Privacy Notice
Last updated date:
The Chocolate Store LLC (“we,” “us,” or “our”) is committed to safeguarding user privacy and ensuring the confidentiality of the information collected while using our services and website in accordance with the Oman Personal Data Protection Law (PDPL) - Royal Decree No. 6/2022 and its Executive Regulations (MD 34/2024). This privacy notice outlines how we collect use, share and protect your personal data, your rights under PDPL and how to exercise those rights.
Contact Information:
Data Controller Information
The chocolate store LLC
PO Box 3295, 112, Muscat, Sultanate of Oman
Contact Information of Data Protection Officer
Name: Mr. Ahmad Awwad
Email: privacy@thechocolatestore.om
Contact:
The DPO is responsible for ensuring The Chocolate Store LLC compliance with the PDPL and for addressing all inquiries related to the processing of personal data.
Our Role
Under the Oman PDPL (Royal Decree No. 6/2022), The Chocolate Store LLC operate as a Data Controller, and we determine the purpose and means of processing your data to provide our services to you.
Personal Data we collect
The Chocolate Store LLC collects only the minimum necessary data required to provide our services and comply with PDPL. We collect information that identifies you or makes you identifiable. The type of data we collect depends on your interaction with us (e.g., whether you are a retail customer, or a website visitor).
- Information You Provide Directly
We collect personal information that you voluntarily provide to us when you subscribe to our newsletter, make a purchase, place an order, contact us, participate in contests, or communicate with us through our retail store, website, WhatsApp, Instagram, email, or telephone.
The information we may collect includes:
- Full name
- Phone number
- Email address
- Delivery address (where applicable)
- Order and purchase details
- Communication records and customer inquiries
This information is used to process orders, generate invoices, deliver products, respond to inquiries, administer contests, provide customer support, send newsletters and communicate with you regarding our products and services.
- Information Collected Automatically
When you visit our digital platforms, we use cookies and similar technologies to collect technical data.
- Technical Data: Your IP address, login data, browser type and version, time zone setting, and operating system.
Minor Data
Due to the nature of our brand, we naturally attract younger audiences. We are fully committed to protecting the privacy of minors under the Oman PDPL.
- In-Store Purchases: We do not knowingly collect personal data from minors at our retail outlets. If a customer is identified as a minor, we will request their parent’s contact details or process the transaction anonymously using a generic store identifier.
- Online & WhatsApp Channels: Our digital ordering channels are intended for users aged 18 and older. Because mobile SIM cards in Oman are legally registered to adults, a phone number alone does not identify a user as a minor. In accordance with Oman PDPL, we do not intentionally process the data of minors without establishing proper safeguards or seeking parental consent where required by law.
- We process digital transactions under the presumption that they are authorized by an adult, unless a user explicitly discloses their identity as a minor during the interaction.
- Website Registration: Minors under 18 should use their parents' information (name, contact details, and address) for digital interactions. Creating an individual online profile for a minor is prohibited unless verifiable parental consent is obtained before the account is finalized.
We do not knowingly collect personal information from children except where it is voluntarily provided in connection with a retail order, online order, contest participation, or customer inquiry.
Where personal information relating to a minor is collected, it is typically limited to basic details such as:
- Name
- Phone number (where applicable)
- Email address (where applicable)
If you believe that a child has provided personal information without appropriate authorization, please contact us so that we can take appropriate action.
Information for Parents and Guardians
If you are a parent or legal guardian and discover that your minor son or daughter has provided us with their personal data without your authorization, we ask that you notify us immediately. Upon verification, we will take prompt action to restrict, block, or permanently delete the data from our active storage.
As a parent or legal guardian, you may exercise any of your rights—including access, rectification, erasure, or checking your child's data records under the Oman PDPL framework—by contacting our dedicated privacy office at: privacy@thechocolatestore.om
Legal Basis & Purpose of Processing
We process your personal data only when a valid legal basis exists under the Oman PDPL:
- Explicit Consent: We process your personal data if you have given your clear, written, or electronic approval/consent for the same. Where we rely on your consent to use your personal data, you have the right to withdraw the consent at any time. Please contact us using the details in the Contact us section.
- Contractual Necessity: We process your data to fulfil the contractual necessity.
- Legal Obligations: We process your personal data necessary for compliance with the any legal obligation, court judgments, or regulatory requirements.
- Security of the Organization: To protect our systems, prevent fraud, and ensure the safety of our operations.
Data Subject Rights Under PDPL
As a data subject, you have the following rights:
- Access: You have right to request a copy of your personal data held by The Chocolate Store LLC
- Correction: You have a right to request correction of inaccurate or outdated data.
- Erasure: You have a right to request deletion of your data under specific circumstances.
- Deletion: You have right to request erasure of your personal data, for example if consent is withdrawn or the data is no longer necessary.
- Withdrawal of Consent: You have a right to revoke previously given consent at any time.
- Restriction: You have right to request temporary halt of processing under specific conditions.
- Data Portability: You have right to request transfer of your data in a machine-readable format
- Objection: You have right to object to processing for direct marketing or other reasons.
- Complaint: If you have any questions or concerns regarding our privacy practices, we encourage you to contact our Data Protection Officer (DPO) directly. If our DPO is unable to resolve your concern to your satisfaction, you maintain the right to escalate your complaint to the Ministry of Transport, Communications and Information Technology (MTCIT).
To exercise any of these rights, please contact: privacy@thechocolatestore.om
Cookies and Google Analytics:
We use strictly necessary cookies to ensure the proper functioning and security of our website and to analyze website traffic using Google Analytics. Analytics cookies will only be set with your consent. You can accept or reject these cookies. Google Analytics is used solely to monitor site performance, and we ensure that technical parameters like IP masking are implemented where possible to safeguard anonymity.
