Privacy policy

Last updated: 25 September 2026

This Privacy Policy describes how CocoaDreams collects, uses, stores and shares your personal information when you visit our website, create an account, make a purchase, subscribe to our products or marketing, contact us, leave a review or otherwise interact with us.

CocoaDreams is a brand operated by Glowworm Enterprises LTD. For the purposes of UK data protection law, Glowworm Enterprises LTD is the data controller of the personal information described in this policy.

Our store is powered by Shopify, which provides the ecommerce platform and related services that allow us to operate CocoaDreams.

Quick answers

Can I stop receiving marketing emails or texts?

Do you track how I use the website?

Can I ask you to delete my personal information?

Who We Are

CocoaDreams is a UK-based brand operated by Glowworm Enterprises LTD.

We currently sell and deliver CocoaDreams products to customers in the United Kingdom.

If you have any questions about this Privacy Policy or how we handle your personal information, you can contact us at:

support@cocoadreams.co.uk

Personal Information We Collect

The personal information we collect depends on how you interact with CocoaDreams.

We may collect the following categories of personal information:

Contact information, including your name, email address, telephone number, billing address and delivery address.
Order and transaction information, including products purchased, order history, discounts used, returns, refunds, cancellations and subscription information.
Payment information. Payments are processed through Shopify and its payment providers. We do not normally receive or store your full payment card details ourselves.
Customer account information, including account details, saved addresses, preferences and information associated with your Shopify customer account.
Marketing preferences, including whether you have agreed to receive marketing by email or SMS and information about how you interact with those messages.
Communications with us, including information you provide when contacting customer support, making a return or refund request, responding to a survey or otherwise communicating with us.
Review information, including reviews, ratings, photographs or other content you choose to submit about CocoaDreams products.
Device and technical information, such as your IP address, browser type, device type, operating system, cookie identifiers and similar technical information.
Website usage information, including pages viewed, links clicked, products viewed, time spent on pages, navigation through the site and interactions with website features.
Advertising information, including information about advertisements you have viewed or interacted with and information used to understand or measure advertising campaigns.
Survey and feedback information where you choose to respond to surveys, questionnaires or other requests for feedback.

How We Collect Personal Information

We collect personal information from several sources.

Directly from you, for example when you place an order, create an account, subscribe, join our email or SMS list, complete a form, leave a review or contact us.
Automatically when you use our website, including through cookies, pixels, analytics tools and similar technologies.
From Shopify, which operates our ecommerce platform and customer account infrastructure.
From service providers and partners that help us operate our store, deliver orders, analyse our website, provide marketing services, process subscriptions or collect reviews.
From advertising platforms where permitted, for example where those platforms provide information about advertising performance or website interactions.

How We Use Your Personal Information

We use personal information for the following purposes:

to process and fulfil your orders;
to take payment and prevent fraudulent transactions;
to arrange delivery through Royal Mail;
to create and manage customer accounts;
to manage CocoaDreams subscriptions;
to process cancellations, returns, refunds and replacements;
to provide customer support;
to send order confirmations, delivery updates and other service-related communications;
to send marketing communications where permitted;
to personalise and improve our website and customer experience;
to understand how customers use our website;
to measure the effectiveness of our advertising;
to request and manage customer reviews;
to carry out surveys and gather feedback;
to maintain the security of our website and services;
to prevent fraud, misuse or abuse;
to maintain business, tax and accounting records; and
to comply with applicable laws and legal obligations.

Our Lawful Bases for Processing

Under UK data protection law, we must have a lawful basis for processing your personal information.

Depending on the activity, we may rely on:

Contract where processing is necessary to provide products or services you have requested, such as processing an order, managing a subscription or arranging delivery.
Consent where you have actively agreed to a particular use of your personal information, such as certain email or SMS marketing and non-essential cookies or tracking technologies.
Legitimate interests where processing is reasonably necessary for operating and improving our business and those interests are not overridden by your rights and interests. This may include website improvement, customer service, fraud prevention, business analytics and protecting our services.
Legal obligation where we need to process information to comply with tax, accounting, regulatory or other legal requirements.

