Privacy Policy

1. Purpose and scope

This privacy policy sets out how Candyspace Media Limited ("Candyspace," "we," "us," or "our") collects, uses, processes, and safeguards your personal information across our digital products, services, websites, and business operations. As a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Candyspace is committed to protecting your privacy rights and ensuring all personal data is handled lawfully, fairly, and transparently.

This policy applies to visitors to our website, clients, business partners, job applicants, and any individuals whose personal data we collect in the course of operating our digital agency business.

This privacy notice was last updated in November 2026. We may update this policy from time to time, and any changes will be published on this page. You should check this page occasionally to ensure that you understand any changes.

2. What personal data do we collect?

We may collect the following categories of personal data:

 

  • Name

  • Email address

  • Telephone number

  • IP address (a unique identifier for your computer or other device)

  • Mobile device ID

3. How is personal data collected?

We obtain personal data from the following sources:

 

  • Direct interactions with individuals.

  • Publicly available business information.

  • LinkedIn and other professional networking platforms.

  • Business directories.

  • Third-party data providers.

  • Referrals and introductions.

 

Where we obtain personal information from publicly available sources, professional networking platforms, business directories, referrals, or third-party data providers, this may include professional contact details, job titles, employer information, professional background, and other business-related information.

 

We use this information for the following purposes:

 

  • To provide you with information that you have requested (e.g., a newsletter, invitations to Candyspace events)

  • To support your applications to Candyspace if you have applied for one of our career opportunities.

  • To respond to specific queries you may raise.

  • To provide you with better ways of accessing information from this website.

  • To improve our products and services.

  • We may also periodically send promotional emails about new products, services, or other information, which we think you may find interesting, using the email address that you have provided.

 

4. Purpose of processing and the lawful bases

We process personal data for a number of specified business purposes and ensure that we have an appropriate lawful basis for doing so under applicable data protection laws (including UK GDPR and Data Protection Act 2018).

 

Depending on the circumstances, we may process your personal information on the following lawful bases:

 

  • Consent: Where you have given us permission to use your personal information for a specific purpose, such as receiving certain types of marketing communications.

  • Contract: Where processing is necessary to enter into or fulfill a contract with you, or to take steps at your request before entering into a contract.

  • Legal obligation: Where we need to process your personal information to comply with a legal or regulatory obligation.

  • Legitimate interests: Where processing is necessary for our legitimate business interests, provided that these interests are not overridden by your interests, fundamental rights, or freedoms.

 

5. Legitimate interests and business development

We may process personal information based on our legitimate interests in developing and promoting our business, identifying potential customers, and establishing commercial partnerships.

 

This may include using business contact information, such as names, job titles, business email addresses, and business telephone numbers, to identify and contact individuals working for organisations that we believe may be interested in our services.

 

For example, we may use personal information to:

  • Identify prospective clients and relevant business contacts.

  • Contact businesses and individuals to introduce our services and discuss potential business opportunities.

  • Undertake business development and sales activities, including making direct telephone calls

  • Send relevant business-related communications where permitted by applicable law.

  • Maintain and manage our relationships with existing and prospective clients.

 

In some circumstances, we may obtain business contact information from publicly available sources, professional networking platforms, business directories, or third-party data providers.

 

We consider our use of this information to be a proportionate way of identifying relevant business contacts and developing commercial relationships. We take appropriate steps to ensure that our processing does not unnecessarily interfere with individuals' privacy rights and interests.

 

Where we rely on legitimate interests, we assess the potential impact on individuals and consider their reasonable expectations, the nature of the information being used, and the safeguards available to protect their personal information.

 

We undertake direct marketing in accordance with applicable data protection and electronic marketing legislation, including the Privacy and Electronic Communications Regulations (PECR).

Right to Object: You have the right to object to the processing of your personal information for direct marketing purposes at any time. If you object, we will immediately stop using your personal information for direct marketing. You can exercise this right by contacting us directly at hello@candyspace.com or by using the unsubscribe link provided in our marketing email communications.

