Privacy Policy

Effective Date: 30 August 2026

1. Overview & UK GDPR Compliance

Kandy Land is committed to protecting your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

Contact Information: Name, delivery address, billing address, email address, phone number.
Order Details: Items purchased, custom mix notes, transaction history.
Technical Data: IP address, browser type, device information, and site interaction data.

3. How We Use Your Data

Contractual Necessity: Processing payments, packing orders, and shipping items to your address.
Legitimate Interests: Improving site performance, maintaining security, and handling support queries.
Legal Obligation: Retaining transaction logs for UK tax and accounting audits.

Note: We never store payment card details. Payments are processed securely via Stripe.

4. Data Sharing & Third Parties

We share necessary data strictly with trusted operational infrastructure and fulfillment partners:

Stripe: Payment processing, anti-fraud evaluation, and transaction verification.
Royal Mail / Couriers: Physical order dispatch, tracking services, and address delivery.
Cloudflare: Website hosting and security. Cloudflare processes web traffic and retains short-term system logs (including IP address, browser type, and security threat data) for up to 30 days to protect against web attacks.

5. Your Rights Under UK Law

You have the right to access, correct, or request deletion of your personal data. Contact us at [email protected] to make a request.