Privacy policy

Last updated: 10/10/2026

This Privacy Policy describes how Caribou Candy ("we", "us", or "our") collects, uses, and discloses your personal information when you visit or use cariboucandy.co.uk (the "Site"), make a purchase from us, or otherwise communicate with us (collectively, the "Services"). "You" and "your" means you as the user of the Services, whether a customer, website visitor, or another individual whose information we have collected as described in this Policy.

CattBlack Ltd, trading as Caribou Candy (company number 12408415), is the "data controller" of your personal information for the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018). Our registered office is Unit 7 The Triangle, 95 Commerce Way, Lancing Business Park, Lancing, BN15 8UP, and our trading address is Trafalgar House, Newhaven, BN9 9DD, United Kingdom. You can contact us at privacy@cariboucandy.co.uk.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge the collection, use, and disclosure of your information as described here.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site and update the "Last updated" date above.

What Personal Information We Collect

The personal information we collect about you depends on how you interact with our Site and use our Services.

Information you give us directly may include:

  • Basic contact details: name, address, phone number, email.
  • Order information: name, billing address, shipping address, payment confirmation, email address, phone number.
  • Account information: username, password, security questions.
  • Shopping information: items you view, add to your cart, or add to your wishlist.
  • Customer support information: anything you choose to include when you message us.

Some features of the Services require this information directly from you. You can choose not to provide it, but this may prevent you from using those features.

Information we collect automatically (cookies and similar technologies), including device and browser information, network connection information, your IP address, and how you use our Site — see Cookies below.

Information we obtain from third parties, such as:

  • Companies who support our Site and Services, such as Shopify.
  • Our payment processors, who collect payment information (e.g., card details, billing address) to process your payment and fulfil our contract with you.
  • Analytics and advertising partners, when you interact with our Site, our emails, or our advertisements.

Any information we obtain from third parties is treated in accordance with this Privacy Policy. We're not responsible for the accuracy of information provided to us by third parties, or for their own privacy practices — see Third Party Websites and Links below.

How We Use Your Personal Information, and Our Legal Basis for Doing So

Under UK data protection law, we must have a valid legal basis for each way we use your personal information. Here is how we use your information and the basis we rely on:

  • To provide our Services (legal basis: performance of a contract with you). Processing your payments, fulfilling and shipping your orders, managing returns and exchanges, creating and managing your account, sending order and account-related notifications, and enabling you to post reviews.
  • Marketing and advertising (legal basis: your consent, or our legitimate interests in promoting our business to existing customers). Sending marketing emails, texts or post, and showing you relevant advertising. You can withdraw consent or opt out at any time — see Your Rights and Choices below.
  • Security and fraud prevention (legal basis: legal obligation, and our legitimate interests in keeping the Site and our customers safe). Detecting, investigating and acting on suspected fraudulent, illegal or malicious activity.
  • Customer support and improving our Services (legal basis: our legitimate interests in being responsive to you and maintaining our relationship with you).
  • Complying with our legal obligations (legal basis: legal obligation), such as keeping financial and tax records.

Cookies

Like most websites, we use cookies and similar technologies ("Cookies") on our Site, including:

  • Strictly necessary Cookies — required for the Site and checkout to function (e.g., keeping items in your cart).
  • Analytics Cookies — help us understand how visitors use the Site, so we can improve it.
  • Marketing Cookies — used by us and our advertising partners to show you relevant ads on our Site and elsewhere.

Where required by UK law, we'll ask for your consent before using non-essential Cookies, and you can manage your preferences at any time through the cookie settings on our Site or your browser controls. Blocking Cookies may affect how the Site functions. For more detail on the Cookies used to power our store, see Shopify's Cookie Policy: https://www.shopify.com/legal/cookies.

How We Disclose Personal Information

We may disclose your personal information to third parties for the purposes set out above, including:

  • Vendors and service providers who perform services on our behalf (e.g., IT hosting, payment processing, data analytics, customer support, fulfilment and shipping).
  • Shopify and our other business and marketing partners, who will use your information in accordance with their own privacy notices.
  • Third parties where you have asked or consented to it, such as to ship your order or through social media widgets or login integrations.
  • Our affiliates or wider corporate group.
  • Where necessary to comply with a legal obligation, respond to a court order or similar request, enforce our terms, protect our rights, or as part of a business transaction such as a merger or sale.

We do not sell your personal information, and we do not disclose sensitive personal information for the purposes of inferring characteristics about you.

If you post a product review or other content in a public area of the Services, that content will be public and accessible by anyone. We're not responsible for the privacy or security of information you choose to make public, or for how others may use it.

Third Party Websites and Links

Our Site may link to websites or platforms operated by third parties. If you follow a link to a site we don't control, please review their own privacy and security policies — we're not responsible for the privacy or security practices of third-party sites.

Children's Data

Our Services are not intended for children, and we do not knowingly collect personal information from children under 13. If you're a parent or guardian and believe your child has provided us with personal information, please contact us using the details below so we can delete it.

Security and Retention of Your Information

No security measures are perfect, and we can't guarantee "perfect security" — please avoid sending sensitive information to us through unsecured channels.

We keep your personal information only as long as necessary for the purposes set out in this Policy — for example, to maintain your account, provide the Services, resolve disputes, and meet our legal obligations. This generally means we keep order and financial records for at least 6 years to comply with UK tax law, and account information for as long as your account remains active plus a reasonable period afterwards.

Your Rights and Choices

Under UK data protection law, you have the following rights in relation to your personal information, though they may not apply in every circumstance:

  • Right of access — to ask for a copy of the personal information we hold about you.
  • Right to rectification — to ask us to correct inaccurate or incomplete information.
  • Right to erasure — to ask us to delete your personal information in certain circumstances.
  • Right to restrict processing — to ask us to limit how we use your information.
  • Right to data portability — to receive your information in a portable format, or ask us to transfer it to another organisation, in certain circumstances.
  • Right to object — to object to our processing of your information, including direct marketing, at any time.
  • Right to withdraw consent — where we rely on your consent, you can withdraw it at any time.
  • Managing marketing preferences — you can opt out of marketing emails at any time using the unsubscribe link. You may still receive non-promotional emails, such as those about your account or orders.

To exercise any of these rights, contact us using the details below. We won't discriminate against you for doing so. We may need to verify your identity before responding, and you can authorise someone to act on your behalf provided we can verify this. We'll respond within the timeframes required by law.

Complaints

If you have concerns about how we handle your personal information, please contact us first using the details below so we can try to resolve it. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

International Transfers

We only ship within the UK, but some of our service providers (such as Shopify) may store or process your personal information outside the UK, including in the United States. Where we transfer personal information outside the UK, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transferring only to countries covered by UK adequacy regulations.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you'd like to exercise any of the rights available to you, please email us at privacy@cariboucandy.co.uk or write to us at CattBlack Ltd (trading as Caribou Candy), Trafalgar House, Newhaven, BN9 9DD, United Kingdom.