 

6. Information we collect from job applicants

We collect personal information that you share with us when you register, contact us, or interact with us through our website, email, phone, or otherwise. You can decide not to provide certain information or ask that any information you have previously shared be removed. If you do so, you may not be able to take full advantage of a career at Candyspace and progress an application.

 

For example, you may provide information to us when you contact us about an opportunity to work at Candyspace, upload a CV or resume, or provide other career information.

 

To apply for a role listed on our website, we require users to register and to provide us with basic contact information. Through these interactions you may share with us your name, address, e-mail address, postal address, contact number, and career history (usually in the form of a CV), as well as any other personally identifiable information you include in your interactions with Candyspace. We may also ask for additional information, including carrying out background verification, to assist us with our recruitment process and in the event you are offered a job.

 

7. How do we share and disclose your personal data?

We may share your personal information with other group companies, affiliates, and third-party service providers where necessary to support our business operations and the purposes set out in this policy.

 

These providers may include CRM and marketing automation platforms, website hosting providers, analytics providers, recruitment platforms, IT service providers, and professional advisers.

 

Where third parties process personal information on our behalf, they are required to protect the information, maintain its confidentiality, and only process it in accordance with our instructions and applicable data protection legislation.

 

Some third parties may process personal information as independent data controllers. Where this is the case, their own privacy policies and data protection obligations will apply.

 

  • We may send your personal information to other group companies, affiliates, and third parties to help us process your personal information for the purposes set out in this policy. They only have access to the personal information they need to perform those services. They are required to keep your personal information confidential and may not use it other than as we ask them to and always in accordance with this privacy policy. 

  • We may disclose personal information to third parties when we reasonably believe we are required by law and in order to investigate, prevent, or take action regarding suspected or actual unlawful or otherwise prohibited activities, including, but not limited to, fraud.

  • If our business (or any part of it) is sold or transferred at any time, the personal data we hold may form part of the assets transferred, although it will still only be used in accordance with this policy. Furthermore, in the event that we sell or buy any business or assets, we may disclose your personal data to the prospective buyer or seller of such business or assets. We will ensure that the third parties who receive your personal information are required to keep it confidential.

 

Other than as set out above, we will not pass your personal data to a third party company for any secondary or unrelated purposes without your prior consent.

 

8. How do we keep your personal data secure?

We are committed to safeguarding the personal information in our custody, whether collected directly from you, generated through your use of our services, or lawfully obtained from public directories, third-party data providers, and professional platforms such as LinkedIn.

 

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, unlawful processing, accidental loss, destruction, or damage.

 

Our security architecture includes:

  • Enterprise Cloud Infrastructure: Our primary Customer Relationship Management (CRM) and marketing systems are hosted via HubSpot, which maintains rigorous, industry-recognised security standards, including SOC 2 Type II compliance and ISO 27001 certification.

  • Encryption: Data stored within our CRM is encrypted both in transit (using TLS 1.2 or higher) and at rest (using AES-256 bit encryption).

  • Access Controls: Access to personal data is restricted on a strict "need-to-know" basis to authorised Candyspace personnel, protected by multi-factor authentication (MFA) and role-based permissions.

  • Vendor Due Diligence: We review the security postures of all third-party software vendors and data processors prior to onboarding to ensure they meet UK GDPR standards.

 

While we apply appropriate technical and organisational measures to protect your information, no transmission over the internet or electronic storage system can be guaranteed to be completely secure.

 

We maintain incident response procedures to investigate and manage personal data breaches, mitigate any potential impact, and notify affected individuals and the Information Commissioner's Office where required by applicable data protection legislation.

 

9. How long do we store your personal data?

We only retain personal information for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting or reporting requirements.

 

The length of time we retain personal information will depend on the nature of the information, the purpose for which it was collected, and our ongoing business or legal requirements.

 

We periodically review the personal information we hold and securely delete information when it is no longer required.

