Privacy Policy

PRIVACY POLICY Chill Connect - chillconnect.co.uk Effective date: 29 April 2026

1. Introduction

This Privacy Policy explains how Chill Brands Group PLC ("we", "us", "our") collects, uses, stores, and shares personal data when you use our wholesale ordering website at chillconnect.co.uk (the "Website").

We are committed to protecting your personal data and handling it responsibly in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

Please read this policy carefully before using the Website or creating a trade account with us. By registering or placing an order, you confirm that you have read and understood this policy.

2. Who We Are (Data Controller)

The data controller responsible for your personal data is:

Chill Brands Group PLC Company number: 09309241 Registered in England and Wales

You can contact us about data protection matters at: Email: contact@chillbrandsgroup.com 

If you have any concerns about how we handle your data, you can contact us at the address above. You also have the right to complain to the Information Commissioner's Office (ICO) - see Section 10 for details.

3. Personal Data We Collect

We collect the following categories of personal data through the Website:

3.1 Account and Registration Data

  • Name and job title
  • Business name and trading address
  • Business email address and telephone number
  • VAT registration number (where applicable)
  • Username and password (stored in encrypted form)

3.2 Order and Transaction Data

  • Order history and product selections
  • Delivery addresses
  • Invoice and payment records
  • Credit account information and payment terms agreed

3.3 Payment Data Payment card details are processed directly by our payment processor, Worldpay (a Fiserv company). We do not store full card numbers or authentication data on our systems. Our payment processor operates under its own privacy policy and is independently PCI DSS compliant.

3.4 Communications Data

  • Emails, messages, or enquiries you send to us
  • Records of any complaints or disputes
  • Notes from sales representative visits or calls

3.5 Technical and Usage Data

  • IP address and browser type
  • Pages visited and time spent on the Website
  • Referring website or search terms
  • Device type and operating system

This data is collected automatically via cookies and analytics tools. See Section 9 for our Cookie Policy.

4. How We Collect Your Data

We collect personal data in the following ways:

  • Directly from you when you register a trade account, place an order, or contact us
  • From your employer or a colleague acting on behalf of your business
  • Automatically through your use of the Website (technical and usage data)
  • From our field sales representatives who may record contact details and visit notes
  • From third-party verification services where we carry out credit or business checks

5. Why We Use Your Data (Legal Basis)

We only process personal data where we have a lawful basis to do so.

Creating and managing your trade account Legal basis: Performance of a contract (or steps to enter one)

Processing and fulfilling your orders Legal basis: Performance of a contract

Processing payments and managing credit accounts Legal basis: Performance of a contract; compliance with legal obligations

Sending order confirmations, invoices, and service communications Legal basis: Performance of a contract

Responding to enquiries and resolving complaints Legal basis: Legitimate interests (to maintain business relationships and resolve disputes)

Sending marketing communications about our products and promotions Legal basis: Legitimate interests (B2B marketing to existing customers and business contacts) or, where required, consent

Improving our Website and services Legal basis: Legitimate interests (to develop and improve our business)

Fraud prevention and security Legal basis: Legitimate interests; compliance with legal obligations

Complying with legal and regulatory obligations (e.g. tax records) Legal basis: Compliance with legal obligations

Age verification and trade status checks (nicotine product compliance) We are required by law to ensure that our wholesale customers are legitimate trade buyers and that products are not supplied to consumers or to persons under 18. We may carry out checks for this purpose as part of our account onboarding process. The legal basis for this processing is compliance with legal obligations and legitimate interests.

6. Who We Share Your Data With

We do not sell your personal data. We may share it with the following categories of third parties where necessary:

6.1 Service Providers

  • Payment processors (Worldpay) - to process transactions
  • IT and hosting providers - to operate the Website and store data securely
  • Email and communication platforms - to send order confirmations and correspondence
  • CRM and sales tools (including Zoho) - to manage customer relationships
  • Analytics providers (Google Analytics) - to understand how the Website is used (see Section 9)

6.2 Business Operations

  • Our field sales representatives, employees, and contractors who need access to fulfil your order or manage your account
  • Our finance and accounting advisers where required for billing or audit purposes

6.3 Legal and Regulatory

  • Law enforcement, regulators, or courts where we are required or permitted by law to disclose information
  • HMRC or other tax authorities as required for compliance

6.4 Business Transfers If we sell or transfer all or part of our business, your personal data may be transferred to the buyer as part of that transaction. We will notify you in advance where required.

