Privacy Policy
Your trust matters to us. This policy explains what personal information CĀND collects, why we use it, who we share it with and the choices available to you.
Last updated: 9 August 2026
Thoughtful products. Responsible data use.
To process orders, deliver purchases, provide support and keep the website secure.
We share information only with trusted providers and where the law requires it.
You can ask to access, correct, erase or restrict the use of your information.
Who we are
CĀND is operated by Aleksandra Marczak trading as CĀND. For the purposes of UK data protection law, we are the controller of the personal information described in this policy.
72 Collins Road
Bamber Bridge, Preston
PR5 6GU
United Kingdom
Information we collect
Depending on how you use our website or services, we may collect:
Identity and contact details
Your name, billing and delivery address, email address and telephone number.
Order and transaction details
Products ordered, customisation details, order value, payment status, refunds and delivery information.
Account details
Your username, password hash, saved addresses, order history and account preferences.
Gift recipient details
A recipient’s name, delivery address, contact details and gift message where another person places an order for them.
Communications
Messages, enquiries, reviews, complaints and records of our customer-service correspondence.
Technical and usage details
IP address, device and browser information, approximate location, cookie identifiers, pages viewed and website interactions.
Marketing preferences
Your newsletter choices, consent records and whether you have opened or interacted with marketing communications.
Security information
Information used to detect suspicious activity, prevent fraud, protect accounts and keep our website secure.
Payments are processed by independent payment providers. We do not receive or store your complete card number or card security code. We may receive limited information such as payment status, payment method, transaction reference and the last digits of a card.
We do not intentionally collect special-category information, such as information about health, ethnicity, religion or political opinions. Please do not include this type of information in gift messages, order notes or general enquiries unless it is genuinely necessary.
Where your information comes from
- Directly from you when you order, register, contact us, subscribe, leave a review or exercise a legal right.
- From a purchaser when someone sends you a gift or names you as the recipient of an order.
- From payment and delivery providers when they confirm a transaction, delivery event, return or refund.
- Automatically from your device through server logs, cookies and similar technologies when you use the website.
- From publicly available sources where reasonably necessary to prevent fraud, verify information or protect legal rights.
If you provide another person’s information to us, please make sure that you are entitled to do so and that they understand their information will be used to fulfil the order.
How and why we use your information
We use personal information only when we have a lawful basis. The table below explains our main purposes and the bases we normally rely on.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Accept, prepare, personalise and deliver orders | Identity, contact, order, recipient and transaction details | Performance of a contract |
| Take payments, issue refunds and maintain financial records | Identity, contact, order and transaction details | Contract and legal obligation |
| Create and manage customer accounts and welcome offers | Identity, contact, account, order and preference details | Contract and legitimate interests in providing a convenient service |
| Respond to enquiries, reviews, returns, rights requests and complaints | Identity, contact, order and communication details | Contract, legal obligation and legitimate interests in customer care |
| Protect our customers, website and business; prevent fraud and misuse | Identity, transaction, account, technical and security details | Legitimate interests and, where applicable, legal obligation |
| Operate, troubleshoot and improve the website and customer experience | Technical, usage and communication details | Legitimate interests; consent where required for cookies or similar technologies |
| Send newsletters, offers and product updates | Identity, contact, marketing preferences and engagement details | Consent or, where legally permitted, legitimate interests under the soft opt-in rules |
| Establish, exercise or defend legal claims and comply with authorities | Any information relevant to the matter | Legal obligation and legitimate interests in protecting legal rights |
Where we rely on legitimate interests, we consider whether the use is necessary, proportionate and consistent with what you would reasonably expect. You may object to processing based on legitimate interests; see “Your rights” below.
Who we share information with
We do not sell or rent personal information. We may share only what is reasonably necessary with:
- Payment providers, which may include Stripe, PayPal and Klarna. Card and wallet payments may include Apple Pay or other methods supported by the selected provider.
- Delivery and fulfilment providers, including Sendcloud and the carrier selected for the order, which may include InPost UK, Royal Mail, DPD, Evri or Yodel.
- Website, hosting and technology providers that help us operate WordPress, WooCommerce, Elementor, email, backups, security, analytics and customer communications.
