Privacy policy

BULLITT Bars Privacy and Cookie Policy

Last updated 29 September 2026

This policy explains how Coldharbour Foods Limited, trading under the BULLITT Bars brand, collects, uses, stores and shares personal data when you visit our website, create an account, place an order, contact us, enter a promotion or choose to receive marketing.

It also explains your rights and how we use cookies and similar technologies. This website is not intended for children, and we do not knowingly collect personal data relating to children.

Contents
1. Who we are
2. Personal data we collect
3. How we collect personal data
4. How we use personal data
5. Marketing
6. Sharing personal data
7. International transfers
8. Data security
9. Data retention
10. Your legal rights
11. Cookies
12. Contact and complaints

1 Who we are
Coldharbour Foods Limited is the controller responsible for the personal data covered by this policy. BULLITT Bars is a brand of Coldharbour Foods Limited.
Legal entity: Coldharbour Foods Limited
Company number: 17035779
Registered office: James House, Mere Park, Dedmere Road, Marlow, Buckinghamshire, United Kingdom, SL7 1FJ
Email: hello@bullittbars.com
Telephone: 07837 345 307
Please tell us if your personal details change so that the information we hold remains accurate.

2 Personal data we collect
Personal data means information that identifies you directly or indirectly. Depending on how you use our website, we may collect the following categories of personal data:
• Identity data, such as your name, username or account identifier.
• Contact data, such as your billing address, delivery address, email address and telephone number.
• Transaction data, such as your purchases, order history, payments, refunds and delivery details.
• Financial data needed to process a payment. Payment details are generally processed securely by our payment providers, and we do not normally store complete payment card details.
• Technical data, such as your IP address, browser, device, operating system, time zone and login information.
• Profile data, such as your account details, orders, preferences and feedback.
• Usage data, such as how you use our website and interact with its features.
• Marketing and communications data, such as your marketing choices and communication preferences.
We may use aggregated or anonymised information for statistical and business purposes. Information that cannot identify you is not personal data. If we combine aggregated information with personal data so that it can identify you, we treat the combined information as personal data.
We do not intend to collect special category data, information about criminal convictions or offences, or personal data relating to children.

3 How we collect personal data
We collect personal data through:
• Direct interactions, including when you place an order, create an account, subscribe to marketing, enter a promotion, complete a survey, leave a review or contact us.
• Automated technologies, including cookies, server logs and similar technologies that collect technical and usage data when you use our website.
• Service providers and third parties, including Shopify, payment providers, delivery and fulfilment providers, analytics providers and advertising platforms where you have consented to non-essential cookies.
• Public sources where lawful and relevant, such as Companies House.

4 How we use personal data
We use personal data only where the law allows us to. The main lawful bases are performing a contract with you, complying with a legal obligation, pursuing our legitimate interests where your rights do not override those interests, and obtaining your consent where required.
The table summarises our main uses of personal data.
Purpose
Data used
Lawful basis
Create and manage your account
Identity and contact data
Contract
Process payment, fulfil and deliver your order, manage returns and recover money owed
Identity, contact, financial and transaction data
Contract and legitimate interests
Respond to enquiries, complaints, reviews and surveys
Identity, contact, profile and communications data
Contract, legal obligation and legitimate interests
Operate, secure and troubleshoot our website and business
Identity, contact, technical and usage data
Legitimate interests and legal obligation
Purpose
Data used
Lawful basis
Analyse and improve our website, products and customer experience
Technical, usage and profile data
Legitimate interests or consent where cookies require it
Send marketing and measure advertising
Identity, contact, profile, usage, technical and communications data
Consent or legitimate interests where the law permits
Run competitions, promotions or surveys
Identity, contact, profile, usage and communications data
Contract and legitimate interests
If we need personal data to fulfil an order or comply with the law and you do not provide it, we may be unable to supply the product or service. We will explain this when we request the information.
We will use personal data only for the purpose for which it was collected unless the law allows us to use it for another compatible purpose. If we need to use it for an unrelated purpose, we will explain the legal basis unless the law prevents us from doing so.

5 Marketing
We may send you marketing if you have asked to receive it or, where the law permits, if you have bought from us and have not opted out. We will obtain consent where required, including before sharing personal data with another organisation for its own marketing.
You can stop marketing at any time by using the unsubscribe link in a message or contacting hello@bullittbars.com. Opting out of marketing does not affect service messages about an order or other transaction.

