Butlers Chocolates Data Protection Policy 

1. INTRODUCTION
We are Butlers Chocolates UC (The Irish Chocolate Company UC T/A Butlers Chocolates).  We’re a company registered in the Republic of Ireland with company number 205466. In this Privacy Policy, we will refer to ourselves as ‘we’, ‘us’ or ‘our’. We are the Data Controller of the personal information we collect, hold and use about you, as explained in this Policy.

If you have any questions, you can get hold of us in any of the following ways:
1.     by phoning us on 00353 1 6710599
2.    by emailing us at privacy@butlers.ie or
3.    by writing to us at Butlers Chocolates UC, Clonshaugh Business Park, D17A076, Ireland.

Purpose of this Policy: We are committed to protecting and respecting your data protection rights and freedoms as specified under the General Data Protection Regulation (GDPR) and related Irish and EU data protection and privacy legislation. The purpose of this data protection policy is a statement of that commitment.

We take the privacy, including the security, of personal information we hold about you seriously. This policy is designed to inform you about how we collect personal information about you and how we use that personal information. You should read this Policy carefully so that you know and can understand why and how we use the personal information we collect and hold about you. It is important that you keep your personal information up to date. If any of your personal information changes, please contact us as soon as possible to let us know. If you do not do this, then we may be prevented from supplying the goods to you (for example, if you move address and do not tell us, then your goods may be delivered to the wrong address).

Scope of this Policy: This data protection policy should be read in conjunction with any terms and conditions that apply to your interactions with us to fully understand your data protection rights and freedoms. This data protection policy sets out your data protection rights as a data subject, what personal data we collect, how we use your personal data, whom we may disclose it to, and how long we retain and then delete it. Please read the following carefully to understand our practices regarding your personal data and how we will process it.

Important Definitions:
Personal data: information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly. Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means.

Data Protection Principles: As a controller of your personal data under the GDPR, we are responsible for the following data protection principles:

Personal data processed must be lawful, and fair and transparent to the data subject. This means that processing will only be done under an allowable legal basis and we will provide you with certain information when collecting your personal data and when you exercise your data subject rights (see next section). We expect the legal basis for processing your personal data will be one of the following: - Your unambiguous, informed, freely given and specific consent, which you can withdraw at any time; A contract between us, formed for example when you purchase a product from our website or enter employment with us; - A legal obligation we are under based upon Irish or EU law, such as calculating and reporting of tax liabilities; - Our legitimate interests in running our business such as ensuring the quality of our products and services, providing training to our employees, for marketing activities, and keeping our customers, visitors, and employees safe and satisfied. We will attempt to balance our interests against your rights and freedoms before processing under this basis.

Personal data must be collected for a specific, explicit, and legitimate purpose and not be further processed for an incompatible purpose. This purpose limitation principle means we will tell you the specific purpose of the processing of your data and it will comply with all applicable laws. We will also not process your personal data for a reason that is not compatible with the purpose it was collected for.

• Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. This data minimisation principle means we will only collect the personal data we need for processing.
• Personal data must be accurate and kept up to date. This accuracy principle means we will endeavour to keep your personal data current and accurate. You may request we update your personal data if it becomes inaccurate or out of date.
• Personal data must not be kept in an identifiable form any longer than necessary. This storage limitation principle means we will delete or anonymise your personal data when it is no longer needed for processing.
• Personal data must be secured against loss or unauthorised alteration or disclosure. This integrity and confidentiality principle means that we will deploy sufficient technical and organisational safeguards to protect your personal data.

2. WHAT PERSONAL DATA WE COLLECT ABOUT YOU
As already mentioned, the types of personal data we collect about you may differ from person to person, depending on who you are and the relationship between us. Therefore, we may also collect the following:

• Any personal data you post on our website or provide when placing an order
• Data about how you use our website
• Technical data such as your IP address, your login data, details about your browser, length of visit to pages on our website, page views and navigation paths, details about the number of times you use our website, time zone settings and other technology on the devices you use to access our website. Please see our cookie policy for more details about this.
• Your marketing and communication preferences
• Any other information that you directly provide to us whether through our contact form, over the phone, by email or otherwise, such as when entering a competition or completing a survey.   

