Free delivery on orders over £30! Cluck yeah!

Legal

Privacy Policy

How we collect, use, and protect your personal information.

Cluck-O-Late
chickenchocolate.co.uk
Last updated: 7 May 2026


1. About this Privacy Policy

This Privacy Policy explains how we collect, use, share and protect your personal information when you visit chickenchocolate.co.uk ("our site"), buy Cluck-O-Late products from us, sign up to our marketing, contact our customer service team, or otherwise interact with us.

It applies in addition to our Terms & Conditions. If anything in this Privacy Policy conflicts with our Terms & Conditions on the subject of personal information, this Privacy Policy applies.

By using our site or placing an order, you confirm you have read this Privacy Policy.


2. Who we are

The "data controller" of your personal information is the company that decides how and why your data is used. For this site, that is us:

  • Registered company name: VAPE SUPPLIER™ Ltd
  • Company number: 10873335
  • Registered office: 33 Bennetts Hill, Birmingham, West Midlands, England, B2 5SN
  • VAT number: GB 272938666
  • Privacy contact email: help@chickenchocolate.co.uk

We are registered with the UK Information Commissioner's Office (ICO) as a data controller. References to "we", "us" and "our" mean VAPE SUPPLIER™ Ltd.


3. The personal information we collect

"Personal information" means any information that identifies you or could reasonably be linked to you. Depending on how you use our site, we may collect or process the following:

  • Contact details: name, billing address, shipping address, email address and phone number.
  • Order and payment information: the items you view, add to basket or buy, your order history, transaction details, payment confirmation, and partial card details (the full card number is handled by our payment provider, not by us).
  • Account information: if you create an account, your username, password (stored encrypted), saved addresses, preferences and any wishlist items.
  • Customer service information: the content of any emails, chats or messages you send us, including any details you choose to share about an order or a complaint.
  • Marketing information: your subscription status, opt-in date, what you've opened or clicked in our marketing emails.
  • Device and usage information: IP address, browser type, device type, operating system, referring website, the pages you view on our site, what you click, and how long you stay. This information is largely collected through cookies and similar technologies (see section 8).
  • Inferred information: insights about your likely product preferences based on browsing and purchase history.

We do not knowingly collect any "special category" personal data (such as health, ethnicity, or religious beliefs) and we ask that you do not send us this information.


4. Where we collect your personal information from

  • Directly from you when you order, register, subscribe, contact us or otherwise interact with the site.
  • Automatically from your device when you visit our site, through cookies and similar tracking technologies (see section 8).
  • From our service providers who help us run the site, take payments, deliver orders and operate our marketing (e.g. Shopify, payment providers, couriers, email platforms).
  • From advertising and analytics partners where you have given consent for them to share information about your interactions with us (e.g. Meta, Google, TikTok).

5. How we use your personal information and our lawful bases

Under UK GDPR we must have a "lawful basis" for every use of your personal information. The table below sets out, for each main purpose, what we do and which lawful basis we rely on.

  • To process your orders, take payment, fulfil delivery and handle returns. Lawful basis: performance of a contract with you.
  • To create and manage your account, save your preferences, and let you log in. Lawful basis: performance of a contract.
  • To handle customer service queries, complaints, refunds and food safety reports. Lawful basis: performance of a contract, and legitimate interests (running our business effectively and safely).
  • To send marketing emails about Cluck-O-Late and related products to existing customers. Lawful basis: legitimate interests, under the "soft opt-in" rule in PECR (the Privacy and Electronic Communications Regulations 2003). You can opt out at any time using the unsubscribe link in any marketing email.
  • To send marketing emails to people who are not yet customers. Lawful basis: your consent, given when you sign up. You can withdraw consent at any time.
  • To show you relevant advertising on third-party sites and social media (e.g. Meta, Google, TikTok). Lawful basis: your consent, given through our cookie banner.
  • To detect, prevent and investigate fraud, abuse, security incidents and unlawful activity. Lawful basis: legitimate interests, and legal obligation.
  • To keep records required by tax, accounting and consumer protection law. Lawful basis: legal obligation.
  • To analyse, improve and develop our products, our site and our service. Lawful basis: legitimate interests.
  • To exercise or defend legal claims. Lawful basis: legitimate interests, and where applicable legal obligation.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You can ask us about that assessment using the contact details in section 18.


