Terms and privacy

The Christmas Hot Chocolate Trail is run by Andrew Carter, trading as The Christmas Hot Chocolate Trail, of Suite A, 82 James Carter Road, Mildenhall, IP28 7DE. You can reach us at hello@hotchocolatetrail.co.uk.

Each venue on the trail is an independent business. They are not our agents and we do not run them.

Anyone can walk the trail. You do not need an account, and we do not ask for your name.

If you are under 18 you can collect stamps like anyone else. You cannot buy alcoholic drinks, and any drink on the trail containing alcohol is marked as such.

A stamp requires you to buy one of that venue's listed trail drinks, at that venue, on the day you claim it. Staff will give you the day's code when you buy.

You can collect one stamp per venue for the season. Collecting a second at the same venue does nothing — it is not an error, there is simply nothing more to collect there.

The code changes daily and is for paying customers. Please do not pass it on or post it anywhere; a venue whose code circulates has to have it changed, which is a nuisance for their staff on a busy day.

We may cancel stamps where there is good reason to think they were not earned by a purchase. We would rather absorb the odd honest mistake than turn away someone who paid, so this is used sparingly.

Badges are digital: a badge on your passport, a card you can share, and your name on the roll of honour if you finish. They have no cash value and cannot be transferred or exchanged for anything.

There is no draw, no prize and no element of chance anywhere on this trail. Every badge is earned by collecting stamps and is guaranteed once you have them.

The number of stamps needed to complete the trail is worked out from the venues taking part on the day you claim. If a venue leaves partway through the season, stamps you already collected there still count and you are never moved backwards. A badge, once earned, is never taken away.

Stamps belong to this season and do not carry over to a future one.

We cannot promise a venue will be open when you get there, or that a particular drink will be available. Venues set their own hours and run out of things. Where a venue has told us its hours we show them, and where it has not we show nothing rather than guess — a wrong 'open' sends you out in the cold for nothing.

Drink descriptions, prices and allergen information come from each venue and are their responsibility.

Each drink's listing shows what the venue has told us it contains from the 14 allergens UK law requires food businesses to declare. Anything it may contain because of how it is made — a shared steam wand or blender, for instance — is shown separately as "may contain", with any notes from the venue beside it.

If a listing shows no allergens, that does not mean the drink contains none. Some listings were written before we asked the question this way, and it is always worth asking.

If you have an allergy or intolerance, tell staff before you order, every time. Recipes, suppliers and what is in the jug on the day can change, and the venue's staff are the ones who know what is in your cup.

Nothing here limits our liability for death or personal injury caused by our negligence, for fraud, or for anything else the law does not allow us to limit.

Beyond that, this is a free walking trail and we are not liable for indirect losses — a wasted journey, a missed badge, a venue that turned out to be shut.

Anything you buy is a contract between you and that venue. Complaints about a drink, service or an allergen belong with them, though we would like to hear about it too.

These terms are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.

By accepting these terms you confirm you are authorised to agree to them on behalf of the venue — that you are the owner or manager, or that whoever is has asked you to.

That matters more than it sounds. This agreement includes a promise about the accuracy of your allergen information, and that is not something to accept on somebody else's behalf without asking them.

Nothing, for the 2026 season. There is no fee, no commission and no charge of any kind for taking part this year.

This is the trail's first year and it is free while it proves itself. A future season may carry a participation fee — if it does, we will set it out in full before asking you whether you want to take part again, and it will never apply to a season you have already joined.

We do not ask for exclusivity. You are free to run your own promotions, join other trails, and to leave.

You choose at sign-up whether you are on the trail for the full season or for December only.

You can upgrade from December-only to the full season at any time, from your own management page. You cannot downgrade after 1 December — by then the trail has been promoted with you on it and visitors are planning routes around it.

You can withdraw at any time by telling us. We will take you off the public trail promptly. Stamps visitors already collected at your venue continue to count towards their badges, and your name stays in the season's archive.

Display the QR table cards and the window sticker we send you, somewhere a customer can see them.

Give the day's code to customers who buy one of your listed trail drinks, and not publish it anywhere — not on social media, not on a chalkboard visible from the street. The code is the only thing connecting a stamp to a purchase.

