Last updated: August 2026
1. About This Privacy Policy
1.1 Cocoa Black Limited (“Cocoa Black”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.
1.2 This Privacy Policy explains how we collect, use, store and share personal information when you:
(a) visit or use our website at cocoablack.com (the “Site”);
(b) purchase products from us;
(c) place an order for collection or delivery;
(d) book or attend a class at The Chocolate & Pastry School;
(e) purchase or use a Gift Voucher;
(f) create or use an online account;
(g) contact or otherwise communicate with us;
(h) subscribe to marketing communications;
(i) participate in promotions, competitions or surveys; or
(j) otherwise interact with Cocoa Black.
1.3 This Privacy Policy should be read alongside our Terms & Conditions and our Cookie Policy.
2. Who We Are
2.1 Cocoa Black Limited is the controller of the personal information described in this Privacy Policy.
2.2 Cocoa Black Limited is a company registered in Scotland under company number SC310529.
2.3 Our registered office is:
Cocoa Black Limited
Unit 7 Southpark Industrial Estate
Peebles
EH45 9ED
Scotland
2.4 Our principal customer-facing premises, including the Cocoa Black shop and The Chocolate & Pastry School, are at 1–3 Cuddybridge, Peebles, Scotland.
2.5 References in this Privacy Policy to data-protection law include the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other applicable UK data-protection and privacy legislation.
3. Personal Information We Collect
3.1 The personal information we collect depends upon how you interact with us.
3.2 We may collect the following categories of personal information.
Identity and Contact Information
3.3 This may include your:
(a) name;
(b) postal and delivery address;
(c) email address;
(d) telephone number; and
(e) account or username information.
Order and Transaction Information
3.4 This may include:
(a) products purchased or ordered;
(b) class bookings;
(c) Gift Voucher purchases and redemptions;
(d) delivery and collection information;
(e) order history;
(f) amounts paid, refunds and transaction information; and
(g) communications relating to an order, purchase or booking.
Payment Information
3.5 Payments may be processed by third-party payment providers. We may receive information confirming the status and details of a transaction, but we do not necessarily receive or retain your complete payment-card details.
Account Information
3.6 If you create an account, we may process information associated with that account, including login credentials in encrypted or otherwise protected form, saved details, preferences and order history.
Communications
3.7 We may retain information you provide when you contact us, including enquiries, complaints, feedback, correspondence and records of customer-service communications.
Marketing Information
3.8 We may process information about:
(a) whether you have asked to receive marketing from us;
(b) your marketing preferences;
(c) whether you have opened or interacted with marketing communications, where our systems provide this functionality; and
(d) when and how you gave, withheld or withdrew consent or opted out.
Technical and Website Information
3.9 When you use the Site, we may collect information such as:
(a) IP address;
(b) browser and device type;
(c) operating system;
(d) pages visited;
(e) referring website;
(f) approximate location derived from an IP address; and
(g) information collected through cookies and similar technologies.
3.10 Further information about cookies and similar technologies is provided in our Cookie Policy.
4. Allergies and Dietary Information
4.1 If you tell us about an allergy, intolerance, dietary requirement or relevant health-related requirement in connection with an order or class, that information may constitute special category personal data under data-protection law.
4.2 We will only process such information where we have a lawful basis and an applicable condition permitting us to do so.
4.3 Where appropriate, we may ask for your explicit consent to process relevant allergy, dietary or health information so that we can consider your requirements and help manage food-safety risks.
4.4 Please do not provide health information that we do not reasonably need.
5. How We Obtain Your Information
5.1 We obtain personal information primarily:
(a) directly from you when you order, book, register, contact us or otherwise interact with Cocoa Black;
(b) automatically when you use the Site, including through cookies and similar technologies;
(c) from payment providers and other suppliers involved in fulfilling your transaction;
(d) from another person who purchases a Gift Voucher, makes a booking or places an order for you; and
(e) from other sources where permitted by law.
5.2 Where another person provides your information to us, we will use it only for appropriate purposes and in accordance with applicable law.
6. How and Why We Use Personal Information
6.1 Data-protection law requires us to have a lawful basis for processing personal information.
6.2 Depending upon the circumstances, we may rely upon:
(a) contract — where processing is necessary to enter into or perform a contract with you;
(b) legal obligation — where processing is necessary for us to comply with the law;
(c) legitimate interests — where processing is necessary for our legitimate business interests or those of another person and those interests are not overridden by your rights and interests;
(d) consent — where you have given us valid consent; or
(e) another lawful basis available under applicable law.