Email and SMS Marketing

We use Klaviyo to help manage our email and SMS marketing.

You may choose to join our marketing list through website forms, promotional pop-ups, checkout opt-ins or other signup forms.

We may also offer incentives, such as a discount or free shipping, in connection with an optional email or SMS signup.

Where consent is required, marketing is only sent after you have taken an affirmative step to opt in.

You can stop receiving CocoaDreams marketing at any time by using the unsubscribe link in an email, following the opt-out instructions in an SMS, or contacting us at support@cocoadreams.co.uk. Withdrawing your marketing consent does not affect orders you have already placed or prevent us from sending necessary service-related communications.

Messages such as order confirmations, payment confirmations, subscription notices, delivery updates, refund information and important service communications are transactional rather than promotional and may still be sent where necessary to provide the service you requested.

We maintain appropriate records of marketing preferences and may retain limited suppression information after an unsubscribe so that we can respect your request not to receive further marketing.

Cookies, Analytics and Tracking Technologies

Our website uses cookies and similar technologies to operate the store, understand how the website is used, remember preferences, measure performance and support advertising.

These technologies may include:

Shopify cookies and technologies required to operate our store;
Shopify Analytics;
Google Analytics;
Meta Pixel;
TikTok Pixel; and
Hotjar.

Yes, we use analytics and tracking technologies to understand how visitors use CocoaDreams, improve the website and measure advertising, but non-essential tracking is subject to your cookie choices where consent is required.

You can manage available cookie choices through the cookie or privacy controls presented on our website.

Some cookies are necessary for the website to function and cannot be disabled through ordinary consent settings.

Hotjar

We use Hotjar to understand how visitors interact with our website.

Hotjar may provide us with information such as:

heatmaps;
session recordings;
navigation and click behaviour;
scroll behaviour; and
survey and feedback responses.

We configure Hotjar to suppress or mask form entries and sensitive information from session recordings so that information entered into sensitive fields is not intentionally captured in those recordings.

Hotjar information is used to identify usability problems, understand customer journeys and improve the design and performance of our website.

Advertising

We advertise CocoaDreams through platforms that may include:

Meta, including Facebook and Instagram;
Google;
TikTok;
Pinterest; and
Spotify.

Where permitted by your cookie and privacy choices, advertising platforms may receive information about your interaction with our website or advertising campaigns.

This information may be used to:

measure advertising performance;
understand whether advertisements result in website visits or purchases;
limit or improve advertising campaigns;
create advertising audiences; and
show advertising that may be more relevant to users.

The relevant advertising provider may also process information under its own privacy policy.

Reviews and Customer Feedback

We use review services including:

Trustpilot;
Loox; and
Google Reviews or Google customer review services.

After a purchase, we may use your order and contact information to send or facilitate a request for a review.

If you choose to leave a review, the review provider may process information you submit in accordance with its own privacy policy.

Reviews you choose to publish may be displayed publicly, including your name or other profile information where the relevant review service allows this.

Customer Accounts

We use Shopify customer accounts.

If you create an account, Shopify may process information such as your name, email address, order history, saved addresses and account preferences so that you can access and manage your account.

We may use account information to provide customer service, manage orders and subscriptions and improve your experience with CocoaDreams.

Subscriptions

We use Shopify Subscriptions to provide subscription purchasing options.

Where you subscribe, information relating to your subscription may be processed to:

manage recurring orders;
schedule recurring payments;
send subscription-related communications;
allow you to manage or cancel your subscription; and
provide customer support.

Delivery and Royal Mail

We use Royal Mail as our delivery courier.

To fulfil your order, we may share information such as your name, delivery address and other information reasonably necessary for delivery.

