we may collect information such as:

• IP address
• Browser and device information
• Website usage information
• Pages visited
• Information collected through cookies and similar technologies

Please see our Cookie Policy for further information about cookies and similar technologies.

3. Why we use your personal information and our lawful bases

Under the UK GDPR, we must have a lawful basis for processing your personal data.

The lawful basis we use depends on why we are processing your information.

A. Processing and fulfilling your orders

We use your name, address, email address, telephone number and order information to:

• process and fulfil your orders;
• arrange delivery or collection;
• send order confirmations and updates;
• deal with queries relating to your order;
• process refunds, cancellations and returns; and
• provide customer service.

Lawful basis: Article 6(1)(b) – Contract

This processing is necessary for us to take steps at your request before entering into a contract and to perform our contract with you.

B. Taking and processing payments

We process information necessary to take payment for your order and maintain appropriate records of transactions.

We do not normally have access to or store your full payment card details where payment is processed by a third-party payment provider.

Lawful basis: Article 6(1)(b) – Contract

Processing payment information is necessary to fulfil our contract with you.

We may also be required to retain certain transaction and financial information to comply with legal obligations.

Additional lawful basis: Article 6(1)(c) – Legal obligation

C. Accounting, tax and financial records

We may process customer and transaction information to maintain our business records and comply with applicable accounting, tax and financial obligations.

Lawful basis: Article 6(1)(c) – Legal obligation

We may be legally required to retain certain financial records for a specified period.

D. Responding to enquiries

If you contact us by email, telephone, social media, through our website or by another method, we may process your personal information in order to respond to your enquiry.

Lawful basis: Article 6(1)(f) – Legitimate interests

Our legitimate interest is to communicate with customers and prospective customers, respond to enquiries and operate our business effectively.

Where your enquiry relates to an existing order or contract, processing may instead be necessary under:

Article 6(1)(b) – Contract

E. Customer service and managing our relationship with you

We may use your information to deal with customer service matters, complaints, refunds, returns and other issues relating to your relationship with us.

Lawful basis: Article 6(1)(f) – Legitimate interests

Our legitimate interests include providing customer service, maintaining our relationship with customers and managing our business.

Where the processing is necessary to fulfil an existing contract with you, we may rely on:

Article 6(1)(b) – Contract

F. Sending marketing emails

If you have specifically agreed to receive marketing communications from us, we may use your name and email address to send you information about our chocolates, products, offers, events and other Sam Joseph Chocolates news.

Lawful basis: Article 6(1)(a) – Consent

You can withdraw your consent to marketing at any time by using the unsubscribe link in our marketing emails or by contacting us.

Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew your consent.

Where applicable, we may also rely on the soft opt-in provisions under the Privacy and Electronic Communications Regulations (PECR) for existing customers, provided the relevant legal requirements are met.

G. Improving our products, website and services

We may use information about how customers interact with our website and services to understand how they are used and to improve our products, website, customer experience and business operations.

Lawful basis: Article 6(1)(f) – Legitimate interests

Our legitimate interests include improving our website, products and services and understanding how customers use them.

Where cookies or similar technologies are used that require consent, we will seek consent where legally required.

H. Website security and fraud prevention

We may process technical information such as IP addresses, device information and website activity to help:

• protect our website;
• prevent fraud and misuse;
• identify suspicious activity;
• maintain website security; and
• protect our customers and business.

Lawful basis: Article 6(1)(f) – Legitimate interests

Our legitimate interests are protecting our website, business, customers and systems from fraud, abuse and security threats.

I. Legal claims and protecting our business

We may process personal information where necessary to establish, exercise or defend legal claims or to obtain legal advice.

Lawful basis: Article 6(1)(f) – Legitimate interests

Our legitimate interests include protecting our legal rights and the interests of our business.

Where processing is necessary to comply with a legal obligation, we may instead rely on:

Article 6(1)(c) – Legal obligation

4. Legitimate interests

Where we rely on Article 6(1)(f) – legitimate interests, we consider whether our interests are balanced against your rights and freedoms.

We will only rely on legitimate interests where the processing is necessary, proportionate and does not override your rights and interests.

Our legitimate interests may include:

• operating and managing Sam Joseph Chocolates;
• providing customer service;
• communicating with customers;
• improving our products and services;
• improving and securing our website;
• preventing fraud and misuse;
• protecting our business and legal rights; and
• understanding and improving the customer experience.

The ICO states that where legitimate interests are used, organisations should identify the legitimate interest and consider the impact on individuals.

5. Sharing your personal information

We do not sell your personal information.

