Privacy Statement
Privacy Policy for Classic Candle Company Ltd
Last Updated: July 2026
This Privacy Policy explains how Classic Candle Company Ltd collects, uses, stores, and protects your personal data when you visit our website or use our services. It applies to all users of the Website and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Classic Candle Company Ltd is the data controller for any personal data collected through this Website. This means we are responsible for deciding how and why your personal data is used.
Company details
Classic Candle Company Ltd
Address Seven Acres Business Park, IP12 4PS
www.ClassicCandle.com
ICO registration number : ZA207764
Data Protection Officer contact privacy @ classiccandle.com
If you have any questions about this policy, please contact us at the email address above or via our website contact form.
2. What Personal Data We Collect
We may collect the following types of personal data:
– Identity Data: Name, gender, job title, profession.
– Contact Data: Email address, telephone number, billing and delivery address, post code.
– Financial Data: Credit/debit card numbers (processed by our payment providers only—we do not store these).
– Transaction Data: Details of products you have purchased from us.
– Technical Data: IP address, browser type and version, operating system, device information.
– Usage Data: Information about how you use our Website, including pages visited, time spent, referring site URLs, and exit pages.
– Marketing and Communications Data: Your preferences for receiving marketing communications.
We do not routinely collect any “special category” data (e.g., health information, racial or ethnic origin, political opinions, religious beliefs). If we ever need to, we will obtain your explicit consent first.
3. How We Collect Your Data
We collect personal data in the following ways:
Directly from you when you:
– Create an account on our Website.
– Place an order.
– Subscribe to our newsletter.
– Fill in a contact or enquiry form.
– Participate in a survey or provide feedback.
– Correspond with us by phone, email, or post.
Automatically when you visit our Website, through cookies and similar technologies. This includes Technical Data and Usage Data. For more details, see our Cookie Policy (Section 14).
From third-party sources including:
– Payment providers (Stripe, PayPal, Revolut) for transaction processing.
– Analytics providers (such as Google Analytics) for website usage information.
4. How We Use Your Data and Our Lawful Bases
Under UK GDPR, we must have a valid lawful basis for each type of processing we carry out. The table below explains how and why we use your data.
Purpose Data Types Used Lawful Basis
To process and fulfil your orders, including payment processing and delivery. Identity, Contact, Financial, Transaction Contract (Article 6(1)(b)): Processing is necessary for the performance of the contract with you.
To manage your account and provide customer support. Identity, Contact Contract (Article 6(1)(b))
To improve our products, services, and Website experience. Usage, Technical Legitimate Interest (Article 6(1)(f)): We have a legitimate interest in understanding how our Website is used to enhance our offering.
To send you marketing communications (with your consent). Identity, Contact, Marketing Preferences Consent (Article 6(1)(a)): You can withdraw this consent at any time (see Section 11).
To comply with legal obligations, including tax and accounting requirements. Identity, Contact, Transaction, Financial Legal Obligation (Article 6(1)(c))
To detect and prevent fraud. Identity, Contact, Financial, Technical, Transaction Legitimate Interest (Article 6(1)(f) and recognised legitimate interest under DUAA 2025 for crime prevention).
5. Sharing Your Data with Third Parties
We do not sell your personal data to third parties. However, we may share your data with the following categories of recipients for legitimate business purposes:
– Payment Processors: Stripe, PayPal, and Revolut. These providers process your payment details on our behalf. They do not store your payment data with us; transactions are handled on their secure platforms.
– Delivery and Fulfilment Partners: To ship your orders.
– Analytics Providers: Google Analytics, to help us understand Website usage (see Section 15 on international transfers).
– IT and Service Providers: Companies that provide website hosting, maintenance, and other technical services.
– Professional Advisers: Auditors, lawyers, and insurers, where necessary.
– Regulatory Authorities: Where we are required by law to do so.
We only share data that is necessary for the specific purpose and require all third parties to protect your data in accordance with data protection laws.
6. International Data Transfers
Some third-party services we use, such as Google Analytics, Stripe, PayPal, and Revolut, may transfer and store your personal data outside the United Kingdom—for example, in the United States.
When we transfer your data internationally, we ensure appropriate safeguards are in place to protect it. These may include:
– The UK-US Data Privacy Framework (for transfers to certified US companies).
– Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) with the receiving party.
– Technical measures such as encryption and pseudonymisation.
If you would like more information about the safeguards used, please contact us at the email address above.