6.3 We may process your information for the following purposes:
| Purpose | Typical lawful basis |
|---|---|
| Processing and fulfilling orders | Contract |
| Processing payments and refunds | Contract; legal obligation |
| Arranging delivery or collection | Contract |
| Managing customer accounts | Contract; legitimate interests |
| Managing Chocolate & Pastry School bookings | Contract |
| Managing Gift Vouchers | Contract; legitimate interests |
| Responding to enquiries and complaints | Contract; legitimate interests |
| Maintaining business, accounting and tax records | Legal obligation; legitimate interests |
| Preventing and investigating fraud, theft and misuse | Legitimate interests; legal obligation where applicable |
| Protecting our Site, systems, customers and business | Legitimate interests |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation where applicable |
| Improving our products, services and customer experience | Legitimate interests |
| Website analytics | Consent where required; legitimate interests where legally permitted |
| Sending direct marketing | Consent or another basis permitted by applicable marketing and privacy law |
| Managing marketing preferences and suppression records | Legal obligation; legitimate interests |
6.4 Where we rely upon legitimate interests, those interests may include operating and improving Cocoa Black, protecting our customers and business, preventing fraud and misuse, maintaining appropriate business records and dealing effectively with customers.
6.5 We will not use personal information for a purpose incompatible with the purpose for which it was originally collected unless permitted by law.
7. Orders, Deliveries and Classes
7.1 When you purchase a product or book a class, we use the information reasonably necessary to process the transaction and provide what you have purchased.
7.2 This may involve sharing relevant information with organisations that assist us in fulfilling the transaction, such as payment providers, ecommerce providers and delivery companies.
7.3 Where you book a class for another person, we may process information about that participant where reasonably necessary to administer the booking.
7.4 If a participant provides information about allergies or dietary requirements, we will handle that information in accordance with clause 4.
8. Direct Marketing
8.1 We may send you information about Cocoa Black products, classes, events, offers and other news where permitted by law.
8.2 Where consent is required, we will only send such marketing where you have made an appropriate positive choice to receive it.
8.3 In circumstances permitted by the Privacy and Electronic Communications Regulations 2003 (“PECR”), we may market our own similar products or services to existing customers without obtaining separate consent, provided the applicable requirements are satisfied.
8.4 You may unsubscribe from marketing at any time by using the unsubscribe facility contained in the relevant communication or by contacting us.
8.5 Withdrawing consent or opting out of marketing does not affect transactional or service communications that we need to send in connection with an order, booking, account or other relationship with you.
8.6 If you opt out, we may retain limited information on a suppression list so that we can respect your preference and avoid marketing to you again inadvertently.
9. Photography and Filming
9.1 Cocoa Black may occasionally take photographs or recordings at our premises, classes or events.
9.2 Where an identifiable photograph or recording constitutes personal information, we will process it in accordance with applicable data-protection law.
9.3 Where we rely upon your consent for a particular promotional or marketing use, you may withdraw that consent at any time.
9.4 Where another lawful basis applies, we will process the information in accordance with that basis.
9.5 Photography and filming for promotional purposes are separate from CCTV or other security recording, where applicable.
10. CCTV
10.1 CCTV may be operated at Cocoa Black premises for purposes including security, protecting customers, staff and property, preventing and investigating crime and dealing with incidents.
10.2 Where CCTV is used, appropriate signage will be displayed.
10.3 CCTV information will only be retained for as long as reasonably necessary for the purposes for which it was collected, unless it needs to be retained for longer in connection with an incident, investigation, legal claim or legal requirement.
10.4 CCTV information may be disclosed to law-enforcement agencies, insurers, professional advisers or other appropriate recipients where necessary and lawful.
11. Cookies and Similar Technologies
11.1 Our Site uses cookies and may use similar technologies.
11.2 Some technologies are necessary for the Site to operate. Others, such as analytics, advertising or personalisation technologies, will only be used where permitted by law.
11.3 Where consent is required, optional technologies will not be used unless and until the required consent has been obtained.
11.4 You can change your choices using the cookie controls made available on the Site.
11.5 Further information about the cookies and similar technologies we use, their purposes and their duration is contained in our Cookie Policy.
12. Who We Share Personal Information With
12.1 We do not sell your personal information.
12.2 Where necessary and lawful, we may share personal information with organisations including:
(a) website and ecommerce providers;
(b) payment processors;
(c) delivery and logistics providers;
(d) email and marketing-service providers;
(e) IT, hosting and security providers;
(f) analytics and technology providers;
(g) accountants, auditors, insurers, solicitors and other professional advisers;
(h) governmental, regulatory, tax and law-enforcement authorities;
(i) suppliers assisting us with an order, booking or service; and
(j) a purchaser, investor or adviser in connection with a proposed sale, restructuring or transfer of all or part of our business.
12.3 We only provide third parties with personal information reasonably necessary for the relevant purpose and require appropriate protection where applicable.
