Privacy Notice
Last updated: 3 September 2026
At Soché, we respect your privacy and are committed to handling your personal information responsibly, transparently and securely.
This Privacy Notice explains how Le Papillon Boutique Ltd, trading as Soché, collects, uses, stores and shares personal information when you:
- Visit soche.co.uk
- Browse or interact with our website
- Create or use an online customer account
- Purchase products from us
- Contact our customer support team
- Subscribe to communications from us
- Make a wholesale or commercial enquiry
- Enter into a business relationship with us
- Interact with our digital communications, where applicable
It also explains your rights and how you can exercise them.
1. Who We Are
For the purposes of applicable UK data protection legislation, the organisation responsible for deciding how and why your personal information is processed is:
Le Papillon Boutique Ltd
Trading as: Soché
Email: info@soche.co.uk
In this Privacy Notice, “Soché”, “we”, “us” and “our” refer to Le Papillon Boutique Ltd trading as Soché.
Where we determine the purposes and means of processing your personal information, we act as the data controller.
For particular processing activities, another organisation may act as a separate controller, joint controller or processor depending on the circumstances and contractual arrangements.
2. What Personal Information Do We Collect?
The information we collect depends on how you interact with us.
2.1 Information you provide directly
This may include:
- Full name
- Email address
- Telephone number
- Billing address
- Delivery address
- Company name
- Job title or role
- Business contact information
- Account login information
- Order information
- Enquiry details
- Communications with our team
- Preferences you provide to us
- Information provided when subscribing to communications
- Information provided when requesting wholesale or commercial information
2.2 Order and transaction information
When you purchase from us, we may process information relating to the transaction, including:
- Products purchased
- Quantity
- Order number
- Order date
- Order value
- Billing information
- Delivery information
- Payment status
- Refund information
- Returns information
- Delivery and fulfilment information
- Customer communications relating to the order
Payment card information is generally processed through our payment provider and payment infrastructure rather than being stored by Soché in full.
2.3 Technical and website information
When you visit our website, certain information may be collected automatically or through technologies used on the site.
Depending on your browser, device and consent choices, this may include:
- IP address
- Browser type
- Device type
- Operating system
- Approximate location derived from IP address
- Pages visited
- Products viewed
- Referring website
- Website interactions
- Session information
- Device identifiers
- Cookie identifiers
- Website performance information
- Other technical information generated through use of the website
Some of this information may constitute personal information under applicable data protection law.
2.4 Information from business enquiries
If you contact us regarding wholesale, foodservice, distribution, industrial, private-label or export opportunities, we may collect information including:
- Name
- Company name
- Job title
- Business email
- Telephone number
- Country
- Business address
- Delivery destination
- Products of interest
- Estimated quantities
- Packaging requirements
- Intended application
- Commercial requirements
- Documentation requirements
- Communications and correspondence
2.5 Information received from other sources
In certain circumstances, we may receive personal information from sources other than the individual concerned.
These may include:
- Business partners
- Commercial customers
- Service providers
- Delivery or fulfilment partners
- Professional advisers
- Publicly available business sources
- Fraud-prevention services
- Other organisations where permitted by law
Where applicable, we will provide the privacy information required by law.
3. How We Use Personal Information
We use personal information only for appropriate and lawful purposes.
These purposes may include the following.
3.1 Processing and fulfilling orders
We use information to:
- Process purchases
- Confirm orders
- Process payments
- Prepare orders for fulfilment
- Arrange delivery
- Provide delivery updates
- Provide tracking information
- Handle cancellations
- Process returns and refunds
- Provide customer support
- Maintain transaction records
The principal lawful basis for this processing is that it is necessary to perform a contract with you or to take steps at your request before entering into a contract.
3.2 Customer service
We use personal information to:
- Respond to enquiries
- Investigate complaints
- Resolve delivery issues
- Investigate damaged or defective products
- Handle returns and refunds
- Provide product information
- Provide technical or order support
Depending on the circumstances, the lawful basis may be contract, legal obligation or our legitimate interests in operating and supporting our customers.
3.3 Website operation
We process technical and usage information to:
- Operate our website
- Maintain security
- Prevent misuse
- Diagnose technical problems
- Improve website performance
- Maintain functionality
- Understand how our website is used
Depending on the specific processing activity, the lawful basis may be legitimate interests, consent, or another lawful basis permitted by applicable law.
3.4 Fraud prevention and security
We may process information to:
- Detect and prevent fraudulent transactions
- Protect customers
- Protect our business
- Verify transactions
- Identify suspicious activity
- Maintain website and payment security
- Prevent abuse of our services
The lawful basis may include legitimate interests and legal obligations, where applicable.
3.5 Legal and regulatory compliance
We may process information where necessary to:
- Comply with legal obligations
- Maintain accounting and financial records
- Meet tax requirements
- Respond to lawful requests from authorities
- Establish, exercise or defend legal claims
- Meet regulatory requirements
- Protect our legal rights
The relevant lawful basis may be legal obligation, legitimate interests or another lawful basis permitted by law.