Honour a stamp for anyone who has bought a qualifying drink.

Keep your listing roughly true. If your hours change, or a drink comes off, update it from your management page — that takes effect immediately and needs nothing from us.

You confirm that the allergen and ingredient information you give us for each drink is accurate: which of the 14 allergens UK food law requires to be declared it contains, anything it may contain through cross-contact, and any notes that go with them. You will tell us promptly if a recipe, a supplier or the way you make it changes.

Being on the trail does not change your own legal duties as a food business. You must still be able to give accurate allergen information for everything you serve, whether in writing or by a notice telling customers to ask staff. If you sell a trail drink or kit pre-packed on the premises, it needs a full ingredients label with the allergens emphasised. And "gluten-free" is a legal claim: only describe a drink that way if it meets the legal limit.

We publish your information as you supply it. We cannot check it, and we do not change it. If someone is harmed because the information you gave was wrong, that is your responsibility and you agree to cover us against claims arising from it.

This is the firmest clause in this document and it is deliberate. Every drink on the trail carries its allergen line wherever it appears, with a note telling people to speak to your staff before ordering.

Our allergen guide for venues explains all of this in plain terms, with a chart to fill in and keep at the counter and the sign to display.

Read the allergen guide for venues

You keep ownership of everything you give us. Nothing here transfers copyright.

You grant us a non-exclusive, royalty-free licence to use the images, drink descriptions and venue details you supply, to promote the trail — in print, on the website, and on social media.

That licence runs for this season and continues afterwards for archive material: the season's pages stay readable, and past years get referred to when recruiting for the next one.

You confirm you have the right to give us these images — that you took them, or that whoever did has agreed. If you send us a photographer's work without their permission, that is a problem you would be asked to resolve.

We may crop, resize and re-encode images to fit a page or a poster. We will not alter them in a way that misrepresents your venue or your drinks.

If you want an image taken down, ask. We will remove it from anything we control. We cannot recall something already printed.

Pledging is optional, it was optional when you signed up, and declining changed nothing about your place on the trail. This clause only applies if you chose to pledge. If you did not, skip it.

If you did, the amount you chose is recorded against your listing and you agree to pay it to Norfolk Community Foundation (registered charity 1110817) within 30 days of the season ending.

A per-stamp pledge is counted per stamp, not per drink sold. A stamp is one visitor's first visit to your venue on the trail — so a table of four buying four drinks is one stamp, and somebody returning a second time is not another one. It is a smaller number than your till will show, deliberately: it is the only figure we can count exactly.

We will tell you what it comes to in January, worked out from the stamps actually collected at your venue, before anything is due.

You pay them directly. No money passes through us at any point — we do not collect it, we do not hold it, and we cannot claim Gift Aid on your behalf. That means we also cannot enforce this beyond telling you what you pledged and asking you to honour it.

We may publish what the trail raised in total. We will not publish what any individual venue gave.

You get your own management page for the season, and a report in January covering your stamp count and how your drinks were rated.

We keep your contact details to run the trail and to ask whether you would like to take part again. We do not sell them, and we do not pass them to other venues.

Reporting to partners, including the Business Improvement District, is aggregate — visitor numbers, patterns across the city. It never identifies an individual visitor.

We review every listing and every photograph before it appears. We may ask for changes, or decline a listing, and we will tell you why.

We may remove content that is inaccurate, unlawful, or that we judge unsuitable for a family audience.

We will do our best to keep the trail running and your listing correct, but we cannot promise the website will always be available, or guarantee any level of visitors.

Since the trail is free to you, our liability to you is limited to putting the listing right. We are not liable for lost trade.

Nothing here limits liability for death or personal injury caused by our negligence, or for fraud.

This agreement is governed by the law of England and Wales.

Andrew Carter, trading as The Christmas Hot Chocolate Trail, of Suite A, 82 James Carter Road, Mildenhall, IP28 7DE is the data controller. Write to us at privacy@hotchocolatetrail.co.uk, or at the address above.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk.

