Privacy policy
Version: Draft v1 · Last updated: 6 September 2026
Data controller: [Legal entity name and form] trading as Candy Doodle ("we", "us", "our")
Registered address: [registered address]
Email: info@candydoodle.co.uk · Website: https://candydoodle.co.uk
This privacy policy explains how Candy Doodle collects, uses, stores and protects personal data when you visit our website, submit an enquiry, book an Event, order Products, or interact with us as a Venue partner. We process personal data in accordance with UK GDPR and the Data Protection Act 2018.
1. Who we are
Candy Doodle provides live sugar-printing activity hire and personalised sugar treats across the United Kingdom. We operate a desktop sugar printer with a heated nozzle at parties, play centres, school fairs, corporate events, weddings and markets, and supply made-to-order sugar confectionery.
For data protection queries, contact our data protection contact at info@candydoodle.co.uk.
ICO registration: We are [registered / not yet registered — confirm via ICO self-assessment] with the Information Commissioner's Office. Our registration number is [ICO registration number — placeholder]. You can check registrations at https://ico.org.uk/ESDWebPages/Search.
2. Scope of this policy
This policy applies to personal data we collect through:
- our website at https://candydoodle.co.uk;
- enquiry and contact forms on the website;
- email, telephone and social media correspondence;
- event bookings, venue partnerships and personalised orders;
- on-site activity at Events (limited data — see section 8).
It does not cover third-party websites we link to (for example social media platforms). Those sites have their own privacy policies.
3. What personal data we collect
We collect only data that is adequate, relevant and limited to what is necessary for the purposes described below.
3.1 Data collection summary
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email address, telephone number | You (enquiry form, email, phone, booking form) |
| Event and order details | Event type, preferred date, venue town or postcode, approximate guest numbers, dietary or allergy notes, delivery address | You (enquiry form, booking correspondence) |
| Booking and transaction | Booking reference, deposit and payment status [payment processor — placeholder], invoice details | You and our records |
| Venue partnership | Venue name, contact person, site address, authorised Operator names | Venue (contract and onboarding) |
| Communications | Messages you send us, our replies, complaint records | You and our staff |
| Technical and security | Hashed IP address, referring page URL, browser type (where logged by our host), form submission timestamp | Automatically when you use the enquiry form |
| Marketing preferences | Whether you have opted in to marketing emails | You (only if you opt in) |
| Photography and filming | Images or video of Equipment and sugar art; images of children only with written parental consent | Us (at Events, with consent) |
| Children's data at Events | First names and ages of participating children (where needed for the activity); allergy information provided by parents or hosts | Host, parent or guardian (not collected via the website) |
We do not knowingly collect personal data from children under 13 through our website. If you believe a child has submitted data via the website, contact us and we will delete it promptly.
4. How we collect data — enquiry form processing chain
When you submit our website enquiry form, the following processing chain applies:
- You complete the form on https://candydoodle.co.uk with your name, email, phone (optional), event details and message.
- The form is submitted securely (HTTPS) to a Codex Services API endpoint that handles form processing on our behalf.
- Codex Services applies technical controls including: hashing of your IP address (we do not store raw IP addresses in our enquiry records), a rate limit of five submissions per minute per source to prevent abuse, and validation of required fields.
- Codex Services forwards the enquiry content to info@candydoodle.co.uk via our email system.
- We read and respond to your enquiry, and retain the record in accordance with our retention schedule (section 7).
Codex Services acts as our processor for website hosting and form handling. A [Data Processing Agreement — placeholder] is in place. Codex Services hosts via Vercel [region — e.g. London (lhr1) — placeholder].
We do not use the enquiry form for automated decision-making or profiling.
5. Purposes and lawful bases
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) | |
|---|---|---|---|
| Respond to enquiries and provide quotes | Contact details, event details, message | Contract (steps prior to contract, Art. 6(1)(b)) and Legitimate interests (running and promoting our business, Art. 6(1)(f)) | |
| Manage Event bookings and Products orders | Contact details, booking and order data, payment records | Contract (Art. 6(1)(b)) | |
| Operate Venue partnerships | Venue contact data, authorised Operator names, commercial records | Contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f)) | |
| Website security, spam prevention and abuse detection | Hashed IP, page metadata, submission timestamps | Legitimate interests (security of our systems, Art. 6(1)(f)) | |
| Legal, regulatory and accounting records | Transaction and correspondence data | Legal obligation (Art. 6(1)(c)) and Legitimate interests (Art. 6(1)(f)) | |
| Marketing emails or newsletters | Email address, preferences | Consent (Art. 6(1)(a)) | only where you have opted in |
| Photography of Equipment and sugar art for marketing | Images without identifiable children | Legitimate interests (promoting our services, Art. 6(1)(f)) | you may opt out before an Event |
| Photography of identifiable children | Images of children | Consent (Art. 6(1)(a)) | written parental consent per child |
Where we rely on legitimate interests, you have the right to object (section 8). We balance our interests against your rights and will explain our assessment on request.