 

Where we process personal information for business development and marketing purposes, we will periodically review whether the information remains relevant and necessary. We will delete information when it is no longer required.

 

10. International data transfers

As a global company working with international partners and modern cloud-based infrastructure, we may transfer, store, or process your personal information outside the United Kingdom (UK).

 

Where we transfer personal information outside the UK, we will ensure that appropriate safeguards are in place in accordance with applicable data protection legislation.

 

These safeguards may include:

 

  • Transfers to countries that have been recognised by the UK government as providing an adequate level of data protection.

  • Transfers to organisations covered by an applicable UK adequacy arrangement, including the UK-US Data Bridge, where the recipient is appropriately certified.

  • The use of approved contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's Standard Contractual Clauses.

 

11. Do we process your personal data for automated individual decision-making?

We do not use your personal data to make decisions with legal or similarly significant effects for you based solely on automated processing. Should Candyspace introduce automated decision-making processes in the future, we will notify you beforehand and provide details regarding your rights to object to or opt out of such processing.

 

12. External website links

By accessing third-party websites through our site, you are consenting to the terms and privacy policies of those websites. We do not accept any responsibility or liability for their privacy practices or the content of such websites.

 

13. Users under age 13

Our website and services are intended primarily for business users and are not directed at children under the age of 13.

 

We do not knowingly collect personal information from children under the age of 13. If we become aware that we have collected such information without appropriate authorisation, we will take steps to delete it.

 

If you are under 13 years old and wish to ask a question or use this site in any way that requires you to submit your personal information, please ask your parent or guardian to do so on your behalf.

 

14. What rights do you have?

Under data protection laws, you may have the following rights in relation to your personal information:

 

  • Right of access: You have the right to request a copy of the personal information we hold about you.

  • Right to rectification: You have the right to ask us to correct inaccurate or incomplete personal information.

  • Right to erasure: You may have the right to ask us to delete your personal information in certain circumstances.

  • Right to restrict processing: You may have the right to ask us to restrict the processing of your personal information in certain circumstances.

  • Right to data portability: Where applicable, you may have the right to receive personal information you have provided to us in a structured, commonly used, and machine-readable format, or request that it be transferred to another organisation.

  • Right to object: You have the right to object to the processing of your personal information for direct marketing purposes at any time. If you object, we will immediately stop using your personal information for direct marketing. You can exercise this right by contacting us directly or by using the unsubscribe link provided in our marketing email communications. We will retain limited information on a suppression list to ensure that we respect your preferences and do not contact you again for marketing purposes.

  • Rights relating to automated decision-making: You have rights in relation to certain decisions made solely by automated means, where applicable.

  • Right to withdraw consent: Where we rely on your consent to process personal information, you can withdraw that consent at any time.

  • Right to Opt-Out of Sale/Sharing: While CandySpace will not use your data for any other purpose than mentioned here or sell your data, you can opt-out of sale or sharing of your personal data shared with CandySpace for processing.

 

You can exercise your rights by contacting us using the details provided in this policy. We may need to verify your identity before responding to your request.

 

We will normally respond within one month of receiving your request, although this period may be extended where permitted by applicable data protection legislation.

 

15. How to exercise your rights and contact information

Candyspace is the data controller for any information collected through this website or provided when contacting us directly.

 

Our full legal name is Candyspace Media Limited. We are a private limited company incorporated in England and Wales. Our registered company number is 05132736, and our registered address is Candyspace Media Ltd, Chancery House, 53–64 Chancery Lane, London, WC2A 1QS.

 

If you have any questions or concerns about how we process your personal information, wish to exercise your data protection rights or would like to make a complaint, you can contact us at hello@candyspace.com.

 

We take privacy concerns seriously and aim to acknowledge complaints promptly. We will investigate and respond to complaints in accordance with applicable data protection legislation.

 

Your Right to Complain to the Regulator

If you have a complaint or an issue with how we have collected or are processing your personal information, you have the right to contact your supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO).