3. HOW WE MAY USE YOUR DATA
We use (process) your personal data only for the purpose stated when the data was collected. For example, personal data collected when you order on the Butlers Chocolates website, through our pre-order app, or in a Butlers Chocolate Café would be used only for the purposes of completing the transaction you have initiated, including for payment and delivery of the ordered product to you, respond to queries related to the order and deal with any complaints. We may also send you customer communicatons about enhancements to products or services you have bought and reply to any enquiries you make about our products or services. 

We share your personal information with third parties who help us to deliver targeted marketing campaigns and to personalise your experience online. These providers include Segmentify, Klaviyo and Google. Personal data collected when you join the Butlers Platinum or Loyalty Card program or request to be added to the newsletter distribution will be used only to email you information related to your membership, and promotions or news where you have opted in to receive these marketing communications. We may also send offers and promotions to our existing customers. You may choose to opt-out at any time by simply clicking the “Unsubscribe” link included in the message.

We will use your data in order to:

• Process financial transactions to enable you to purchase our goods, our products or services
• Send you customer communications about enhancements to products or services you have bought
• Enable us to perform a contract with you and process orders, respond to enquiries related to the order and deal with complaints
• Reply to any enquiries you make about our products or services
• Send you marketing communications where we are allowed by law to do so
• Personalise your experience on our website
• Monitor the use of our website and online services
• Ask you to complete surveys or invite you to enter into competitions or prize draws
• Keep records of orders placed and communications in relation to such orders
• Keep records of communications
• Analyse your use of our website and other online services
• Administer and protect our business and website
• Deliver relevant website content and advertisements to you
• Understand the effectiveness of our advertising
• Bring legal claims against you if you breach a contract or fail to make payment (we know you won’t….)
• Comply with any legal obligations we are subject to or as required by a government authority
• Obtain or maintain insurance policies
• Manage our business

4. OUR LAWFUL GROUND OF PROCESSING
Under the General Data Protection Regulations (GDPR), we are only legally able to process your personal data if we have a lawful ground for doing so. 

Our lawful grounds of processing are:

• In relation to Customer Data that we have obtained in relation to you placing an order with us that we hold for the purpose of fulfilling that contract, informing you about updates to the product or service and keeping records of the contract, the processing is necessary for the performance of a contract to which you are subject and for our legitimate interests in informing you about updates to the product or service and to keep records for our business.
• In relation to Prospect Data that we have obtained when you enquired about our products or services (whether that be through our website or otherwise) and that we process in order to reply to your enquiry and keep records of this, the processing is necessary in order to take steps at your request prior to entering into a contract and for our legitimate interests in record keeping for our business
• In relation to Prospect Data that we have obtained when you signed up for any of our free resources and that we process in order to send you those free resources, reply to your communications about the resources and to keep relevant records, you have given consent to the processing for the purposes of us sending you the free resource and it is in our legitimate interests to reply to your communications and to keep records for our business.
• In relation to Marketing Data that we have obtained when you told us your marketing preferences, when you consented to us sending you details of our products and services, for the purposes of us sending you marketing communications, enabling you to partake in our promotions such as competitions, prize draws and free give-aways, to deliver relevant website content and advertisements to you and measure or understand the effectiveness of this advertising, the processing is necessary for our legitimate interests which in this case are to study how customers and users use our products/services, to develop them, to grow our business and to decide our marketing strategy.
• In relation to User Data that we have obtained through cookies on our website or other online services for the purposes of operating our website, ensuring relevant content is provided to you, ensuring the security of our website, maintaining back- ups of our website and/or databases and to enable publication and administration of our website, other online services and business, the processing is necessary for the purposes of our legitimate interests which in this case are to enable us to properly administer our website and our business.
• In relation to Technical Data (that includes data about your use of our website and online services such as your IP address, your login data, details about your browser, length of visit to pages on our website, page views and navigation paths, details about the number of times you use our website, time zone settings and other technology on the devices you use to access our website), we process this data to analyse your use of our website and other online services, to administer and protect our business and website, to deliver relevant website content and advertisements to you and to understand the effectiveness of our advertising.  Our lawful ground for this processing is our legitimate interests which in this case are to enable us to properly administer our website and our business and to grow our business and to decide our marketing strategy.
• In relation to your data that we process in order to comply with legal requirements or as required by a government authority, the processing is necessary for compliance with a legal obligation to which we are subject.
• In relation to keeping records, this processing is either necessary for compliance with a legal obligation that we are subject to or for our legitimate interests in responsible business operations.

