Privacy policy

Who we are and how to contact us

Rye Chocolates Ltd is the data controller for ryechocolates.co.uk and for the personal information you give us when you shop with us, contact us or sign up to our emails. That means we decide how and why your information is used, and we are responsible for looking after it.

• Company: Rye Chocolates Ltd, registered in England and Wales, company number 14353850
• Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ
• Shop and correspondence address: 110a High Street, Rye, East Sussex TN31 7JE
• Registered with the Information Commissioner's Office (ICO), registration number ZB513828
• Email: info@ryechocolates.co.uk
• Telephone: +44 (0)1797 225 295

We are a small business and are not required to appoint a Data Protection Officer. Questions about this policy or about your information can be sent to the email or postal address above, marked for the attention of Tobias Cuthbert, Director.

What this policy covers

This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it and the rights you have over it. It applies when you:

• visit or buy from our website, ryechocolates.co.uk
• create a customer account or sign up to our emails
• contact us by email, telephone, our website contact form, or by message on Facebook or Instagram
• buy from us in one of our shops in Rye or Hastings

We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR). This policy applies from 16 September 2026 and replaces our previous privacy policy.

The personal information we collect

We collect only what we need to take your order, deliver it, look after you as a customer and run our business.

What we collect	What it includes	How we get it
Contact and identity details	Name, email address, telephone number, billing and delivery address	From you, when you order, create an account, sign up to our emails or contact us
Order details	What you bought, gift messages, delivery instructions, order history, and any questions you ask about our products	Created when you order or contact us
Payment details	Payment method, card type, the last four digits of your card and the transaction reference. Full card numbers go directly to the payment provider and never reach us	From Shopify Payments, Shop Pay, Apple Pay, Google Pay or PayPal
Account details	Email address, password (stored in encrypted form), saved addresses and order history	From you, if you choose to create an account
Marketing preferences	Whether you have agreed to receive our emails, and which of our emails you open or click	From you, and from our email platform, Klaviyo
Correspondence	Emails, contact form messages, telephone calls, Facebook and Instagram messages, reviews and feedback	From you
Technical and usage data	IP address, browser and device type, time zone, the pages and products you view, the website or search term that brought you to us, and how you use our site	From cookies and similar technologies (see Cookies below)
Trade and wholesale details	Business name, contact name, job title, address, and order and payment history	From you, when you enquire about stocking our chocolate
In-shop purchases	Card payment details, which are processed by Square, our till provider, and your email address if you ask for an emailed receipt	From Square

Gifts and other people's details. If you send a gift, we collect the recipient's name, address and sometimes telephone number so that we can deliver it. We use these details only to deliver the gift and we keep them with your order record. Please make sure the recipient is happy for you to give us their details.

Information from other sources. We may also receive your details from online marketplaces we sell through, when you buy our chocolate there and we dispatch the order; from Shopify's fraud-screening service; and from Royal Mail about the progress of your delivery.

Sensitive information. We do not need any special category information, such as health details, to serve you. If you tell us about an allergy or intolerance when asking about a product, we use that information only to answer your question and we rely on your explicit consent to do so. Please do not send us more sensitive information than you need to.

How we use your information and why we are allowed to

UK GDPR requires us to have a lawful basis for everything we do with your personal information. These are the purposes we use it for and the lawful basis for each.

What we use your information for	Our lawful basis
Taking, processing and delivering your order; sending order confirmations and delivery updates; dealing with returns, replacements and refunds	Performance of our contract with you
Taking payment and screening orders for fraud	Performance of our contract; our legitimate interest in protecting our business and our customers from fraud
Answering your questions, complaints and requests by email, telephone, contact form or social media	Performance of our contract (for orders); our legitimate interest in giving good customer service
Running your customer account	Performance of our contract
Sending you our email newsletter, product news and offers	Your consent, where you have signed up; or our legitimate interest in telling existing customers about similar products, as PECR allows, where you have bought from us and not opted out. You can opt out at any time
Showing you our advertising on Facebook, Instagram and Google, and measuring whether it works	Your consent, given through the cookie choices you make on our website
Understanding how people use our website so that we can improve it	Your consent for analytics cookies; our legitimate interest in aggregated statistics that do not identify you
Keeping accounting, tax and VAT records	Our legal obligations under the Companies Act 2006 and HMRC rules
Keeping our website and systems secure and preventing misuse	Our legitimate interest in network and information security
Handling legal claims, insurance and regulatory matters, and any sale or restructuring of our business	Our legitimate interests; our legal obligations
Managing wholesale and trade relationships	Performance of our contract; our legitimate interest in running our business

Where we rely on legitimate interests, we have checked that our interests do not override your rights and freedoms. You can ask us about that assessment, or object to the processing, at any time (see Your rights below).