Royal Mail processes that information in accordance with its own legal and privacy obligations.

Shopify

Our online store is hosted and powered by Shopify.

Shopify processes personal information in order to provide ecommerce functionality, including hosting, checkout, payments, customer accounts, fraud prevention, analytics and other platform services.

Information that you provide through our store may therefore be transmitted to and processed by Shopify and its service providers.

Shopify may also process certain information about your interactions with our store for its own permitted purposes, as explained in Shopify's applicable privacy documentation.

How We Share Personal Information

We may share personal information with service providers where reasonably necessary to operate CocoaDreams.

These categories may include:

Shopify and Shopify-related service providers;
payment processors;
Klaviyo for email and SMS marketing;
Royal Mail for order delivery;
analytics providers such as Google Analytics;
Hotjar;
advertising providers including Meta, Google, TikTok, Pinterest and Spotify;
review providers including Trustpilot, Loox and Google;
professional advisers such as accountants or legal advisers where necessary;
technology and hosting providers; and
government authorities or law enforcement where disclosure is legally required.

We may also disclose information where necessary to protect our rights, investigate fraud, enforce our terms or comply with legal proceedings.

Business Transfers

If Glowworm Enterprises LTD is involved in a merger, acquisition, financing, restructuring, sale of assets or similar business transaction, personal information may be disclosed or transferred as part of that transaction where legally permitted.

International Data Transfers

Although CocoaDreams currently sells to customers in the United Kingdom, some of our service providers operate internationally.

This means personal information may be processed or stored outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we or our service providers may rely on recognised safeguards such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses or another legally recognised transfer mechanism.

How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet our legal, accounting, contractual and business obligations.

The appropriate retention period depends on factors such as:

whether you have an active customer account or subscription;
whether we need the information to fulfil an order or provide customer support;
tax and accounting requirements;
fraud prevention and security requirements;
whether there is an ongoing complaint or dispute; and
any applicable legal limitation periods.

Where personal information is no longer required, we may delete or anonymise it.

Security

We take reasonable administrative, organisational and technical measures to protect personal information.

However, no online service or method of electronic storage is completely secure, and we cannot guarantee absolute security.

You are responsible for keeping any account credentials secure and should not share your password or login information with other people.

Your Privacy Rights

Under UK data protection law, you may have rights in relation to your personal information.

Yes. Depending on the circumstances, you may ask us to delete personal information we hold about you, although we may need to retain certain information where we have a legal or legitimate reason to do so.

Your rights may include:

Right of access – to request a copy of personal information we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete information.
Right to erasure – to ask us to delete personal information in certain circumstances.
Right to restrict processing – to ask us to limit how we use your information in certain circumstances.
Right to data portability – to receive certain information in a structured, commonly used and machine-readable format where applicable.
Right to object – to object to certain processing based on legitimate interests.
Right to object to direct marketing – you can ask us to stop using your personal information for direct marketing at any time.
Right to withdraw consent – where we rely on your consent, you may withdraw that consent at any time.

These rights are not absolute and may be subject to legal exceptions.

To exercise a privacy right, contact:

support@cocoadreams.co.uk

We may need to verify your identity before completing a request.

Children

CocoaDreams is not intended to collect personal information from children.

If you believe a child has provided personal information to us without appropriate authorisation, please contact us so that we can investigate and take appropriate action.

Third-Party Websites and Services

Our website may contain links to websites, services or platforms operated by third parties.

Those third parties operate under their own terms and privacy policies, and we are not responsible for their privacy practices.

We recommend reviewing the relevant third-party privacy notice before providing personal information to another organisation.

Complaints

If you have concerns about how we use your personal information, please contact us first at:

support@cocoadreams.co.uk

We will try to resolve your concern.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you believe your personal information has been handled unlawfully.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, services, technology, legal requirements or privacy practices.

When we update the policy, we will update the "Last updated" date shown at the top of this page.