Privacy Policy
Privacy Policy
Atlantic Boba Ltd · Company No. NI738235 · VAT No. 514604026 · Last updated: 5 April 2026
Atlantic Boba Ltd ('Atlantic Boba', 'we', 'us', 'our') is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store and share personal data when you visit atlanticboba.co.uk or engage with us as a wholesale customer.
Atlantic Boba Ltd is the data controller. We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we process the personal data of individuals in the EEA — including the Republic of Ireland — we also comply with the EU GDPR to the extent applicable.
1. Identity and Contact Details
Atlantic Boba Ltd · Unit 26, Lows Industrial Estate, 31 Ballynahinch Road, Carryduff, BT8 8EH, Northern Ireland
Email: info@atlanticboba.co.uk · Tel: 07803 157948 · Company No. NI738235 · VAT No. 514604026
All data protection enquiries should be directed to info@atlanticboba.co.uk.
2. Personal Data We Collect
Data you provide: full name and job title; business name, trading name and company registration number; business address (billing/delivery); email and telephone; payment information (card details processed exclusively by Stripe — not stored by us); BACS bank details where applicable; order history and correspondence.
Data collected automatically: IP address and approximate location; browser, version and device type; pages visited and time spent; referral source; cookie identifiers and session data; performance and error data.
3. Lawful Basis for Processing
| Purpose | Lawful Basis |
|---|---|
| Processing and fulfilling orders | Performance of a contract — Article 6(1)(b) |
| Issuing VAT invoices and financial records | Legal obligation — Article 6(1)(c) |
| Responding to enquiries and customer service | Legitimate interests — Article 6(1)(f) |
| Managing wholesale accounts and order history | Performance of a contract — Article 6(1)(b) |
| Sending product and service updates (where opted in) | Consent — Article 6(1)(a) |
| Improving our website through analytics | Legitimate interests — Article 6(1)(f) |
| Food safety, tax and regulatory obligations | Legal obligation — Article 6(1)(c) |
| Fraud prevention and site security | Legitimate interests — Article 6(1)(f) |
4. How We Use Your Personal Data
We use personal data to: process and manage wholesale orders; operate your account; issue VAT invoices and financial documents; process payments and detect fraud; respond to enquiries; send order confirmations, dispatch and delivery updates; send product information where you've consented; comply with legal obligations under food safety, tax and import legislation; and improve our website and services through analytics.
5. Sharing Your Personal Data
We do not sell, rent or trade your personal data. We may share it with:
| Third Party | Purpose and Basis |
|---|---|
| Shopify Inc. | Website hosting and order management — data processor under contract |
| Stripe Inc. | Secure payment processing — data processor under contract |
| Royal Mail / A2B Carrier Logistics / courier partners | Order fulfilment and delivery |
| Google LLC (Google Analytics) | Website analytics — pseudonymised |
| Accountants and professional advisers | Legal, financial and compliance advice |
| HMRC | Tax obligations — legal obligation |
| FSA, DAERA, LCCC, Belfast Port Health | Food safety and regulatory compliance |
| Law enforcement or courts | Where required by law or court order |
6. International Data Transfers
Some service providers operate outside the UK and EEA: Shopify Inc. (Canada — adequacy decision), Stripe Inc. (US — SCCs), Google LLC (multiple jurisdictions — SCCs). We do not transfer customer personal data to our suppliers in China or Taiwan. Where international transfers occur, we ensure appropriate safeguards are in place under Chapter V of UK GDPR.
7. Data Retention
| Category | Retention Period |
|---|---|
| Order and transaction records (incl. VAT invoices) | 7 years from end of relevant tax year |
| Active customer accounts | Duration of account + 3 years following last order |
| Inactive or deleted accounts | 3 years from last activity |
| Marketing consent records | Until consent withdrawn + 1 year |
| Correspondence and enquiries | 3 years from date of correspondence |
| Website analytics data | 26 months |
8. Your Rights
Under UK GDPR you have rights to: access your data, correct inaccurate data, request erasure, restrict processing, data portability, object to processing, withdraw consent, and not be subject to solely automated decisions. To exercise any right, contact info@atlanticboba.co.uk — we'll respond within one calendar month.
If dissatisfied, you can complain to the ICO (UK: ico.org.uk · 0303 123 1113) or the DPC (Ireland: dataprotection.ie).
9. Cookies
We use strictly necessary cookies (cart, session, security — cannot be disabled), performance/analytics cookies (Google Analytics, anonymised), functional cookies (currency, language preferences) and marketing cookies (only with explicit consent via the cookie banner).
10. Security
We protect personal data through SSL/TLS encryption, access controls on a need-to-know basis, PCI DSS compliant payment processing via Stripe (we do not store card data), and regular review of our security arrangements. We notify the ICO of personal data breaches within 72 hours where required.
11. Children
Our services are directed exclusively at business customers. We do not knowingly collect personal data from individuals under 18.
12. Third-Party Links
Our website may contain links to third-party sites. We are not responsible for their privacy practices.
13. Changes to This Policy
We may update this policy from time to time. The current version is always available at atlanticboba.co.uk/pages/privacy-policy.
14. Contact
Privacy queries and Subject Access Requests: Atlantic Boba Ltd, Unit 26, Lows Industrial Estate, 31 Ballynahinch Road, Carryduff, BT8 8EH · info@atlanticboba.co.uk · 07803 157948