All third parties who process data on our behalf are required to handle it securely and in accordance with UK GDPR.

7. International Data Transfers

Some of our service providers may process data outside the UK. Where personal data is transferred outside the UK, we ensure that adequate safeguards are in place - such as the UK Government's International Data Transfer Agreement (IDTA) or transfers to countries with an adequacy decision - to protect your data to the same standard as it receives in the UK.

If you would like further information about the safeguards we use for any specific transfer, please contact us.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with our legal obligations.

  • Trade account and order records: 7 years from the end of the relevant financial year (HMRC requirement)
  • Communications and correspondence: up to 6 years (in line with standard limitation periods for contract claims)
  • Marketing preferences: until you opt out or withdraw consent
  • Website analytics data: up to 26 months (standard retention for Google Analytics)
  • Failed or incomplete account applications: 6 months

Once personal data is no longer required, it is securely deleted or anonymised.

9. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies to operate correctly and to improve your experience. A cookie is a small text file placed on your device when you visit a website.

We use the following types of cookies:

Strictly necessary cookies These are essential for the Website to function - for example, to keep you logged in to your trade account and to process orders. These cannot be disabled.

Analytics cookies We use Google Analytics to understand how visitors use the Website. Google Analytics collects data including pages visited, time spent on the site, and general location (country/region level). The data is aggregated and does not identify you personally. Google may transfer this data to servers in the United States; this transfer is covered by Google's standard contractual clauses. You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout. You can also opt out of analytics cookies via our cookie consent banner.

Functional cookies These remember your preferences (such as saved delivery addresses) to improve your experience.

You can manage or withdraw your cookie consent at any time using the cookie settings link in the footer of the Website. Please note that disabling certain cookies may affect the functionality of the Website.

For more information about cookies generally, visit www.allaboutcookies.org.

10. Your Rights Under UK GDPR

As a data subject, you have the following rights in relation to your personal data:

  • Right of access - to request a copy of the personal data we hold about you
  • Right to rectification - to ask us to correct inaccurate or incomplete data
  • Right to erasure - to ask us to delete your data in certain circumstances
  • Right to restrict processing - to ask us to limit how we use your data in certain circumstances
  • Right to data portability - to receive your data in a structured, machine-readable format in certain circumstances
  • Right to object - to object to processing based on legitimate interests or for direct marketing purposes
  • Rights related to automated decision-making - we do not use solely automated decision-making that produces significant effects

To exercise any of these rights, please contact us at contact@chillbrandsgroup.com. We will respond within one month. We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office Website: www.ico.org.uk Helpline: 0303 123 1113 Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. Marketing Communications

We may send you information about our products, promotions, and offers by email or other means. We rely on legitimate interests to market to existing trade customers and business contacts in a B2B context. You can opt out of marketing communications at any time by:

Opting out of marketing will not affect transactional communications related to your account or orders.

12. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, or destruction. These include:

  • Encryption of data in transit (SSL/TLS)
  • Access controls restricting data to authorised personnel only
  • Regular security assessments of our systems and third-party providers
  • Staff training on data protection obligations

In the event of a personal data breach that is likely to affect your rights and freedoms, we will notify you and the ICO as required by law.

13. Third-Party Links

The Website may contain links to third-party websites (for example, supplier or partner websites). We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal data to them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of the policy and, where changes are material, notify you by email or via a notice on the Website. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Email: contact@chillbrandsgroup.com

If you prefer to write to us about a specific rights request, please mark your correspondence "Data Protection Request" and include your name, company name, and contact details so we can respond efficiently.

This policy was last reviewed on 29 April 2026.