Privacy policy
Privacy Policy
Last updated: 28 October 2026
This policy explains what personal data we collect when you visit cold-beverages.com, buy from us or contact us, why we use it, who receives it and what rights you have. It applies to customers and visitors in the United Kingdom. If you are in Germany, Austria or elsewhere in the EU, please see the German-language privacy notice on our German site.
1. Who we are
The controller of your personal data is Cold Beverages Limited, 2A Connaught Avenue, London E4 7AA, United Kingdom ("C°LD", "we", "us"). Our online store is run on a shared platform with our group company Cold Beverages GmbH, Arndtstraße 26, 22085 Hamburg, Germany, which acts on our behalf as an operator of the store systems.
Contact for anything about your data: datenschutz@coldbeverages.ch or info@coldbeverages.ch.
2. What we collect and why
| What | Why | Legal basis (UK GDPR) | How long |
|---|---|---|---|
| Server log data: IP address, date and time, pages requested, referrer, browser and device details | Delivering the website, keeping it secure, fixing faults | Legitimate interests (Art. 6(1)(f)) | Usually deleted after 90 days |
| Order data: name, email, billing and delivery address, phone number (optional), items ordered, order number and date, payment status | Taking and delivering your order, customer service, refunds | Contract (Art. 6(1)(b)); legal obligation for accounting and tax records (Art. 6(1)(c)) | Tax and accounting records for 6 years after the end of the financial year, other order data for up to 6 years to deal with claims |
| Customer account data: name, email, addresses, order history | Letting you check out faster and view past orders | Contract (Art. 6(1)(b)) | Until you ask us to delete the account |
| Messages and contact form data: name, email, country, reason for your enquiry, your message, and where relevant order number, product, batch number or best-before date | Answering your enquiry | Legitimate interests (Art. 6(1)(f)), or contract where the enquiry is about an order | Until the matter is resolved, then up to 3 years in case of follow-up or claims |
| Newsletter data: email address, name (optional), time of sign-up and confirmation, IP address at sign-up, whether emails are opened and links clicked | Sending you news and offers about C°LD | Consent (Art. 6(1)(a)). If you bought from us, we may also email you about similar products under the soft opt-in rule (PECR reg. 22) and legitimate interests | Until you unsubscribe. We then keep your address on a suppression list so we do not email you again |
| Competition and promotion entries: name, email, address (for prizes), proof of age where required, entry content | Running the promotion and sending prizes | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | Deleted after the promotion ends, winners' data kept for the legal retention period |
| Cookie and analytics data (see section 5) | Understanding how the site is used and measuring our advertising | Consent (Art. 6(1)(a) and PECR reg. 6), except the limited cookieless signals described in section 5 | See section 5 |
| Job and collaboration enquiries sent to us by email | Handling your application or enquiry | Legitimate interests (Art. 6(1)(f)); contract steps (Art. 6(1)(b)) | Applications are deleted 6 months after the process ends unless you agree to us keeping them longer |
You do not have to give us your data, but we cannot complete an order or answer an enquiry without the details marked as required.
3. Who we share data with
- Shopify (Shopify International Limited, Dublin, Ireland, and Shopify Inc., Canada and USA) hosts our store, runs checkout, our cookie banner and our newsletter tool. Shopify acts as our processor. For some purposes, such as fraud prevention and its "Shopify Network Intelligence" and improved services features, Shopify is an independent controller. See shopify.com/uk/legal/privacy and, to exercise rights directly with Shopify, privacy.shopify.com.
- Payment providers. Card and wallet payments are handled through Shopify Payments and the other payment methods shown at checkout. We never see or store your full card number. Payment providers act as independent controllers for their own fraud and compliance checks and their privacy notices apply.
- Delivery and fulfilment. We pass your name, delivery address and, where you provide them, your email address and phone number to our warehouse and fulfilment partner and the carrier delivering your order. If you do not want delivery notifications by email or text, tell us and we will switch them off.
- Marketing and analytics providers (Google and Meta), only as described in section 5 and only after you consent, with the exception noted there.