6. Who we share your personal information with

We share your personal information only where necessary, and only with parties who are required to keep it secure and use it only for the purposes we set. We share it with:

  • Shopify Inc., who hosts our store and provides the underlying e-commerce platform. See section 7 for more on this relationship.
  • Payment providers (such as Shopify Payments, PayPal, Klarna and other gateways shown at checkout) to take payment securely. We do not store your full card details ourselves.
  • Couriers and fulfilment partners to deliver your order to the address you provide.
  • Email and SMS platforms we use to send order confirmations, shipping updates and marketing.
  • Customer service tools we use to handle your enquiries.
  • Analytics and advertising providers (such as Google, Meta and TikTok) where you have consented to advertising and analytics cookies.
  • Professional advisers such as our accountants, lawyers and insurers, where strictly necessary.
  • Government, regulators and law enforcement where we are legally required to do so, including HMRC, the ICO, Trading Standards and the police.
  • A buyer or successor in the event we sell or restructure the business, in line with applicable law.

We do not sell your personal information for money.


7. Our use of Shopify

Our site is built on the Shopify platform. Shopify hosts our store and processes data on our behalf as a "data processor", which means it follows our instructions on how to handle your information.

However, Shopify also uses some data in its own right as a "data controller" — for example, to operate, secure and improve the platform across all merchants who use it, and to power some of its enhanced features (such as fraud screening and Shop Pay). For those uses, Shopify is responsible for explaining its own processing and for handling your rights requests directly.

You can read Shopify's Consumer Privacy Policy at shopify.com/legal/consumer-privacy-policy, and exercise rights against Shopify directly through the Shopify Privacy Portal at privacy.shopify.com/en.


8. Cookies and similar technologies

Our site uses cookies and similar technologies (such as pixels and local storage) to make the site work, remember your basket, understand how the site is used, and (where you've consented) show you relevant advertising.

When you first visit our site you will see a cookie banner. You can accept or reject non-essential cookies, and change your preferences at any time using the cookie settings link in our footer.

For full details of the cookies we use, including names, purposes and how long they last, see our Cookie Policy.


9. Marketing communications

If you are an existing customer, we may send you marketing emails about similar products and offers under the PECR "soft opt-in" rule. You can opt out at any time using the unsubscribe link in every marketing email.

If you are not yet a customer, we will only send you marketing where you have given consent (for example, by ticking a sign-up box). You can withdraw consent at any time.

Even if you opt out of marketing, we will still send you essential service messages such as order confirmations, dispatch notifications, refund confirmations and account or food safety notices.


10. International transfers

Some of our service providers, including Shopify, are based outside the United Kingdom. Where we transfer your personal information outside the UK, we make sure it is protected to the standard required by UK data protection law, including by using:

  • UK adequacy regulations, where the destination country has been recognised by the UK government as offering an adequate level of protection;
  • the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms approved by the ICO; and
  • additional safeguards where appropriate, such as encryption in transit and at rest.

You can ask us for a copy of the safeguards in place by contacting us using the details in section 18.


11. How long we keep your personal information

We keep your personal information only for as long as we need it for the purposes set out in this policy, or for as long as the law requires. Typical retention periods are:

  • Order, transaction and tax records: at least 6 years from the end of the relevant tax year, to comply with HMRC and Companies Act requirements.
  • Customer accounts: for as long as your account is active. If you ask us to close your account, we will delete or anonymise your account data within a reasonable period, except where we are required to retain certain information by law.
  • Customer service records: typically up to 2 years after your last contact, longer where there is an open dispute or legal claim.
  • Marketing data: until you unsubscribe or withdraw consent, then we keep a minimal suppression record so we don't accidentally email you again.
  • Cookie and analytics data: as set out in our Cookie Policy.
  • CCTV, fraud and security logs: typically up to 1 year, longer where there is an active investigation.