6 Sharing personal data
We may share personal data where necessary with:
• Ecommerce and hosting providers, including Shopify.
• Payment providers used at checkout.
• Warehousing, fulfilment, delivery and customer service providers.
• Analytics and advertising providers, including Google and Meta services where these are enabled and you have given any required consent.
• Professional advisers, such as lawyers, accountants, auditors, banks and insurers.
• HM Revenue and Customs, regulators, law enforcement agencies and other authorities where required by law.
• A buyer, seller or adviser involved in a sale, purchase, merger or reorganisation of all or part of our business.
We require service providers to protect personal data, use it only for agreed purposes and process it according to our instructions and applicable law.

7 International transfers
Some service providers, including Shopify and providers of analytics, advertising, payment or technical services, may process personal data outside the United Kingdom. Where a restricted transfer takes place, we rely on a lawful transfer mechanism, such as UK adequacy regulations, an approved contractual safeguard including the UK International Data Transfer Agreement or Addendum, or another permitted
exception. We also assess whether the transferred information will receive an appropriate level of protection.
Contact hello@bullittbars.com if you would like more information about the safeguards used for international transfers.

8 Data security
We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration or disclosure. Access is limited to people and service providers who need the information for their work and are required to keep it confidential.
We maintain procedures for responding to suspected personal data breaches and will notify affected people and regulators where the law requires us to do so.

9 Data retention
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, tax, accounting and reporting requirements. We may retain information for longer where a complaint or legal claim is likely.
We generally keep basic customer and transaction records for six years after the end of the relevant customer relationship or transaction where required for tax, accounting or legal purposes. Other retention periods depend on the type of information, why it is used and the risk associated with keeping it.
We may anonymise personal data so that it can no longer identify you. We may use anonymised information for research or statistical purposes without further notice.

10 Your legal rights
Depending on the circumstances, UK data protection law may give you the right to:
• Request access to the personal data we hold about you.
• Ask us to correct incomplete or inaccurate personal data.
• Ask us to erase personal data where there is no lawful reason to keep it.
• Object to processing based on legitimate interests or for direct marketing.
• Ask us to restrict how we use personal data.
• Receive certain personal data in a structured, commonly used, machine-readable format or ask us to transfer it to another organisation.
• Withdraw consent at any time where we rely on consent. This does not affect processing carried out before consent was withdrawn.
To exercise a right, email hello@bullittbars.com. We may ask for information to confirm your identity. You will not usually need to pay a fee, although the law allows us to charge a reasonable fee or refuse a request that is clearly unfounded or excessive.
We aim to respond within one month. If a request is complex or you make several requests, the law may allow additional time. We will tell you if this applies.
We do not use personal data for solely automated decisions that produce legal or similarly significant effects.

11 Cookies
Cookies and similar technologies are small files or identifiers used by websites and apps. They help the website work, remember choices, understand usage and, where permitted, measure advertising.
We use the following categories:
• Strictly necessary cookies, which are required for functions such as secure areas, the shopping basket, checkout and fraud prevention. These do not require consent where the legal exemption applies.
• Preference cookies, which remember choices and settings.
• Analytics cookies, which help us understand how visitors use the website and improve its performance.
• Advertising cookies, which help measure campaigns and show more relevant advertising.
We do not place non-essential analytics, preference or advertising cookies unless you have given any consent required by law. You can accept, reject or change your choices using the cookie banner or cookie settings link on our website. You can also control cookies through your browser, although blocking necessary cookies may prevent parts of the website from working.
Third parties such as Shopify, Google or Meta may place cookies when their services are enabled. Their use of information is also governed by their own privacy information. The cookies in use may change when website features or apps change, so the cookie banner or settings tool provides the most current controls.

12 Contact and complaints
Questions about this policy or requests concerning personal data should be sent to:
Email: hello@bullittbars.com
Telephone: 07837 345 307
Address: Coldharbour Foods Limited, James House, Mere Park, Dedmere Road, Marlow, Buckinghamshire, United Kingdom, SL7 1FJ
You may complain to the Information Commissioner's Office, the UK regulator for data protection. Visit ico.org.uk for details. We would appreciate the opportunity to address your concern first.
Changes to this policy
We may update this policy from time to time. The latest version will be published on our website with the date it was last updated.