Privacy Policy
Chocobania (“we”, “us”, “our”) is a sole trader business based in Dublin, Ireland, operated by Ania. We are committed to protecting your personal data and your rights under the General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988–2018. This policy explains what data we collect, why we collect it, and how we use it.
1. Who We Are
Business name: Chocobania
Location: Dublin, Ireland
Contact: ania@chocobania.eu
As a small artisan business, Ania is the sole data controller responsible for your personal information.
2. What Data We Collect
We collect the following personal data when you use our website or place an order:
- Account information: name, email address, password (hashed)
- Order information: delivery address, order contents, order history
- Payment information: handled entirely by Stripe — we never see or store your card details
- Communications: emails you send us, including enquiries or support requests
- Usage data: pages visited, time on site (collected via Google Analytics with your consent)
3. Why We Use Your Data (Legal Basis)
We process your data for the following purposes and legal bases:
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling your order | Performance of a contract (Art. 6(1)(b) GDPR) |
| Sending order confirmation and shipping emails | Performance of a contract |
| Managing your account | Performance of a contract |
| Responding to enquiries | Legitimate interest |
| Analytics (Google Analytics) | Your consent |
| Google Customer Reviews survey (only if you opt in after checkout) | Your consent |
| Fraud prevention and security | Legitimate interest |
| Legal and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
4. Cookies & Analytics
We use Google Analytics 4 to understand how visitors use our site (pages visited, time spent, general location). This data is anonymous and aggregated.
Google Analytics cookies are only set after you give your consent via the cookie banner. You can withdraw consent at any time by clearing your browser's local storage or using a browser extension such as the Google Analytics Opt-out Browser Add-on.
We also use strictly necessary cookies for session management (keeping you logged in, maintaining your cart). These do not require consent as they are essential for the website to function.
5. How Long We Keep Your Data
- Account data: as long as your account is active, plus 12 months after last login
- Order records: 7 years (required by Irish tax law)
- Email correspondence: up to 2 years
- Analytics data: 14 months (Google Analytics default)
6. Who We Share Your Data With
We share your data only with trusted service providers required to fulfil your order:
- Stripe, Inc. — payment processing (PCI-DSS compliant)
- Google LLC — analytics (with your consent)
- Shipping carriers — your name and delivery address, to fulfil your order
If you opt in to Google Customer Reviews after checkout, we share your order number, email address, delivery country and estimated delivery date with Google LLC so it can send you the review survey.
We do not sell, rent or trade your personal data to any third party for marketing purposes.
7. Your Rights Under GDPR
You have the following rights regarding your personal data:
- Access: request a copy of the data we hold about you
- Rectification: ask us to correct inaccurate data
- Erasure: request deletion of your data (subject to legal retention obligations)
- Restriction: ask us to pause processing of your data
- Portability: receive your data in a machine-readable format
- Objection: object to processing based on legitimate interest
- Withdraw consent: for analytics at any time via the cookie banner
To exercise any of these rights, email us at ania@chocobania.eu. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission of Ireland.
8. Data Security
We take reasonable technical and organisational measures to protect your data, including encrypted HTTPS connections and bcrypt password hashing. Your payment details are never stored by us — they are handled entirely by Stripe and never touch our servers. No online system is 100% secure, but we work hard to protect your information.
9. Changes to This Policy
We may update this document from time to time. Before any change takes effect, we will notify you by email of our intention to make the change at least 30 days in advance. The updated version will be posted on this page with a revised date.
10. Contact
If you have any questions about this policy or how we handle your data, please contact us at ania@chocobania.eu.