When we no longer need your personal information, we securely delete or anonymise it.


12. How we keep your personal information secure

We use technical and organisational measures to protect your personal information, including encrypted connections (HTTPS), encrypted storage of sensitive data, restricted access to staff and providers who need it, and use of reputable, security-tested partners such as Shopify and our payment providers.

No system is perfect. If something goes wrong, we will investigate, take action to limit any harm, and notify the ICO and affected individuals where required by law.

You can help by choosing a strong, unique password for your account, not sharing your login details with anyone else, and using secure channels when sending us sensitive information.


13. Your rights under UK data protection law

Under the UK GDPR and Data Protection Act 2018, you have the following rights in relation to your personal information. Some of these rights only apply in certain circumstances.

  • Right of access: ask for a copy of the personal information we hold about you.
  • Right to rectification: ask us to correct information that is inaccurate or incomplete.
  • Right to erasure ("right to be forgotten"): ask us to delete your personal information, where we no longer have a lawful reason to keep it.
  • Right to restrict processing: ask us to limit how we use your information in certain situations, for example while you contest its accuracy.
  • Right to object: object to our processing where we rely on legitimate interests, including for direct marketing (where you can object at any time, for any reason).
  • Right to data portability: ask us to provide certain information in a portable format, or transfer it to another provider where technically feasible.
  • Right to withdraw consent: where we rely on your consent, withdraw it at any time. This will not affect anything we did before you withdrew it.
  • Right not to be subject to solely automated decisions that have a legal or similarly significant effect on you. We do not currently make any such decisions.

To exercise any of these rights, email us at help@chickenchocolate.co.uk. We will respond within one month, and may extend that by a further two months for complex requests (we will tell you if we need to do that). We may need to verify your identity before we act, and we may charge a reasonable fee or refuse a request that is clearly unfounded or excessive, as the law allows.


14. Children

Our site is not intended for use by children under 16. We do not knowingly collect personal information from children. If you are a parent or guardian and you believe your child has provided us with personal information, contact us at help@chickenchocolate.co.uk and we will delete it.


15. Third-party websites and links

Our site may link to other websites and platforms that we do not control, including social media platforms, news articles and partner sites. This Privacy Policy does not cover those sites. We recommend you read their privacy policies before sharing personal information with them.

If you use a social media plugin or login on our site (for example, signing in with a third-party account, or sharing a product to a social platform), the relevant social platform may collect information about that interaction in line with its own privacy policy.


16. Complaints and how to contact the ICO

If you are unhappy with how we have handled your personal information, please contact us first at help@chickenchocolate.co.uk so we have a chance to put it right.

You also have the right to lodge a complaint with the UK Information Commissioner's Office, the regulator for data protection in the UK:

  • Information Commissioner's Office
  • Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  • Helpline: 0303 123 1113
  • Website: ico.org.uk

If you live in the European Economic Area, you can also contact your local data protection authority. A list is available at edpb.europa.eu.


17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our practices, the services we use, or the law. When we do, we will post the updated version on this page and change the "Last updated" date at the top. If the changes are significant, we will give you reasonable notice by email or by a prominent notice on the site.


18. Contact us

For any privacy-related question, request or complaint, contact us at:

VAPE SUPPLIER™ Ltd
33 Bennetts Hill, Birmingham, West Midlands, England, B2 5SN
Email: help@chickenchocolate.co.uk


VAPE SUPPLIER™ Ltd
33 Bennetts Hill, Birmingham, West Midlands, England, B2 5SN
Registered in England, Company Number: 10873335
VAT Number: GB 272938666
Customer service: help@chickenchocolate.co.uk

This Privacy Policy was last updated on 7 May 2026. It should be read alongside our Terms & Conditions and our Cookie Policy.