Privacy Policy

Information You Give Us

We collect information when you place an order, create an account, contact us, submit a review or join the Candy Club:

• Identity and contact details: Name, email address, telephone number and account details
• Order and delivery details: Billing and shipping addresses, products ordered, order history and delivery instructions
• Payment-related details: Payment status and limited transaction information; full card details are handled by our payment providers
• Communications: Support messages, return requests, complaints, reviews and survey responses
• Marketing preferences: Newsletter subscription, consent and unsubscribe choices

Information Collected Through the Storefront

• IP address, browser, device and operating-system information
• Pages viewed, links selected, referring pages and approximate location derived from IP address
• Shopping-cart activity, checkout events and security or fraud signals
• Cookie identifiers and similar technologies described below

Information from Other Sources

We may receive order, payment, delivery, analytics or fraud-prevention information from Shopify, payment providers, carriers and other service providers used to operate the store.

We use personal information only when we have an appropriate lawful basis.

To Perform Our Contract with You

• Take payment and process your order
• Arrange delivery and provide tracking
• Manage accounts, returns, refunds and customer support
• Send essential order and service communications

For Our Legitimate Interests

• Operate, secure and improve the website
• Prevent fraud, misuse and payment disputes
• Understand store performance and customer service needs
• Protect our business and establish or defend legal claims

We balance these interests against your rights and expectations before relying on them.

With Your Consent

• Send optional marketing communications
• Use non-essential cookies or similar technologies where consent is required

You may withdraw consent at any time without affecting earlier lawful processing.

To Meet Legal Obligations

We may keep transaction records, respond to lawful requests and take steps required by consumer, accounting, data-protection or other applicable law.

We use reasonable organisational and technical measures designed to protect personal information. These include encrypted website connections, access controls, trusted payment processing, account authentication and limiting access to people or providers who need information for an authorised purpose.

Shopify and other service providers maintain their own security controls for the systems they operate. Full payment-card details are processed by authorised payment providers rather than stored directly by Velvet Candies.

We share personal information only when needed to operate the store, provide a requested service, meet legal obligations or protect legitimate interests.

Categories of Recipients

• Shopify: Storefront hosting, checkout and ecommerce services
• Payment providers: Payment authorisation, refunds and fraud prevention
• Warehousing and delivery providers: Packing, shipping, tracking and delivery support
• Email and customer-support providers: Service messages, support and consented marketing
• Analytics, security and advertising providers: Store performance, security and optional personalised advertising where permitted
• Professional advisers and authorities: Legal, accounting, insurance, regulatory or law-enforcement purposes where justified

Sale or Restructuring

Information may be transferred as part of a genuine sale, merger, restructuring or transfer of business assets, subject to appropriate confidentiality and legal safeguards.

Cookies and similar technologies help the store function and, where permitted, help us understand performance and provide relevant marketing.

• Essential cookies: Required for security, cart, checkout, account and core storefront functions
• Preference cookies: Remember choices such as location or storefront preferences
• Analytics cookies: Help us understand visits and improve the site
• Marketing cookies: Measure campaigns and support relevant advertising

Your Choices

Where required, non-essential cookies are used only after the appropriate consent. You can use the store's cookie controls and your browser settings to change choices or delete cookies. Blocking essential cookies may prevent parts of checkout or account functionality from working.

We send Candy Club and promotional emails when you have consented or when another lawful basis permits them.

How to Stop Marketing

• Select the unsubscribe link in any promotional email
• Use any available preference controls
• Email support@velvetcandies.com with the subject “Marketing Opt-Out”

Unsubscribing from marketing does not stop essential messages about orders, refunds, account security or service changes.

Depending on where you live and the lawful basis used, you may have the right to:

• Be informed about how your information is used
• Request access to personal information
• Correct incomplete or inaccurate information
• Request deletion in applicable circumstances
• Restrict or object to certain processing
• Receive certain information in a portable format
• Withdraw consent at any time where processing relies on consent
• Object to direct marketing
• Complain to an appropriate data-protection regulator

Some rights are subject to legal conditions and exemptions. We may need to verify your identity before completing a request.

Our store is intended for customers who can lawfully enter into a purchase contract. It is not directed at children, and we do not knowingly use children's personal information for targeted marketing.

If you are a parent or guardian and believe a child has supplied personal information without appropriate permission, contact support@velvetcandies.com so we can investigate and take appropriate action.

Shopify and other providers may process personal information outside the country where you live. When data-protection law requires safeguards for an international transfer, we rely on an applicable adequacy decision, approved contractual protections or another lawful transfer mechanism.

Contact us if you would like more information about the safeguards relevant to your personal information.

We keep personal information only for as long as reasonably needed for the purpose collected, including fulfilling orders, maintaining accounts, handling support and complaints, preventing fraud, meeting accounting or legal duties and establishing or defending claims.

The period varies by record type and is determined by the nature of the information, the customer relationship, legal limitation periods, security needs and mandatory record-keeping requirements. When information is no longer needed, it is deleted or anonymised where reasonably possible.

We may update this policy when our services, providers or legal obligations change. The current version will be published on this page with a revised “Last Updated” date.

Where a change materially affects how we use personal information, we will provide an additional notice or request consent when required.

If you believe Velvet Candies has handled your personal information incorrectly, email support@velvetcandies.com with the subject “Data Protection Complaint”. Include your name, contact details, a clear description of the concern, relevant dates and any supporting information.

We will acknowledge a data-protection complaint within 30 days, make appropriate enquiries without undue delay, keep you informed where the investigation continues and explain the outcome.

If you remain dissatisfied, you may complain to the UK Information Commissioner's Office or the data-protection authority responsible for your location.