We may share personal information with trusted third parties where necessary to operate our business and provide our services.

These may include:

• payment service providers;
• website hosting providers;
• e-commerce and website service providers;
• delivery and postal companies;
• email marketing providers;
• IT and technical service providers;
• accountants and professional advisers;
• fraud prevention and security providers; and
• government, regulatory or law enforcement bodies where we are legally required to do so.

Where a third party processes personal information on our behalf, we take reasonable steps to ensure that appropriate contractual and security arrangements are in place.

6. International transfers

Some of the service providers we use may process personal data outside the UK.

Where personal data is transferred outside the UK, we will ensure that the transfer is carried out in accordance with applicable UK data protection law and that appropriate safeguards are in place where required.

These safeguards may include an adequacy decision or appropriate contractual safeguards.

7. How long we keep your information

We will only keep your personal information for as long as it is reasonably necessary for the purpose for which it was collected.

Different types of information may be retained for different periods.

For example:

• Order information: retained for as long as reasonably necessary to manage your order and customer relationship and to meet our legal and accounting obligations.
• Financial and transaction records: retained for the period required by applicable tax and accounting legislation.
• Customer enquiries: normally retained only for as long as necessary to deal with the enquiry and any related matter.
• Marketing information: retained until you unsubscribe or withdraw your consent, subject to any information we need to retain for other legitimate or legal purposes.
• Website and technical information: retained for periods appropriate to the purpose for which it was collected.

When personal information is no longer required, we will securely delete it or anonymise it where appropriate.

The ICO requires privacy information to explain how long personal data is kept, or the criteria used to determine the retention period.

8. Your data protection rights

Under UK data protection law, you may have the following rights:

Right of access

You can ask us for a copy of the personal information we hold about you.

Right to rectification

You can ask us to correct inaccurate or incomplete information.

Right to erasure

In certain circumstances, you can ask us to delete your personal information.

Right to restrict processing

In certain circumstances, you can ask us to restrict how we use your personal information.

Right to data portability

Where applicable, you may have the right to receive certain personal information in a structured, commonly used and machine-readable format.

Right to object

You may have the right to object to certain processing, particularly where we rely on legitimate interests.

You have an absolute right to object to direct marketing.

Right to withdraw consent

Where we rely on your consent to process your personal information, you can withdraw that consent at any time.

Withdrawing consent does not affect processing carried out before consent was withdrawn.

Your rights will depend on the circumstances and the lawful basis on which we are processing your information.

9. How to exercise your rights

If you would like to exercise any of your data protection rights, please contact us using the contact details on our website.

Please provide enough information for us to identify you and understand your request.

We may need to ask for additional information to verify your identity before completing certain requests.

We will normally respond to a valid request within one month, although this may be extended where permitted by law for particularly complex requests.

10. Keeping your information secure

We take reasonable technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure; and
• destruction.

Access to personal information is limited to people and organisations that need it for legitimate business purposes.

However, no method of transmitting or storing information online can be guaranteed to be completely secure.

11. Cookies

Our website may use cookies and similar technologies.

Cookies may be used to make our website work correctly, remember preferences, understand how visitors use our website and, where applicable, support marketing or analytics.

Where consent is required before placing or reading a cookie, we will ask for your consent.

You can manage cookies through your browser settings and, where available, our website's cookie settings.

12. Children's information

Our website and services are not specifically directed at children.

We do not knowingly collect personal information from children for marketing purposes.

If you believe that a child has provided us with personal information without appropriate consent, please contact us so that we can investigate and take appropriate action.

13. Automated decision-making and profiling

We do not currently use your personal information to make solely automated decisions that produce legal or similarly significant effects on you.

If this changes, we will update this Privacy Policy and provide any information required by applicable data protection law.

14. Data breaches

If we become aware of a personal data breach, we will assess the breach and take appropriate steps to contain, investigate and remedy it.

Where required by law, we will notify the Information Commissioner's Office (ICO) and affected individuals.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, website, services or data protection requirements.

The latest version will always be published on our website with the date it was last updated.

16. Complaints

If you have concerns about how we have handled your personal information, we would encourage you to contact us first so that we can try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO).

The ICO's website is:

Information Commissioner's Office (ICO)

17. Contact us

If you have any questions about this Privacy Policy, your personal information or how we process your data, please contact:

Sam Joseph Chocolates

Website: https://samjosephchocolates.co.uk/

Email: info@samjosephchocolates.co.uk

Postal address: Sam Joseph Chocolates, Nowfood centre, Parkgate Road, Chester, CH14AQ