Processing of sensitive data and personal data of children: We do not collect or process any special categories (sensitive) data from you. Sensitive data refers to data that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not collect any information about criminal convictions and offences. We do not carry out automated decision making or any type of automated profiling.

We do not knowingly collect, on the website or via our pre-order app, and process any personal data of children under the digital age of consent (currently defined in Ireland as those under the age of 16). The personal data of children collected for the Butlers Chocolate Factory Tour is not further processed except to ensure their safety and is securely deleted within a defined period after the completion of each tour.

Processing less visible to data subjects: We do not collect and process personal data from our online users, except for the use of cookies described above and certain identifying information such as IP address collected by authentication servers to help with safety and security of our customers and our business. Like other retailers, we collect CCTV images of customers, visitors, and employees in our cafés and production facilities for the purposes of security, safety, and to prevent theft (our legitimate business interest) or fraud. This is carried out in the least intrusive manner possible and the images are retained for less than a month unless needed for criminal or disciplinary investigation and are then securely deleted. There is very limited access to the CCTV images by authorised personnel and these are appropriately secured from unauthorised physical and electronic access. The images may be disclosed to An Garda Síochána for purposes of a criminal investigation.

5. HOW WE COLLECT YOUR PERSONAL DATA
We may collect data about you by you providing the data directly to us (for example by filling in forms on our site or by sending us emails). This includes the personal information that you provide to us when you place an order, subscribe to our mailing list,  enter a competition or survey. place an order via our pre-order app, or in our Butlers Chocolate Cafés, join our Butlers Platinum Loyalty Card or Happiness Card programme, tour the Butlers Chocolate Factory, or apply to enter employment with us. 

The information we collect will be different for each type of transaction or situation but should be the minimum personal data required to complete the transaction, including details to identify and contact you such as your name, address, phone number, business name and email address. We do not collect personal data about customers from sources besides yourself. We may automatically collect certain data from you as you use our website by using cookies and similar technologies. Please see our cookie policy for more details about this.

We may receive some of your personal data from third parties such as analytics providers such as Google based outside Ireland, [advertising networks such as Mets based outside Ireland], such as search information providers such as Google based outside Ireland, providers of technical, payment and delivery services, fraud detection agencies and data brokers or aggregators.

6. MARKETING COMMUNICATIONS

Our lawful ground of processing your personal data to send you marketing communications is either your consent or our legitimate interests (namely to grow our business). Under the ePrivacy Regulations, we may only send you email or text marketing communications if (i) you made a purchase or asked for information from us about our goods or services or (ii) you agreed to receive marketing communications and, in each case, you have not opted out of receiving such communications since. Under these regulations, if you are a limited company, we may send you marketing emails without your consent. However, you can still opt out of receiving marketing emails from us at any time. Before we share your personal data with any third party for their own marketing purposes, we will get your express consent. You can ask us or third parties to stop sending you marketing messages at any time by emailing us at website@butlers.ie. We also have unsubscribe buttons on the bottom of all of our emails. If you opt out of receiving marketing communications this opt-out does not apply to personal data provided as a result of other transactions, such as purchases etc. 

7. DISCLOSURES OF YOUR PERSONAL DATA

We disclose your personal data only to certain processors who help us run our business. These processors are required contractually to act only under our instructions and adhere to the same levels of data protection as we deploy. For example, we use processors to process card payments and deliver the products you ordered on the website and in our pre-order app and to deliver tickets to visitors on the Butlers Chocolate Factory tours. We disclose to them only the minimum amount of personal data needed for the purposes of the processing required by the transaction, such as your name and address for shipping and your card details for payments. We do not retain your card details. We may also be required to disclose your personal data by law or to ensure the safety and security of our customers, visitors, or employees. We will never sell or license your personal data.