We do not make decisions about you by automated means alone that have legal or similarly significant effects on you. Shopify's fraud analysis may flag an order as high risk, but a member of our team decides whether to accept or cancel it.

We only use your information for the purposes we collected it for. If we ever need to use it for an unrelated purpose, we will tell you first and explain the lawful basis.

Who we share your information with

We never sell your personal information, and we never pass it to anyone else for their own marketing. We share it only with the companies that help us run our shop and website, listed here.

Who	What they do for us	Their privacy policy
Shopify	Hosts our website, checkout, customer accounts and order records; runs Shopify Payments and Shop Pay and screens orders for fraud	Shopify
Shopify Payments, PayPal, Apple Pay and Google Pay	Process your payment. Your card details go straight to them and are never stored by us	PayPal, Apple, Google
Royal Mail	Delivers your order. We give them your name, address and, where you have provided them, your email address or telephone number for delivery updates	Royal Mail
Klaviyo	Sends our email newsletter and offers, and records which emails are opened and clicked	Klaviyo
Google	Google Analytics, which tells us how our website is used, and Google Ads, which shows and measures our advertising	Google
Meta (Facebook and Instagram)	Our Facebook and Instagram pages and messages, and the Meta pixel, which shows and measures our advertising	Meta
Katana and QuickBooks	Our stock and production system, and our accounting software, which receive order details so that we can make, record and account for your order	Katana, Intuit
Square	Processes card payments and emailed receipts in our shops	Square
Label-printing software	Links our website to Royal Mail so that we can book deliveries and print address labels	Acts only on our instructions
Professional advisers	Our accountants, solicitors, insurers and bank, where needed to run the business or deal with a claim	Their own policies apply

We may also share your information where the law requires us to, for example with HM Revenue & Customs, the police, a court or a regulator, or to protect our rights, property or safety or those of our customers. If we sell or restructure our business, customer records may pass to the new owner, who must use them in line with this policy.

Companies that act on our instructions are bound by contracts requiring them to keep your information secure and to use it only to provide their service to us. Some, such as the payment providers, Google and Meta, are also responsible in their own right for the information they hold, and their privacy policies apply to that.

Sending your information outside the UK

Some of the companies we work with store or process information outside the UK. Shopify is a Canadian company with servers in Canada, the United States and Ireland. Klaviyo, Google, Meta, PayPal and Intuit (QuickBooks) are based in, or use servers in, the United States. Katana is based in Estonia, in the European Union.

Whenever your information leaves the UK, we make sure it is protected to the standard UK law requires, in one of these ways:

• the country has been found by the UK government to give adequate protection: this covers the European Union and EEA, Canada and, under the UK-US Data Bridge, United States companies certified to the UK Extension to the EU-US Data Privacy Framework
• the provider has signed the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, both approved by the ICO, which legally commit it to protecting your information

If you ask us to deliver an order outside the UK, we pass the recipient's name and address to Royal Mail, which hands them to the postal service in the destination country. That transfer is necessary to carry out your order.

You can ask us for more detail about the safeguards we rely on by contacting us at info@ryechocolates.co.uk.

How long we keep your information

We keep your information only for as long as we need it for the purpose we collected it, or for as long as the law requires.

Information	How long we keep it	Why
Order records, invoices, refunds and payment references (including gift recipient details)	6 years after the end of the financial year in which you ordered	HMRC and Companies Act record-keeping rules
Customer account	Until you close it, or 3 years after you last log in or order, after which we delete it	We only need it while you use it
Email marketing list	Until you unsubscribe. We then keep your email address on a suppression list so that we do not email you again	To honour your choice
Customer service correspondence	2 years from our last contact with you; complaints and disputes for 6 years	In case the matter comes up again or leads to a claim
Wholesale and trade records	For the length of the relationship and 6 years after the last order	Contract and tax records
Website analytics data	Google Analytics data for up to 14 months; Shopify analytics in aggregated form that does not identify you	To see how our website is used over time
Advertising data held by Google and Meta	For the periods set out in their own privacy policies	Their own policies apply

When we no longer need your information we delete it securely or anonymise it so that it no longer identifies you.

Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. We use them, along with similar technologies such as pixels, to make our website work, to understand how it is used and to show you our advertising. Essential cookies are set automatically because the website cannot work without them. All other cookies are set only if you agree to them when you first visit, and you can change your mind at any time by adjusting your cookie preferences on our website or by deleting cookies in your browser, which will make the choice appear again on your next visit.

