Legal

Privacy Policy

Last updated: March 2026  ·  Candish Limited, Cambridge, UK
Contents
  1. Who We Are
  2. What We Collect
  3. How We Use Your Data
  4. Lawful Basis
  5. Sharing Your Data
  6. How Long We Keep Data
  7. Your Rights
  8. Cookies
  9. Security
  10. Contact & Complaints
This policy explains how Candish Limited collects, uses and protects your personal data under the UK GDPR and Data Protection Act 2018. We will never sell your personal data.

1 Who We Are

Candish Limited is the data controller for personal data collected through this website. Registered in England and Wales, based in Cambridge, UK.

Data enquiries: info@candishlimited.com

2 What We Collect

  • Account information: Name, email, company name, phone, billing/delivery address.
  • Quote submissions: Product descriptions, design files, images, colours and sizing.
  • Transaction data: Orders, invoices, and payment records (we do not store full card details).
  • Communications: Emails and messages you send to us.
  • Technical data: IP address, browser type, pages visited — collected automatically via cookies.

3 How We Use Your Data

  • To set up and manage your trade account.
  • To process, fulfil and deliver your orders.
  • To send quotes, design proofs, invoices and order updates.
  • To respond to enquiries and provide customer support.
  • To send relevant product information where you have given consent or we have legitimate interest.
  • To improve our website using anonymised analytics.
  • To comply with our legal and financial obligations.

We will never use your data for automated decision-making or profiling with a significant legal effect.

4 Lawful Basis for Processing

  • Contract: Processing necessary to fulfil your order or manage your account.
  • Legitimate interests: Improving services, fraud prevention, and direct marketing to existing customers.
  • Legal obligation: Retaining financial records as required by HMRC and company law.
  • Consent: Marketing to new contacts where no prior relationship exists.

5 Sharing Your Data

We do not sell, rent or trade your data. We share it only where necessary with:

  • Production and factory partners (fulfilment and quality control).
  • Payment processors (secure transaction processing).
  • Delivery and logistics providers (shipping your order).
  • Cloud service providers including Google, Cloudinary, and ShopWired — all under data processing agreements.
  • Professional advisers (accountants, lawyers) under confidentiality obligations.
  • Regulatory authorities where required by law.
Some providers may store data outside the UK. Where this occurs, we ensure appropriate safeguards are in place such as UK adequacy decisions or Standard Contractual Clauses.

6 How Long We Keep Your Data

  • Account data: Active account period plus 2 years after last activity.
  • Order and financial records: 7 years (HMRC requirement).
  • Quote enquiries not resulting in an order: 12 months.
  • Marketing consent records: Until you withdraw consent or opt out.

7 Your Rights

Under UK GDPR you have the following rights:

Right of Access

Request a copy of the personal data we hold about you.

Right to Rectification

Ask us to correct inaccurate or incomplete data.

Right to Erasure

Ask us to delete your data where we no longer have a lawful basis.

Right to Object

Object to processing based on legitimate interests, including direct marketing.

Right to Restriction

Ask us to restrict processing in certain circumstances.

Right to Portability

Receive your data in a structured, machine-readable format.

To exercise any right, email info@candishlimited.com. We will respond within 30 days at no charge.

8 Cookies

  • Essential cookies: Required for login and basket — cannot be disabled.
  • Analytics cookies: Help us understand how visitors use the site (Google Analytics).
  • Marketing cookies: Used to show relevant advertising on other platforms.
  • Personalisation cookies: Remember your preferences between visits.

Manage cookie preferences via the banner on your first visit or through your browser settings.

9 Security

We use SSL/TLS encryption and restrict access to personal data to authorised personnel only. In the event of a notifiable data breach we will inform you and the ICO as required by UK GDPR.

10 Contact & Complaints

Candish Limited · Cambridge, United Kingdom
Email: info@candishlimited.com · Phone: 0800 056 7929

To complain to the regulator: Information Commissioner's Office (ICO)
ico.org.uk  |  0303 123 1113

Questions about your privacy?

We respond to all data enquiries within 30 days.

Get in Touch