4. Wholesale and B2B Processing
Soché operates a B2B supply business serving customers across areas including:
- Retail
- Foodservice
- Hospitality
- Distribution
- Import
- Food manufacturing
- Industrial applications
- Private label
- Commercial ingredient supply
Where you contact us or enter into a commercial relationship with us, we may process your business contact information and related correspondence to:
- Respond to enquiries
- Prepare quotations
- Discuss specifications
- Assess supply requirements
- Arrange samples
- Negotiate commercial terms
- Process purchase orders
- Manage customer relationships
- Arrange production and fulfilment
- Arrange commercial shipments
- Provide documentation
- Manage accounts and invoicing
- Provide customer support
- Maintain commercial records
The lawful basis will depend on the particular activity and may include taking steps at your request to enter into a contract, performing a contract, legitimate interests, or legal obligation.
5. Lawful Bases for Processing
Under applicable UK data protection law, we must have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on:
Contract
Where processing is necessary to enter into or perform a contract with you.
For example:
- Processing an online order
- Arranging delivery
- Processing a refund
- Managing a commercial supply agreement
Legal obligation
Where processing is necessary for us to comply with a legal requirement.
For example:
- Accounting records
- Tax requirements
- Certain regulatory requirements
- Responding to lawful requests
Legitimate interests
Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.
Examples may include:
- Fraud prevention
- Website security
- Customer support
- Business administration
- Service improvement
- Managing business relationships
- Protecting our legal rights
Where we rely on legitimate interests, we consider the impact on individuals and apply appropriate safeguards.
Consent
Where the law requires consent, we will ask for it before carrying out the relevant processing.
For example, certain forms of electronic marketing and certain non-essential cookies or similar technologies may require consent.
You may withdraw consent at any time where consent is the lawful basis for processing.
Withdrawal of consent does not affect processing that took place before withdrawal.
6. Marketing Communications
Where permitted by law, we may send information about Soché, our products, services, offers, launches or other communications that may be relevant to you.
Where consent is required, we will obtain consent before sending such communications.
You can unsubscribe from marketing communications at any time by:
- Using the unsubscribe link included in the communication; or
- Contacting us at info@soche.co.uk
Even if you opt out of marketing communications, we may continue to send essential service communications, such as:
- Order confirmations
- Delivery updates
- Refund information
- Important account communications
- Product or safety notices
- Other communications necessary to administer your transaction
7. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
Some cookies are necessary for the website to function, including functions associated with:
- Shopping baskets
- Checkout
- Security
- Session management
- Essential website functionality
Other cookies or similar technologies may be used for purposes such as:
- Analytics
- Website performance
- Personalisation
- Advertising
- Marketing
Where consent is legally required for non-essential cookies or similar technologies, we will provide an appropriate consent mechanism.
You can manage your cookie preferences through the cookie controls available on our website.
Please also see our Cookie Policy for further information.
8. Shopify and Our Online Store
Our online store is powered by Shopify.
Shopify provides infrastructure that enables us to operate our online store and process activities associated with customer browsing, accounts, checkout and orders.
Depending on the service and circumstances, Shopify may process personal information on our behalf and may also process certain information as an independent controller for its own purposes.
Shopify states that merchants are generally the controllers of their customers' data and that Shopify may act as a processor where it processes customer data on the merchant's instructions.
Shopify may process or transfer personal information internationally as part of providing its services.
For further information about Shopify's own processing, please consult Shopify's applicable privacy information.
9. Payment Providers
When you make a purchase, payment information is processed through the payment service or services available at checkout.
Payment providers may process information such as:
- Payment information
- Transaction information
- Billing information
- Fraud-prevention information
- Device and transaction information
Payment providers may process information in accordance with their own privacy notices and applicable legal requirements.
Soché does not need to store your complete payment card details in order to process an order.
10. Fulfilment and Delivery Providers
To fulfil and deliver your order, we may share relevant information with third-party fulfilment, warehousing, logistics and delivery providers.
Information shared may include:
- Name
- Delivery address
- Telephone number, where required
- Email address, where required
- Order number
- Products ordered
- Delivery instructions
- Tracking information
These providers use the information necessary to perform the services we have instructed them to provide.
We do not provide fulfilment or delivery providers with personal information that is unnecessary for the relevant service.
11. Other Service Providers
We may use carefully selected third-party service providers to support our operations.
Depending on our actual systems and requirements, these may include providers supporting:
- Website hosting and infrastructure
- E-commerce
- Payment processing
- Fraud prevention
- Order fulfilment
- Delivery
- Customer support
- Email communications
- Marketing
- Analytics
- IT and cybersecurity
- Accounting
- Professional services
- Legal services
- Business administration
Where a provider processes personal information on our behalf, we take appropriate steps to ensure that the processing is governed by appropriate contractual and data-protection arrangements.
12. Information We Do Not Sell
We do not sell your personal information as a commercial product.
We may, however, share information with service providers and other organisations where necessary to operate our business, fulfil orders, provide services, comply with law, protect our interests or otherwise process information on a lawful basis.
13. International Transfers
Some organisations we use may process personal information outside the United Kingdom.