We do not send marketing emails without your consent. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
6. Recipients and processors
We do not sell your personal data. We share data only as described below.
| Recipient | Role | Location / notes | |
|---|---|---|---|
| Codex Services | Website hosting, enquiry form API, form-to-email relay | UK/EU via Vercel [region placeholder]; processor under [DPA in place] | |
| [Email provider — placeholder] | Sending and receiving email at info@candydoodle.co.uk | [UK/EU — placeholder] | |
| Vercel | Cloud hosting infrastructure (via Codex Services) | [Region placeholder — confirm deployment region] | |
| jsDelivr (cdn.jsdelivr.net) | Content delivery network | loads a script when you visit our site | Global CDN; may process IP address in server logs. jsDelivr does not set cookies on our site but connection data may be logged |
| Professional advisers | Accountants, solicitors, insurers | UK, on confidentiality terms | |
| Authorities | Police, courts, regulators | Where required by law |
jsDelivr disclosure: Our website loads assets via jsDelivr. This involves your browser making a request to jsDelivr's servers, which may log technical connection data including your IP address. We do not control jsDelivr's logging practices. See jsDelivr's privacy documentation for details.
7. International transfers
Our processors aim to store and process data in the UK or EEA. Where personal data is transferred outside the UK to a country without an adequacy decision, we ensure appropriate safeguards are in place, such as:
- the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses; or
- transfer to a country covered by UK adequacy regulations.
[Confirm specific transfer mechanisms with each processor — placeholder.] Contact us if you would like a copy of relevant safeguard documents.
8. Retention
We keep personal data only as long as necessary for the purposes for which it was collected.
| Data type | Retention period | Reason |
|---|---|---|
| Enquiry records (no booking made) | [e.g. 24 months] from last contact | Respond to follow-up; business records |
| Event and Products booking records | [e.g. 6 years] from end of financial year | HMRC and legal requirements |
| Venue partnership records | Duration of contract plus [e.g. 6 years] | Contractual and legal obligations |
| Marketing consent records | Until consent withdrawn, plus [e.g. 6 years] for evidence | Demonstrate valid consent |
| Security logs (hashed IP) | [e.g. 90 days] | Abuse prevention |
| Children's images (with consent) | As stated in consent form or until consent withdrawn | Marketing use only with consent |
| Complaint records | [e.g. 3 years] from resolution | Quality and legal defence |
When data is no longer needed, we securely delete or anonymise it.
9. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — request deletion in certain circumstances (for example where data is no longer necessary or you withdraw consent).
- Right to restrict processing — request that we limit how we use your data in certain circumstances.
- Right to data portability — receive your data in a structured, machine-readable format where processing is based on consent or contract and is automated.
- Right to object — object to processing based on legitimate interests, including direct marketing.
- Rights related to automated decision-making — we do not use automated decision-making or profiling that produces legal or similarly significant effects (see section 11).
- Right to withdraw consent — where processing is based on consent, you may withdraw at any time.
How to exercise your rights: Email info@candydoodle.co.uk with the subject line "Data protection request". We may need to verify your identity. We will respond within one month of receiving a valid request. That period may be extended by two further months for complex requests; we will tell you if so.
We do not charge a fee unless a request is manifestly unfounded or excessive.
Right to complain: If you are unhappy with how we handle your data, contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk/make-a-complaint/
- Telephone: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
10. Children's data
10.1 Website
We do not knowingly collect personal data from children under 13 via our website. Our enquiry form is intended for adults making bookings on behalf of families, schools or organisations. If you believe a child under 13 has submitted data through the website, contact info@candydoodle.co.uk and we will delete it.
10.2 Events and activities
At Events, children participate in the sugar-printing activity under supervision. We do not collect children's contact details directly from children. Where a Venue or Client passes us children's first names, ages or allergy information for operational purposes, that data is handled under our contract with the Venue or Client, who remain responsible for obtaining any necessary parental authority.
10.3 Photography and filming
We may photograph the Equipment and finished sugar art for marketing. We will not photograph identifiable children at an Event without written parental consent for each child. We will never publish images of children on our website, social media or marketing materials without that written consent. You may opt out of all photography when booking.
11. Automated decision-making and profiling
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Enquiry form submissions are reviewed by a person before we respond.
12. Security measures
We implement appropriate technical and organisational measures to protect personal data, including:
- HTTPS encryption for data transmitted via our website;
- access controls limiting staff access to personal data on a need-to-know basis;
- hashed IP storage (not raw IP) for enquiry security logs;
- rate limiting on the enquiry form (five submissions per minute);
- processor due diligence and [Data Processing Agreements — placeholder] with Codex Services and other processors;
- secure email practices and password policies for business accounts;
- staff awareness of data protection principles.
No method of transmission or storage is completely secure. We cannot guarantee absolute security but we review our measures regularly.
13. Cookies and similar technologies
We do not use analytics or advertising cookies. We may use localStorage for interface preferences (for example reduced-motion settings). A third-party script is loaded from jsDelivr — see section 6.
For full details, see our Cookie Policy at https://candydoodle.co.uk [cookie policy page — placeholder path].
14. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top will change when we do. Material changes will be highlighted on our website where practicable. We encourage you to review this policy periodically.
15. Contact
Data controller: [Legal entity name and form] trading as Candy Doodle
Email: info@candydoodle.co.uk
Address: [registered address]
Website: https://candydoodle.co.uk