7. Data Security
We take the security of your personal data seriously. We have implemented appropriate technical and organisational measures to protect your data against accidental loss, unauthorised access, alteration, or disclosure. These include:
– Encryption of data during transmission over the internet.
– Restricted access to personal data—only authorised staff who need it for their role can access it.
– Secure storage systems and regular security reviews.
– Procedures to deal with any suspected personal data breach.
8. Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for legal, accounting, or reporting requirements.
Data Type Retention Period
Account and order data Retained while your account is active and for 6 years after your last transaction for tax and accounting purposes.
Marketing data Retained until you unsubscribe or withdraw your consent.
Usage and analytics data Retained as set by Google Analytics (see our Cookie Policy for details).
Enquiry data Retained for up to 12 months after the enquiry is resolved.
At the end of the retention period, your data will be securely deleted or anonymised so it can no longer be linked to you.
9. Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right to be informed : You have the right to clear information about how we use your data—this Privacy Policy fulfils that right.
Right of access : You can request a copy of the personal data we hold about you, free of charge.
Right to rectification : You can ask us to correct inaccurate or incomplete data we hold about you.
Right to erasure : You can request that we delete your personal data, subject to certain conditions (e.g., we may need to retain it for legal obligations).
Right to restrict processing : You can ask us to limit how we use your data in certain circumstances.
Right to data portability : You can request a copy of your data in a machine-readable format to transfer to another service.
Right to object : You have an absolute right to object to the processing of your data for direct marketing purposes. You may also object to processing based on legitimate interests.
Right to withdraw consent : Where we rely on your consent (e.g., for marketing emails), you can withdraw it at any time.
Right to lodge a complaint : You have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we handle your data. The ICO’s contact details are at [www.ico.org.uk](https://www.ico.org.uk).
To exercise any of these rights, please contact us using the details in Section 1. We will respond within one month. Complaints sent directly to us will be acknowledged and handled in accordance with our complaints procedure.
10. Marketing Communications
We may use your contact information to send you marketing emails and promotional materials about our products and services. We will only do so if:
– You have given us your consent to receive such communications; or
– You are a trade customer and the marketing relates to similar products to those you have previously purchased from us.
You can opt out of receiving marketing communications at any time by:
– Clicking the unsubscribe link in any marketing email.
– Contacting us directly using the details in Section 1.
11. Cookies
Our Website uses cookies to improve your experience and help us understand how our site is used.
What are cookies? Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work more efficiently, as well as to provide information to the owners of the site.
Types of cookies we use:
– Strictly Necessary Cookies: Essential for the Website to function (e.g., enabling you to add items to your basket). These do not require your consent.
– Analytics/Performance Cookies: We use Google Analytics to collect information about how visitors use our Website. This helps us improve our site. These cookies are only placed with your consent.
– Marketing Cookies: If you consent, we may use cookies to deliver targeted advertising on social media platforms such as Meta (Facebook) and Instagram.
Your Cookie Choices: When you first visit our Website, you will see a cookie banner asking for your consent to set non-essential cookies. You can:
– Accept all non-essential cookies.
– Reject non-essential cookies.
– Manage your preferences at any time through our cookie preference centre.
You can also control cookies through your browser settings. Most browsers allow you to refuse or delete all cookies. However, if you block strictly necessary cookies, some parts of the Website may not function properly.
12. Links to Other Websites
Our Website may contain links to third-party websites (including social media platforms). We have no control over these websites and are not responsible for their content or privacy practices. This Privacy Policy does not apply to those websites. We recommend that you read the privacy policy of any third-party website you visit.
13. Changes to Business Ownership
If Classic Candle Company Ltd is sold, merged, or undergoes a similar business restructuring, your personal data may be transferred as part of that transaction. We will take steps to ensure your privacy is protected. In the event of such a transfer, you will be notified and given the opportunity to have your data deleted or withheld from the new owner (subject to any legal obligations).
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page and, where appropriate, notified to you by email. Please check this page regularly to ensure you are aware of the latest version.
15. Contact Us and Complaints
If you have any questions, concerns, or complaints about this Privacy Policy or our data handling practices, please contact us:
Classic Candle Company Ltd
Seven Acres Business Park, IP12 4PS
Email: privacy @ classiccandle.com
If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) :
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: [www.ico.org.uk](https://www.ico.org.uk)
Helpline: 0303 123 1113
16. Children
Our Website is not intended for children under the age of 16, and we do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will take steps to delete that information.