13. International Transfers
13.1 Some organisations that provide services to us may process personal information outside the United Kingdom.
13.2 Where this constitutes a restricted international transfer, we will ensure that the transfer is made in accordance with applicable data-protection law.
13.3 Depending upon the circumstances, this may include relying upon UK adequacy regulations or implementing appropriate safeguards recognised under the UK GDPR.
13.4 Where required, we will carry out any applicable assessment relating to the protection afforded to information transferred internationally.
13.5 You may contact us for further information about safeguards applying to relevant international transfers.
14. How Long We Keep Personal Information
14.1 We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, tax, regulatory and reporting requirements and establishing, exercising or defending legal claims.
14.2 Retention periods vary according to the type of information and the reason we hold it.
14.3 In deciding how long to retain information, we consider:
(a) the nature, amount and sensitivity of the information;
(b) why we collected it;
(c) whether we continue to need it;
(d) applicable legal and regulatory requirements;
(e) relevant limitation periods;
(f) fraud and security considerations; and
(g) whether the information can instead be securely deleted or anonymised.
14.4 Where information is no longer required, we will delete or anonymise it in accordance with our applicable procedures, subject to any lawful reason for retaining it.
15. Security
15.1 We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access, destruction or damage.
15.2 Access to personal information is restricted to people and organisations who have an appropriate reason to access it.
15.3 Where third-party processors handle personal information on our behalf, we require appropriate contractual and security arrangements as required by law.
15.4 No method of electronic transmission or storage can be guaranteed to be completely secure. However, we take reasonable and appropriate steps to protect the information entrusted to us.
15.5 You are responsible for keeping passwords and other account credentials confidential and should notify us if you believe your account has been compromised.
16. Your Data-Protection Rights
16.1 Depending upon the circumstances and the lawful basis on which we process your information, you may have rights including the right to:
(a) access personal information we hold about you;
(b) rectify inaccurate or incomplete information;
(c) request erasure of your personal information;
(d) request restriction of processing;
(e) object to certain processing;
(f) receive certain information in a portable format (data portability);
(g) withdraw consent where processing is based upon consent; and
(h) rights relating to certain automated decision-making, where applicable.
16.2 These rights are not absolute and may be subject to conditions or exemptions under applicable law.
Your Right to Object
16.3 YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE USE OF YOUR PERSONAL INFORMATION FOR DIRECT MARKETING.
16.4 You may also have a right to object where we rely upon legitimate interests, depending upon the circumstances.
17. Exercising Your Rights
17.1 If you wish to exercise a data-protection right, please contact Cocoa Black using the contact details provided on our Site or write to us at the address in clause 22.
17.2 We may need to ask for information reasonably necessary to confirm your identity before fulfilling a request.
17.3 We will normally respond to a valid request without undue delay and within one month, subject to any extension permitted by law.
17.4 You will not normally have to pay a fee to exercise your rights. A reasonable fee may be charged, or a request may be refused, only where permitted by law.
17.5 We will explain any applicable restriction, refusal or extension where the law requires us to do so.
18. Complaints
18.1 If you have concerns about how Cocoa Black handles your personal information, please contact us first so that we have an opportunity to investigate and respond.
18.2 You also have the right to complain to the Information Commissioner’s Office (“ICO”), the UK’s data-protection regulator.
18.3 Information about making a complaint and the ICO’s current contact details are available from the Information Commissioner’s Office.
18.4 Your right to complain to the ICO is not affected by contacting Cocoa Black first.
19. Children
19.1 Our products may be purchased for children and children may participate in certain Cocoa Black activities, but our general ecommerce Site is not intended to collect personal information directly from children unnecessarily.
19.2 Where information about a child is reasonably required for a booking or activity, we will seek to collect only information appropriate for that purpose and handle it with particular care.
19.3 Where consent of a parent or guardian is required by law or is otherwise appropriate, we will seek that consent.
20. Third-Party Websites
20.1 The Site may contain links to websites, platforms or services operated by third parties.
20.2 Cocoa Black does not control how independent third parties process personal information.
20.3 We recommend that you read the relevant third party’s privacy information before providing personal information to them.
21. Changes to This Privacy Policy
21.1 We keep this Privacy Policy under review and may update it from time to time to reflect changes to our business, Site, services, technology or legal obligations.
21.2 The latest version will be published on the Site and the date at the beginning of the policy will show when it was last updated.
21.3 Where a change is particularly significant, we may provide additional notice where appropriate.
22. Contacting Cocoa Black About Privacy
22.1 Questions about this Privacy Policy, requests concerning your personal information and data-protection complaints should be directed to Cocoa Black using the contact details published on our Site or in writing to:
Data Protection
Cocoa Black Limited
Unit 7 Southpark Industrial Estate
Peebles
EH45 9ED
Scotland