Privacy Policy

1. Who we are

This Privacy Policy applies to Cozycandleao, based at 26 Leadmill Rd, Sheffield City Centre, Sheffield S1 4SD, United Kingdom. When this Policy refers to "we", "us" or "our", it refers to Cozycandleao as the controller of your personal data.

If you have any questions about this Policy, you can contact us using the details on our contact page.

2. Applicable law

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together referred to as "data protection law". If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the ICO (Information Commissioner's Office), the UK's independent authority set up to uphold information rights.

3. Personal data we collect

The personal data we may collect and process includes:

• Contact details such as your name, email address and telephone number.
• Information about your property relevant to blinds and curtains, such as room types, approximate window sizes and photographs you choose to share.
• Records of communications, including enquiries sent through our website, by phone or by post.
• Technical data about your visit to our website, such as IP address, browser type, pages visited and time spent, where this is collected through cookies or similar technologies. Further information is provided in our Cookies Policy.

4. How we obtain your data

We collect data directly from you when you:

• Submit an enquiry form on our website.
• Contact us by phone, email or post.
• Meet us in person, for example during a home visit or at our premises.

We may also receive technical data about how you use our site from analytics tools or service providers, where configured.

5. Purposes and legal bases for processing

We process your personal data for the following purposes and on the following legal bases under data protection law:

• Responding to enquiries and providing quotations. When you contact us, we process your data to respond, answer questions and provide quotations. The legal basis is Article 6(1)(b) GDPR (processing necessary to take steps at your request prior to entering into a contract).
• Providing our services and managing our relationship with you. If you proceed with an order, we process your data to schedule visits, measure, supply and fit blinds and curtains, invoice you and handle aftercare. The legal basis is Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (our legitimate interest in running our business and maintaining accurate records).
• Operating and improving our website. We may process technical data to operate the site securely and to understand how it is used. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in maintaining and improving our website and services).
• Legal and regulatory obligations. We may process your data to comply with legal and tax obligations. The legal basis is Article 6(1)(c) GDPR (compliance with a legal obligation).

6. Sharing your personal data

We may share your personal data with:

• Trusted service providers who support our business, such as IT and website hosting providers, email service providers, professional advisers and, where relevant, delivery or fitting partners.
• Public authorities or regulators where we are required to do so by law.

Where we use processors, we ensure appropriate contracts are in place, as required by Article 28 GDPR, to protect your data.

7. International transfers

Our core operations are based in the United Kingdom. If any of our service providers transfer personal data outside the UK, we will ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses approved under UK GDPR.

8. Data retention

We keep your personal data only for as long as necessary for the purposes set out in this Policy and to meet legal, accounting or reporting requirements. In general:

• Enquiry records are kept for up to two years after our last contact, unless you become a customer.
• Customer records and invoices are retained for at least six years to comply with tax and accounting rules.

When data is no longer required, we will delete it securely or anonymise it.

9. Your data protection rights

Under data protection law, you have rights in relation to your personal data, subject to certain conditions and exceptions. These include the right to:

• Access your personal data and receive a copy.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data where there is no good reason for us to continue processing it.
• Object to processing carried out on the basis of our legitimate interests.
• Request restriction of processing in certain circumstances.
• Request transfer of your data to another controller where technically feasible (data portability).

You also have the right to withdraw consent where we rely on consent as our legal basis. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

10. How to exercise your rights

If you would like to exercise any of your rights, please contact us using the details on our contact page. We may need to verify your identity before acting on your request. We aim to respond within one month, in line with GDPR.

11. Complaints

If you are concerned about how we handle your personal data, we would encourage you to contact us first so that we can try to resolve the issue. You also have the right to lodge a complaint with the ICO (Information Commissioner's Office), the UK's independent authority set up to uphold information rights, at any time. Up-to-date contact details are available on the ICO's website at ico.org.uk.

12. Cookies and similar technologies

Our website may use cookies and similar technologies to function correctly and to help us understand how visitors use the site. For more information on the types of cookies we use, the purposes for which we use them and how you can manage your preferences, please see our Cookies Policy.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies or legal obligations. The updated Policy will be posted on this page with a revised “last updated” date.

Last updated: 15 December 2025.