- Professional advisers, auditors, insurers and authorities where this is needed for our legal obligations or to protect our rights, and any buyer if our business is ever sold.
We do not sell your personal data.
4. Transfers outside the UK
Some of the providers above are located in, or can access data from, the EU/EEA, Canada or the USA. We only allow this where one of the following applies: the UK has recognised the destination as adequate (this covers the EU/EEA, and the USA for companies certified under the UK-US Data Bridge); we have the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in place; or another safeguard permitted by the UK GDPR applies. You can ask us for a copy of the safeguards at datenschutz@coldbeverages.ch.
5. Cookies, analytics and advertising
When you first visit, our cookie banner lets you accept or reject non-essential cookies. Declining is as easy as accepting. You can change your choice at any time through the cookie settings link on the site or by clearing your cookies. Nothing below is switched on for analytics or marketing purposes until you agree, except as described under "Cookieless signals".
Strictly necessary. Cookies and similar technologies that keep your basket, your language and region, your login and the security of checkout working, and that record your cookie choice. These do not need consent.
Google Tag Manager. We use Google Tag Manager (Google Ireland Limited) to load the services below according to your choice. It does not set analytics or advertising cookies itself.
Google Analytics 4 (analytics, with consent). Google Analytics uses cookies (_ga and _ga_<ID>, up to 2 years) to measure how the site is used: pages viewed, events such as viewing a product, adding to basket, starting checkout and purchasing (with order value and products), approximate location (country or region), device and browser details and a pseudonymous ID. Google does not log or store IP addresses in Google Analytics 4. We keep the data for 14 months.
Cookieless signals. We use Google Consent Mode. If you have not agreed to analytics, Google Analytics sets no cookies and uses no user ID. A small number of signals that are not linked to you personally can still reach Google: the time and page of the visit, browser and device details, a flag that you have not consented and, as with any internet connection, your IP address, which Google does not store. Google uses them only for aggregated and modelled statistics. We rely on legitimate interests (Art. 6(1)(f)) for this limited measurement. You can object at any time (see section 8).
Meta Pixel (advertising, with consent). If you accept marketing cookies, the Meta Pixel (Meta Platforms Ireland Limited) lets us measure the results of our Facebook and Instagram advertising, improve it and show our ads to people who visited the site. Meta sets a cookie (_fbp, up to 90 days) and receives the pages you view, events such as product views, adding to basket, starting checkout and purchases (value, currency, product IDs), your IP address and browser and device details. We and Meta are joint controllers for collecting and sending this data to Meta (Meta Controller Addendum). Meta is solely responsible for what it does with the data afterwards (Meta privacy policy).
Checkout measurement. We also measure checkout start and completed purchases with Google Analytics and Meta through a tool set up in Shopify. It only runs if you have accepted both analytics and marketing cookies. It sends the order number, order value, currency and the products bought, but not your name, address or payment details.
Your browser settings can also block or delete cookies, but parts of the site may then not work properly.
6. Social media
We run profiles on Instagram, Facebook, TikTok and LinkedIn. When you interact with them, the platform processes your data under its own privacy policy. For the aggregated statistics ("insights") that the platforms give us, we and the platform may be joint controllers. If you message us there, we use your message to reply to you.
7. Security and children
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and the security controls of our platform provider. Our website is not aimed at children under 13 and we do not knowingly collect their data.
8. Your rights
Under the UK GDPR you have the right to:
- be told what we do with your data and get a copy of it (access);
- have inaccurate data corrected or incomplete data completed;
- have your data erased in certain cases;
- restrict how we use your data in certain cases;
- receive data you gave us in a portable format (where we process it by consent or contract);
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting what was done before. Unsubscribe links are at the bottom of every newsletter.
To use any of these rights, email datenschutz@coldbeverages.ch. We normally reply within one month and do not charge a fee. We may need to confirm your identity first.
We do not make decisions about you using solely automated processing that have legal or similarly significant effects.
If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk/make-a-complaint.
9. Changes to this policy
We may update this policy, for example when we add a new service. The date at the top shows when it was last changed. If a change significantly affects how we use your data, we will tell you in a suitable way.