Under data protection laws, we can only use your personal information for the purposes we have told you about, unless we consider that the new purpose is compatible with the purpose(s) we told you about. If we want to use your personal information for a different purpose that we do not think is compatible with the purpose(s) we told you about, then we will contact you to explain this, and what legal reason is in place to allow us to do this.

8.  TRANSFERS TO COUNTRIES OUTSIDE OF THE EEA
We store your personal data entirely within the European Economic Area (EEA) and primarily within Ireland. The only exceptions to this may be for credit card payment verification and marketing programs you have consented to participate in. If personal data leaves the EEA for processing, it must be under a contract requiring similar protections as would be required here and utilising one of the transfer mechanisms allowed under the GDPR, including adequacy decisions, standard contractual clauses, or EU-U.S. arrangments. Personal data is retained only until the purposes of the processing have been completed unless there is a requirement to it retain longer based on legal obligations we are subject to. When the retention period for processing has expired, we will delete your personal data using secure disposal techniques.

9. DATA SECURITY
We deploy sufficient organisational and technical safeguards to protect the confidentiality, integrity, availability, and resiliency of your personal data hosted on our processing systems.  We have put in place security measures to prevent your personal data from being accidentally lost, used, altered or accessed without authorisation. For example, we utilise independent external assessors to determine that our security practices are in compliance with international standards such as PCI DSS for your card payment data, we closely restrict physical access to computing equipment where personal data resides, we securely delete personal data that is no longer necessary for processing, we encrypt your personal data stored with us and your communications with our website using strong algorithms, and we deploy rigorous access controls to prevent unauthorised access to your personal data and have these controls independently tested. We also allow access to your personal data to those employees who have a business need to know such dara. They will only process your personal data on our instructions and they must keep it confidential. We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach if we are legally required to. 

10. DATA RETENTION

We will only hold your personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. When deciding what the correct time is to keep the data for, we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means and legal requirements. For tax purposes the law requires us to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they stop being customers. In some circumstances we may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

11. YOUR LEGAL RIGHTS
Your data protection rights are as follows:

• Right of access (sometimes called "subject access"): You may request confirmation that we are processing your personal data. Further, you may access your personal data, meaning you may receive a copy of what we have.
• Right of rectification: You may request that we update any personal data which is inaccurate or incomplete.
• Right of erasure: You may request the erasure of the personal data we control. Please be aware that this right is limited by any legal obligations which we may have to retain the data.
• Right to restrict processing: If your personal data is inaccurate, you may request that the processing of that personal data (except for its storage) be restricted until it is made accurate or if you object to certain processing (see below).
• Right to port: You may request that we provide you or a successor controller in machine-readable form any personal data that you provided to us electronically.
• Right to object: You may object to processing if your personal data is being used for direct marketing purposes or to processing based on our legitimate interest.
• Right to not be subject to solely automated decisions: You have the right to not be subject to decisions that are solely automated (made without human involvement) including profiling and have a legal or other significant impact on you.

In addition to the rights set out above, where we rely on consent as the legal reason for using your personal information, you have the right to withdraw your consent. If you want to exercise any of the above rights in relation to your personal information, please contact us using the details set out at the beginning of this notice. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive or refuse to comply with your request in these circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you. If you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Data Commissioner’s Office (DCO), Ireland’s supervisory authority for data protection issues (https://www.dataprotection.ie/). We should be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you.

12. COOKIES
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our cookies policy.

13. THIRD-PARTY WEBSITES
Our website may contain links to third-party websites. If you click and follow those links, then these will take you to the third-party website. Those third-party websites may collect personal information from you, and you will need to check their privacy notices to understand how your personal information is collected and used by them.

Changes to this Policy:

Revisions to this policy may be made at any time. Please check this policy often to be notified of any changes to this policy. Data subjects will be notified at their last known email address for any material changes to this policy, as reasonable and appropriate. We may update this from time to time.

This page was last updated on May 23rd 2023.