1. General Provisions
This Privacy Policy explains how Candlewide (hereinafter “we”) collects, uses, and protects personal data in connection with the use of the website www.candlewide.com (hereinafter “website”) and purchases made through the online store.
We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable laws of the Republic of Estonia.
A data subject (hereinafter “you”) is any natural person who:
- visits the website
- makes a purchase
- creates a user account
- communicates with us via email
2. Data Controller
Candlewide
Candlewide OÜ
Registry code: 17126745
Address: Viljandi county, Viljandi city, Carl Robert Jakobsoni street 52, 71004 Estonia
E-mail: info@candlewide.com
3. Personal Data We Process
We process the following categories of personal data:
3.1 Order and Customer Data
- first and last name
- email address
- phone number
- shipping and billing address
3.2 Account Data
- login credentials
- order history
3.3 Payment Data
Payment-related data is processed by payment service providers.
Candlewide does not store credit card details.
3.4 Communication Data
- email content
- contact details
3.5 Website Usage Data
- IP address
- device and browser information
- data collected via cookies
4. Purposes and Legal Basis of Processing
We process personal data for the following purposes:
4.1 Contract Performance
- processing orders
- handling payments
- delivering goods
4.2 Legal Obligation
- accounting
- compliance with legal requirements
4.3 Legitimate Interest
- customer support
- fraud prevention
- ensuring website functionality
4.4 Consent
- sending marketing communications (via Smaily)
- web analytics (Google Analytics)
- advertising (e.g. Meta Pixel, if used)
You have the right to withdraw your consent at any time.
4.5 Back-in-Stock Notification
If you enter your email address to receive a notification when a product becomes available again, we will use your email address solely for sending that notification.
The legal basis for processing is pre-contractual measures taken at your request.
Your email address will not be used for marketing purposes unless you have given separate consent.
Data is retained for a maximum of 12 months if no notification has been sent.
5. Data Sharing
We may share personal data with the following service providers:
5.1 Payment Services
- EveryPay AS
- PayPal
Payment service providers process payment data as independent data controllers in accordance with their own privacy policies.
5.2 Delivery Partners
- Smartpost Itella
- FedEx
5.3 IT and Service Providers
- Smaily (email marketing)
- Google LLC (analytics)
- Meta Platforms Inc. (advertising, if used)
- hosting and development service providers
6. Data Transfers Outside the EU
Some service providers (e.g. Google, Meta, PayPal) may process data outside the European Union.
In such cases, appropriate safeguards are applied, including Standard Contractual Clauses approved by the European Commission.
7. Data Retention
We retain personal data only as long as necessary:
- accounting data: up to 7 years
- account data: until the account is deleted
- marketing data: until consent is withdrawn
- analytics data: up to 26 months
8. Cookies
We use cookies for website functionality, analytics, and marketing.
Necessary cookies are required for the operation of the website.
Analytical and marketing cookies are used only with your consent.
More information is available in our Cookie Policy.
9. Data Subject Rights
You have the right to:
- obtain information about your data processing
- access your personal data
- request correction of inaccurate data
- request deletion of your data
- restrict processing
- object to processing
- receive your data in a machine-readable format
- withdraw consent
10. Complaints
If you believe your rights have been violated, you have the right to contact the Estonian Data Protection Inspectorate (www.aki.ee) or a court.
11. Security Measures
We implement appropriate technical and organizational measures, including:
- HTTPS encryption
- access restrictions
- secure hosting environment
12. Changes to the Privacy Policy
We may update this Privacy Policy from time to time.
Updates will be published on the website.