Privacy policy

Last updated: 3 September 2026

Choc and Co cares about protecting the data of the people who visit this site and write to us. This policy explains what data we collect, why, how long we keep it and what your rights are.

1. Who is the data controller

Choc and Co SA
122 Avenue Robert Schuman, 1401 Baulers, Belgium
Company and VAT number: BE 0440.001.995
Telephone: +32 2 366 96 14
E-mail:

We have not appointed a data protection officer. For any question about your data there is a single address: .

2. What this policy covers

This policy covers the site chocandco.com. Our online shop is hosted on a separate site, cafe-tasse.com, which has its own terms and its own privacy policy.

3. The data you send us

This site asks for no account and accepts no payment. The only data we collect is what you enter yourself in our contact and private label enquiry forms:

• your company name and your country;
• your name and your e-mail address;
• the nature of your enquiry, and for a project under your own brand, the format and quantity you have in mind;
• the content of your message.

These forms store nothing in a database: your enquiry reaches us by e-mail and is handled in our mailbox.

4. Technical data

Like any website, ours and its security layer keep access logs containing your IP address, the date and time of the visit, the pages viewed and the type of browser. These logs serve only to keep the site working and secure.

We use no analytics tool and no advertising pixel. We do not track your browsing and we build no profile.

5. Why we process this data, and on what basis

• To answer your enquiry and prepare a business relationship. We process this data on the basis of the consent you give by ticking the box on the form before sending it.
• To get back in touch about your project. We may come back to you some time after your enquiry to ask whether your project has moved forward. That is the purpose of the second part of the box you tick. You can ask us to stop at any time, simply by replying to one of our e-mails or writing to .
• To protect our forms from automated submissions. Our forms include an internal technical device that detects automated submissions. It sets no cookie, sends nothing to a third party and does not analyse your browsing. We operate it on the basis of our legitimate interest in receiving genuine enquiries.
• To keep the site secure and working properly. The technical logs described in point 4 are kept on the basis of our legitimate interest in protecting the site against abusive access.

We send no newsletter and we add nobody to a mailing list.

6. How long we keep it

• An enquiry that leads nowhere is kept for three years from our last exchange, then deleted.
• An enquiry that becomes a business relationship follows the duration of that relationship, then the statutory retention period for accounting records, which is seven years.
• Technical logs are purged after twelve months.

7. Who receives your data

Your enquiries are sent to the people at Choc and Co responsible for answering them: our private label manager for projects under your own brand, our general reception for other enquiries. We do not sell or pass on your data to third parties for commercial purposes.

We use the following technical providers:

• OVH (France), for hosting the site;
• Google Workspace, our professional mail service, in which your enquiries are received and stored.

8. Transfers outside the European Union

Our site is hosted in France. The site itself calls no third-party service. One transfer remains: our professional mail service Google Workspace, in which your enquiries are received, may involve processing of your data in the United States.

These transfers are governed by Google’s data processing amendment, incorporated into our contract. Google LLC is certified under the EU–U.S. Data Privacy Framework, recognised as adequate by the European Commission, and the Commission’s standard contractual clauses apply in addition, in particular to transfers to its own sub-processors.

Our Google Workspace plan does not allow us to restrict the storage location to the European Union.

9. Your rights

You have the right to access your data, to have it corrected or erased, to request that its processing be restricted, to object to that processing, to obtain its portability, and to withdraw at any time the consent you have given.

To exercise these rights, write to . We answer within the period set by the regulation.

If our answer does not satisfy you, you may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), rue de la Presse 35, 1000 Brussels.

10. Security

The site is served over HTTPS only. It is protected by an application security layer and backed up regularly. We limit access to the enquiries we receive to the people who have to handle them.

11. Changes

We may update this policy. The date of the last update appears at the top of the page.