Marketing & Promotional Activities
We only use your personal information for direct marketing if you provide explicit consent. All our marketing communications include clear instructions on how to opt out at any time. You can withdraw your consent or change your preferences by replying directly to our emails, WhatsApp, messaging us on social media, or contacting us through this website.
You information shared with other:
Recipient of your data:
Third party service providers: We may share personal data we collect about you with our third-party service providers. The categories of service providers to whom we entrust personal data including IT and related services such as cloud-based centers, analytics service provides.
Disclosures to protect us or others: We may access, preserve and disclose any information we store associated with you to external parties if we in good faith believe doing so is required or appropriate to comply with law enforcement or national security request and legal process.
Disclosures in the event of merger, sale or other asset transfer: If we are involved in a merge, acquisition, or sale of assets or transition of service to another provider then your information may be sold or transferred as part of such a transaction, as permitted by law and /or contract.
Third Party Service Provider:
We receive and process customer order information from Talabat when you place an order through the Talabat platform. The information shared with us may include your name, phone number, delivery details, and order information, which are used solely for order processing, invoicing, order fulfillment, customer communication, and delivery management.
Please note that Talabat operates as an independent platform and processes your personal data in accordance with its own privacy practices and policies. We encourage you to review Talabat's privacy notice to understand how your personal data is collected, used, and shared by Talabat.
We only process the personal data received from Talabat for the purposes necessary to fulfill your order and comply with our legal and operational obligations.
Social Media and Marketing Activities
We maintain our presence on social media platforms to engage with customers, share updates about our products and services, and conduct general promotional activities. All promotional content shared on our channels consists of untargeted, public posts directed to a general audience rather than individualized or targeted marketing campaigns.
If you interact with us through our social media channels, we may receive information that you choose to share, such as your name, contact details, comments, messages, or other information provided through the platform. Individuals expressing interest through social media may be directed to our official WhatsApp channel or store contact details for further communication and order processing.
Minima Marketing Agency manages our social media content and general marketing activities; however, no direct commercial interaction involving the processing of customer personal data is carried out by Minima on our behalf, nor do they conduct targeted advertising or behavioural profiling using your data. Any personal data shared through social media interactions is processed by Chocolate Store LLC for customer communication, inquiry management, and service-related purposes.
Limitation of Liability for Publicly Shared Data:
While The chocolate store LLC handles all private correspondence (Direct Messages) in accordance with the Oman PDPL (Royal Decree No. 6/2022), we do not encourage the disclosure of non-public personal information in public forums or comment sections. Users are advised that information shared publicly is outside of our exclusive control. Consequently, The chocolate store LLC shall not be held liable for any damages, losses, or privacy breaches arising from the misuse of such information by other users or third parties.
Retention of Personal Data:
We retain your personal data only as long as necessary to fulfil the purpose for which it was collected or as required by law. To satisfy specific corporate governance, auditing, and regulatory requirements under the Sultanate of Oman's Commercial and Tax Laws, financial transactions and invoice records are stored for a minimum of ten (10) years following the end of our commercial relationship. General non-transactional personal data (such as marketing lists and inactive customer digital interaction logs) is retained for a much shorter operational period—typically three (3) years after last activity or deleted promptly upon a valid erasure request or withdrawal of consent, unless a longer legal retention obligation applies.
Data Security:
We implement appropriate technical and organizational measures to protect the personal information we collect from or about you (including personal identifiable information) against unauthorized access, use, alteration, or disclosure. These measures include, among others:
- Encryption of personal data at rest and in transit, where applicable
- Role-based access controls and audit logging
- Staff training and internal privacy and information security governance measures
Cross-Border Data Transfers:
Your data will be stored outside Oman using third party Cloud Service Providers hosted outside Sultanate of Oman. To ensure the safety of your information, and to comply with the cross-border provisions of the Oman PDPL and its Executive Regulations (MD 34/2024 we conduct Transfer Impact Assessments and maintain Data Protection Agreements with our partners to guarantee a level of protection equivalent to the Oman PDPL, ensuring that any external transfer satisfies the mandatory security baselines and regulatory controls established by the MTCIT.
Link to other Sites:
Our Services may contain links to other websites and services. Any information that you provide on or to a third-party website or service is provided directly to the owner of the website or service and is subject to that party’s privacy notice. Our privacy notice does not apply to such websites or services and we’re not responsible for the content, privacy, or security practices and policies of those websites or services. To protect your information, we recommend that you carefully review the privacy policies of other websites and services that you access.
Breach Notification:
A Personal Data Breach may include any unauthorized or unlawful access, disclosure, alterations, loss, destruction misuse or compromise of Personal Data processed by us
In case of a personal data breach we shall take appropriate technical and organizational measures to contain, investigate, assess and remediate the incident in accordance with the Oman Personal Data Protection Law (Royal Decree 6/2022) and its implementing regulations (PDPL) Specifically, in alignment with MD 34/2024, if a personal data breach occurs that is likely to result in a risk to the data subjects' privacy, rights, or freedoms, we will notify the Ministry of Transport, Communications and Information Technology (MTCIT) within 72 hours of becoming aware of the breach. Furthermore, if the breach is likely to pose a high risk to your personal data privacy, we will notify you without undue delay so you can take protective measures.
Changes to Privacy Notice:
Any information that we collect is subject to the privacy notice in effect at the time that the information is collected. We may, however, modify and revise this privacy notice from time to time. We encourage you to review this privacy notice periodically to stay informed about how we process and protect your personal data.
The last updated date at the top of this privacy notice indicates when it was most recently revised.
Complaints and Contact Information:
If you believe your personal data has been mishandled or your privacy rights are violated:
Please contact us at privacy@thechocolatestore.om