Where personal information is transferred internationally, we will take steps to ensure that the transfer is lawful under applicable UK data protection law.
Depending on the circumstances, this may involve:
- A UK adequacy regulation
- Appropriate contractual safeguards
- The UK's International Data Transfer Agreement
- The UK Addendum to approved contractual clauses
- Other lawful transfer mechanisms or applicable exceptions
The precise transfer mechanism will depend on the service provider, destination and processing arrangement.
14. How Long We Keep Personal Information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:
- Provide services
- Complete transactions
- Maintain appropriate business and accounting records
- Comply with legal and regulatory obligations
- Resolve disputes
- Establish, exercise or defend legal claims
- Prevent fraud and misuse
- Maintain necessary business records
Retention periods vary according to the type of information and purpose.
For example, transaction and financial records may need to be retained for longer than routine website enquiries because of accounting, tax or legal requirements.
When information is no longer required, we will securely delete it, anonymise it or otherwise dispose of it appropriately.
15. Data Security
We take reasonable and appropriate technical and organisational measures to protect personal information against:
- Unauthorised access
- Unauthorised disclosure
- Loss
- Destruction
- Accidental alteration
- Other inappropriate processing
Security measures may include access controls, authentication, secure systems, contractual controls and other safeguards appropriate to the nature of the information and processing.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
16. Data Breaches
If we become aware of a personal data breach, we will assess it and take appropriate action in accordance with applicable data protection law.
Where legally required, we will notify the Information Commissioner's Office and/or affected individuals within the applicable timeframe.
17. Your Data Protection Rights
Subject to applicable legal conditions and exemptions, you may have rights including:
Right of access
You may request a copy of the personal information we hold about you.
Right to rectification
You may ask us to correct inaccurate or incomplete personal information.
Right to erasure
In certain circumstances, you may ask us to delete your personal information.
Right to restrict processing
In certain circumstances, you may ask us to restrict how we process your personal information.
Right to data portability
In certain circumstances, you may request personal information you have provided to us in a structured, commonly used and machine-readable format, or ask us to transmit it to another organisation where technically feasible.
Right to object
You may have the right to object to certain processing, including processing based on legitimate interests.
You have an absolute right to object to direct marketing.
Rights relating to automated decision-making
Where applicable, you may have rights in relation to solely automated decisions that produce legal or similarly significant effects.
18. Exercising Your Rights
To exercise your data protection rights, contact:
Please provide enough information for us to identify you and understand your request.
We may need to request additional information to verify your identity before responding.
We will respond within the timeframe required by applicable data protection law.
In most cases, there is no charge for exercising your rights. However, applicable law may permit us to charge a reasonable fee or refuse a request where a request is manifestly unfounded or excessive.
19. Marketing Preferences
You can change your marketing preferences at any time.
If you no longer wish to receive marketing communications, use the unsubscribe option provided in the relevant communication or contact:
Opting out of marketing does not prevent us from sending transactional or service-related communications necessary to administer an order or customer relationship.
20. Children's Privacy
Our website and products are intended for a general audience and are not directed specifically at children.
We do not knowingly seek to collect personal information from children where doing so would be unlawful.
If you believe a child has provided personal information to us in circumstances where it should not have been collected, please contact us at info@soche.co.uk.
21. Third-Party Websites and Services
Our website may contain links to third-party websites, services or platforms.
Those third parties operate under their own privacy policies and terms.
We are not responsible for the privacy practices of third-party websites or services that we do not control.
We recommend reviewing the relevant privacy notice before providing personal information to a third party.
22. Social Media and External Platforms
Where our website or communications contain links or integrations with social-media or other external platforms, those platforms may collect information in accordance with their own privacy policies.
Your interaction with those platforms is subject to their applicable terms and privacy practices.
23. Business and Wholesale Contacts
If you represent a business and communicate with Soché in a professional capacity, we may process your business contact information for purposes including:
- Responding to enquiries
- Managing commercial relationships
- Preparing quotations
- Negotiating agreements
- Processing orders
- Managing supply relationships
- Providing technical and commercial information
- Managing accounts
- Providing customer support
Where appropriate, we may retain business contact information for legitimate business purposes even where you have opted out of marketing communications.
24. Complaints About Our Use of Personal Information
If you have a concern about how we have handled your personal information, please contact us first:
We will investigate your concern and seek to resolve it appropriately.
You also have the right to complain to the UK's data protection regulator.
Information Commissioner's Office (ICO)
The ICO's website provides information about data protection rights and how to make a complaint.
25. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect:
- Changes to our business
- Changes to our website
- New services or functionality
- Changes to our service providers
- Changes to applicable law
- Changes to how we process personal information
When we make material changes, we will take appropriate steps to bring the changes to your attention.
The “Last updated” date at the beginning of this notice indicates when it was most recently revised.
We recommend checking this page periodically for updates.
26. Contact Us
If you have any questions about this Privacy Notice, your personal information or how we process data, please contact:
Soché
Le Papillon Boutique Ltd
Email: info@soche.co.uk
We will endeavour to respond to privacy enquiries within the timeframe required by applicable law.