Type	Main cookies	What they do	How long they last
Essential	_secure_session_id, cart, cart_sig, cart_ts, checkout_token, secure_customer_sig, localization, _tracking_consent, _cmp_a	Keep you logged in, remember your basket and checkout, remember your country and currency, remember your cookie choices, and protect the site from fraud and abuse	From the end of your visit to 1 year
Analytics	_shopify_y, _shopify_s, _landing_page, _orig_referrer, _ga, _gid	Shopify analytics and Google Analytics: tell us which pages and products are viewed, how visitors arrive and how they move through the site, so that we can improve it	From 30 minutes to 2 years
Advertising	_fbp, _fbc, _gcl_au, __kla_id	The Meta pixel, Google Ads and Klaviyo: measure whether our advertising and emails lead to visits and orders, and let us show our adverts to people who have visited our site	From 3 months to 1 year

You can also block or delete cookies through your browser settings; allaboutcookies.org explains how for each browser. Blocking essential cookies will stop the basket and checkout from working.

To opt out of interest-based advertising directly with the advertising platforms, use Google's ad settings, Meta's ad preferences and Your Online Choices. Google also offers a browser add-on that blocks Google Analytics on every site. Our website does not currently respond to "Do Not Track" browser signals, so please use the cookie choices described above instead.

Marketing and how to opt out

We send email news about new chocolates, seasonal collections and offers to people who have signed up to our emails, and to customers who have bought from us and not opted out. We do not currently send marketing by text message, and we never pass your details to other companies for their marketing.

You can stop our emails at any time by clicking the unsubscribe link at the bottom of any email, or by emailing info@ryechocolates.co.uk. We will act on your request straight away, although you may receive an email that was already on its way. Opting out of marketing does not stop the emails we need to send about an order you have placed, such as confirmations and delivery updates.

If you have agreed to advertising cookies, we may also use the Meta pixel and Google Ads to show our adverts to people who have visited our website or bought from us, and to find people with similar interests. You can switch this off through your cookie preferences on our website and through the advertising platforms' own settings described under Cookies above.

Your rights

UK data protection law gives you the following rights over your personal information. They are free to use.

• Access: ask for a copy of the personal information we hold about you and an explanation of how we use it.
• Correction: ask us to correct information that is wrong or incomplete. You can update most details yourself in your customer account.
• Deletion: ask us to delete your information where we no longer need it, or where you withdraw your consent. We may have to keep some records, such as order records for tax purposes, and we will tell you if so.
• Restriction: ask us to pause our use of your information, for example while we check its accuracy or consider an objection.
• Portability: receive the information you gave us in a commonly used electronic format, or have it sent to another provider, where we hold it electronically on the basis of your consent or a contract.
• Objection: object to our use of your information where we rely on legitimate interests. You can object to direct marketing at any time, and we will always stop.
• Withdrawing consent: withdraw any consent you have given at any time. This does not affect anything done before you withdrew it.
• Automated decisions: not to be subject to a decision made solely by automated means that has a legal or similarly significant effect on you. We do not make decisions of this kind.

To use any of these rights, email info@ryechocolates.co.uk or write to Rye Chocolates Ltd, 110a High Street, Rye, East Sussex TN31 7JE. We will reply within one month. If your request is complex, or you have made several, we may take up to two further months and will tell you within the first month if so. We may ask you to confirm your identity, and if we need you to clarify what you are asking for, the time limit pauses until you reply. We carry out reasonable and proportionate searches for the information you ask for. In the rare case that a request is clearly unfounded or excessive, we may charge a reasonable fee or decline it, and we will explain why.

How to complain

If you are unhappy with how we have handled your personal information, you have the right to complain to us directly. Please email info@ryechocolates.co.uk, telephone +44 (0)1797 225 295 or write to Rye Chocolates Ltd, 110a High Street, Rye, East Sussex TN31 7JE, marked for the attention of the Director. We will acknowledge your complaint within 30 days, look into it, keep you informed, and tell you the outcome without undue delay.

You can also complain to the UK data protection regulator, the Information Commissioner's Office (ICO), which becomes the Information Commission on 30 September 2026. You do not have to complain to us first, although we would welcome the chance to put things right.

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Keeping your information secure

Our website and checkout run on Shopify, which encrypts all traffic between your browser and our site and is certified to the Payment Card Industry Data Security Standard (PCI DSS). Payments are handled by Shopify Payments, PayPal, Apple Pay and Google Pay, so full card numbers are never seen or stored by us. Access to customer information is limited to the members of our team who need it to process orders and answer your queries, and our accounts are protected by strong passwords and two-step verification.

No website or system can be completely secure. If a security breach ever puts your information at risk, we will report it to the regulator within 72 hours where the law requires, and we will tell you promptly if the risk to you is high.

Children, other websites and changes to this policy

Children. Our website is not aimed at children and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us their details, please contact us and we will delete them.

Other websites. Our website and emails contain links to other sites, including our Facebook and Instagram pages and the marketplaces we sell through. Those sites have their own privacy policies, and we are not responsible for how they use your information.

Changes to this policy. We review this policy at least once a year and update it when our practices or the law change. The date at the top shows when it was last updated. If we make a change that significantly affects you, we will let you know by email or by a notice on our website. This version was published on 16 September 2026.