Effective Date: 17/03/2025

1. Introduction

Cande Group Ltd (“we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Data Protection Act 2018.

2. Information We Collect

We may collect and process the following types of personal data:

  • Identity Data – Name, job title, date of birth.
  • Contact Data – Address, email, phone number.
  • Financial Data – Payment details, bank information.
  • Technical Data – IP address, browser type, operating system.
  • Usage Data – How you interact with our website or services.
  • Marketing and Communications Data – Preferences for receiving marketing from us.

3. How We Collect Your Data

We collect data in the following ways:

  • Direct interactions (e.g., when you fill out forms, correspond with us, or sign up for services).
  • Automated technologies (e.g., website cookies and analytics tools).
  • Third-party sources (e.g., business partners, public databases, social media platforms).

4. How We Use Your Data

We process your data for the following lawful purposes:

  • To provide and manage our services.
  • To process transactions and payments.
  • To comply with legal obligations.
  • To improve user experience and website performance.
  • To send marketing communications (with your consent).

5. Legal Basis for Processing

We process personal data under the following legal bases:

  • Contractual Necessity – When processing is required to fulfil our contractual obligations.
  • Legitimate Interests – When processing is necessary for our business interests, provided it does not override your rights.
  • Legal Obligation – When processing is required to comply with legal or regulatory requirements.
  • Consent – When you have given explicit permission for specific processing activities.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, including legal, accounting, or reporting requirements. Once no longer needed, data will be securely deleted or anonymised.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, alteration, disclosure, or destruction.

8. Data Sharing and Transfers

We do not sell your data. However, we may share your data with:

  • Service providers who assist in delivering our services.
  • Regulatory authorities where legally required.
  • Business partners where consent has been given.
    If transferring data outside the UK/EU, we ensure safeguards are in place to protect your privacy, such as Standard Contractual Clauses (SCCs).

9. Your Rights Under GDPR

Under UK and EU GDPR, you have the following rights:

  • Right to Access – Request a copy of the personal data we hold.
  • Right to Rectification – Request correction of inaccurate or incomplete data.
  • Right to Erasure – Request deletion of your data under certain circumstances.
  • Right to Restriction – Request temporary suspension of processing.
  • Right to Data Portability – Request a copy of your data in a structured format.
  • Right to Object – Object to processing based on legitimate interests or direct marketing.
  • Right to Withdraw Consent – Where consent is the basis for processing, you can withdraw it at any time.

To exercise your rights, contact us at dpo@candegroup.co.uk.

10. Cookies and Tracking Technologies

Our website may use cookies and similar technologies to enhance user experience. You can manage cookie preferences through your browser settings.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any significant changes will be communicated via our website or direct notification. 

12. Contact Us

If you have any questions regarding this Privacy Policy or how we process your data, please contact us at:
Cande Group Ltd
 Studio 1, Highcross Business Centre, 18 Lancaster Road, Hinckley, LE10 0AW.
dpo@candegroup.co.uk
0116 298 2120

If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local EU data protection authority.

The ICO’s address is:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

This policy ensures compliance with the UK GDPR, EU GDPR, and the Data Protection Act 2018.