We do not know who you are. There is no account, no sign-up and no email address. Your passport lives on your own device, and the trail holds only an anonymous identifier for it — a random string, with no name, address or contact details attached.

That has a consequence worth understanding before you start: if you lose your phone, or clear your browser data, your stamps are gone and we cannot restore them. There is nothing linking that passport to you, which is exactly what keeps it private.

We record, against that anonymous identifier: which venues you collected a stamp at and when, which drinks you marked as favourites, the badges you have earned, and any of the optional questions you chose to answer.

When you earn a badge we record which badge it was, and the venue and the date that earned it, against the same anonymous identifier.

Nothing new is collected to do that — it is worked out from stamps we already hold. We keep it so a badge can tell you exactly why you earned it, rather than leaving you to guess.

We also count how many passports hold each badge, so the trail can say how rare one is. That is a total across everybody, and it is not shown at all until at least a hundred passports exist — a percentage of three people describes three people.

If your phone offers us your location when you claim a stamp, we use it once, in the moment, to check you are near the venue — and then we throw it away. We record only whether the check passed.

We do not store coordinates. We never have. There is no column in our database that could hold one, so there is no record of where you were standing or of the route you walked.

Your stamps do record which venues you visited and when, so the order you visited them in can be worked out from them. That is a list of venues, not a trail of locations, and it is only ever reported as totals across everyone.

Refusing the location prompt does not stop you collecting a stamp, and is not treated as suspicious. In a stone building in December it usually fails anyway.

After a stamp we sometimes ask one question — whether this was your first visit to that venue, how you heard about the trail, roughly where you live, and who you are walking with.

Answering is optional and skipping is offered as prominently as answering. If you skip, we do not ask again.

'Roughly where you live' is three broad options, not a postcode. We use these to report to our partners how many visitors the trail brought into the city, always as totals and never as anything traceable to one person.

Before the full sign-up form opened we invited venues to leave three things — the name of the business, your name and an email address — so we could tell them when it did. If you did that, those three things are all we hold.

We use them for exactly one message, and we do not pass them to anybody. Our basis is our legitimate interest in recruiting venues to a trail you asked to hear about.

Once that message has gone the record has done its job. Ask us to delete it at any point, before or after, and we will — one reply is enough.

We hold what you gave us at sign-up: your venue's details, your name, your email address and phone number, and the drinks and photographs you supplied.

We use them to run the trail, publish your listing, send you your management link and season updates, and to ask whether you would like to take part next year.

Our basis for this is our legitimate interest in operating a trail you asked to join. If you would rather we did not contact you about future seasons, say so and we will stop.

When someone types a venue's daily code, we record whether it worked. If a code is guessed wrongly too many times in a row we pause that person for a few minutes, which is what stops the four-digit code being guessed by a script.

To do that we have to recognise a repeat attempt without knowing who is making it, so we store a one-way scrambled version of the network address rather than the address itself. It cannot be turned back into an address.

This is our legitimate interest in preventing abuse. These records are kept only as long as needed for that purpose.

Our website and database are hosted by Vercel and Supabase, who process data on our behalf and only on our instructions. Email is sent through Resend. Images are stored with Vercel.

We report to the Business Improvement District and our charity partner in totals only — how many visitors, how many stamps, and patterns across the city centre, such as which venues people tend to visit one after another. Never an individual.

We do not sell anything to anybody, and there is no advertising on the trail.

We do not use advertising or tracking cookies, and there is no cookie banner because there is nothing to consent to.

Your device stores your passport so it survives closing the tab. That is on your device, not ours, and clearing it removes your stamps.

Venue details are kept while you take part and afterwards, so a returning venue does not start from scratch, and so the season's archive stays readable.

Anonymous passport records are kept for the season's archive. As they identify nobody, they are not personal data in any useful sense.

Abuse-prevention records are kept only as long as they are needed to do that job.

You can ask what we hold about you, ask us to correct or delete it, object to how we use it, or ask for a copy. Email privacy@hotchocolatetrail.co.uk and we will respond within a month.

For visitors there is an honest catch: we cannot find your records, because they are not linked to you. If you send us your passport identifier we can act on that specific passport.