- Professional advisers, including accountants, insurers, legal advisers and IT specialists, where they need the information to provide their services.
- Public bodies and regulators, such as HM Revenue & Customs, courts, law enforcement or the Information Commissioner’s Office, where disclosure is required or permitted by law.
- A purchaser or successor in connection with a genuine sale, transfer or restructuring of all or part of the business, subject to appropriate confidentiality safeguards.
Some providers act as our processors and must use information only on our instructions. Others, particularly payment providers and carriers, may act as independent controllers for parts of their service and provide their own privacy information.
International transfers
Some technology, payment, communications or delivery providers may process personal information outside the United Kingdom. Where this happens, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard recognised by UK data protection law. We also consider whether additional technical or contractual protections are appropriate.
International deliveries require information to be shared with overseas carriers and, where applicable, customs and tax authorities in the destination country.
How long we keep information
We keep personal information only for as long as needed for the purpose for which it was collected, including legal, accounting, tax, fraud-prevention and dispute-resolution requirements.
For the period required by tax and accounting law, generally at least five years after the relevant tax-return deadline.
While the account remains active and for a reasonable period afterwards, unless related order records must be kept longer.
Normally for up to two years after the matter is closed, or longer where a dispute or legal claim requires it.
Until you unsubscribe or withdraw consent. We may retain a minimal suppression record so that we respect your choice.
For the lifetime stated in our cookie controls or for the shorter period reasonably needed for security and diagnostics.
For as long as reasonably needed to investigate the matter and establish, exercise or defend legal rights.
At the end of the relevant period, information is securely deleted or anonymised unless we are legally required to keep it for longer. We review retention periods when our systems, services or legal obligations change.
Cookies and similar technologies
Our website uses cookies and similar technologies. Some are strictly necessary for the website to function, for example to operate the basket, checkout, account login, security features and cookie-preference controls.
Where consent is required, optional cookies are not placed until you choose to accept them. You can reject optional cookies or change your choices using the cookie settings control displayed on the website. Withdrawing consent does not affect processing that occurred before withdrawal.
You can also control cookies through your browser, although blocking strictly necessary cookies may prevent the basket, checkout or account features from working correctly.
Marketing and offers
If you ask to receive news and offers, we may send you email marketing about CĀND products, launches and occasions. We may also contact existing customers about similar products where the law permits this and an opt-out was offered when the details were collected.
Creating an account, placing an order or receiving a welcome discount does not automatically require you to accept unrelated marketing. You can unsubscribe at any time using the link in a marketing email or by contacting contact@cand.uk. Service messages about orders, payments, deliveries, security or policy changes are not marketing.
We do not sell your details to third parties for their own marketing.
Your data protection rights
Depending on the circumstances, you may have the right to:
CĀND does not currently make decisions about customers based solely on automated processing that produce legal or similarly significant effects.
To exercise a right, email contact@cand.uk. Please describe your request clearly. We may ask for information needed to confirm your identity and protect your data. Rights are not absolute, and we will explain if a lawful exemption applies.
How we protect information
We use proportionate technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration or disclosure. These measures may include encrypted connections, access controls, secure payment providers, software updates, backups, account protection and limiting access to people who need the information for their work.
No online service can guarantee absolute security. If we identify a personal-data breach, we will investigate it and notify affected people and the ICO where the law requires us to do so.
Children’s information
Our website and products are not directed at children, and we do not knowingly collect personal information from children for marketing or account purposes. If you believe a child has provided information to us without appropriate authorisation, please contact us so that we can review and, where appropriate, delete it.
How to make a complaint
If you are concerned about how we use personal information, please email contact@cand.uk with the subject “Data Protection Complaint”, or write to the postal address above.
We will acknowledge a data protection complaint within 30 days of receiving it. Without undue delay, we will take appropriate steps to investigate, keep you informed where necessary and explain the outcome.
You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113 ·
Make a complaint to the ICO
Changes to this policy
We may update this policy when our services, providers or legal obligations change. The latest version will be published on this page with a new “Last updated” date. If a change materially affects how we use personal information, we will provide an additional notice where appropriate.
We encourage you to review this page from time to time.
We are here to help.
Contact us if you have a privacy question, wish to exercise a right or want to make a complaint.