 

Information Commissioner’s Office (ICO) 

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

Website: https://ico.org.uk/make-a-complaint/ 

Telephone: 0303 123 1113

 

16. Changes to the policy

This policy is effective as of the approved date. We reserve the right to update or change this policy at any time, and we will provide you with the updated policy when we make any substantial updates at the earliest either through email or by providing a prominent policy of change on the website. You should check the policy periodically. 


Cookie Policy


We use cookies and similar tracking technologies on our website to support website functionality, understand how visitors interact with our website, and improve the services we provide.


Strictly necessary cookies may be used where required to operate our website and provide the services you request. Non-essential cookies and similar tracking technologies, including analytics cookies, are only activated where you have provided your consent.


You can manage non-essential cookies through the cookie settings pop-up banner when you first visit our website.


1. Introduction

This cookie policy sets out how Candyspace uses cookies and similar tracking technologies on our website.


2. Purpose

The purpose of this policy is to inform you about how and why we use cookies and other technologies to enhance your experience when visiting our website.


3. Scope

This policy applies to all individuals visiting our website properties and to all personal data or online identifiers collected by means of cookies and online tracking technologies.


4. What is a cookie?

Cookies are small text files stored on your computer, smartphone, or other device when you visit a website.


They allow websites to recognise your device, remember certain preferences, and understand how visitors interact with the website.


Cookies may be set by the website you are visiting (first-party cookies) or by third-party services operating on that website (third-party cookies).


Cookies may also be:
Persistent cookies: These remain on your device for a specified period of time or until you delete them.
Session cookies: These are temporary cookies that generally expire when you close your browser.


5. Types of cookies

Cookies can be categorised by their function, origin, and duration, including first-party and third-party cookies, session cookies, and persistent cookies.


6. Information collected and our purpose for using cookies and other technologies

Cookies and similar technologies may be used for the following purposes:

 

  1. Strictly necessary cookies
    These cookies are essential for the operation of our website and enable core functionality, such as security and basic website navigation. They do not require consent where they are strictly necessary to provide a service you have requested.

  2. Performance and analytics cookies
    These cookies help us understand how visitors use our website, including which pages are visited and how visitors navigate between them. We use this information to assess website performance and improve the visitor experience.

  3. Functionality cookies
    These cookies allow our website to remember choices and preferences, helping to provide enhanced functionality and a more personalised experience.

  4. Targeting or advertising cookies
    These cookies may be used to track browsing activity and deliver advertising that is more relevant to visitors and their interests.


We will only use the cookie categories that are actually deployed on our website. Non-essential cookies and similar technologies will only be activated where you have provided the necessary consent.

 

7. Analytics tools

We use third-party analytics tools, including Google Analytics 4 (GA4) and HubSpot, to monitor, measure, and analyse traffic and usage patterns across our website.

 

8. Cookies deployed

Analytics & performance cookies used:

 

Google Analytics 4

Candyspace uses Google Analytics 4 (GA4) to help us understand how visitors interact with our website and evaluate website performance.

 

Google Analytics uses cookies, including _ga and ga<container-id>, to distinguish visitors and collect information about website usage. This may include information about pages visited, referring websites, session activity, language settings, and devices used to access the website.

 

We use this information to analyse website performance and improve the visitor experience. Google Analytics cookies are only activated where you have accepted performance and analytics cookies through our Cookie Settings Banner.

 

Google may process information collected through its services in accordance with its own privacy policy.

 

HubSpot

Candyspace uses HubSpot to support our customer relationship management, marketing, and website analytics activities.

 

HubSpot may use tracking cookies to help us understand how visitors interact with our website. These include:

 

__hstc: Used to track visitors and maintain information about their website activity.

__hssc: Used to track sessions and maintain session-related information.

__hssrc: Used to identify when a visitor's browser session has restarted.

 

The expiry periods of these cookies may vary depending on their configuration.

 

HubSpot may process information collected through its services on our behalf in accordance with applicable data protection requirements.

 

Where HubSpot cookies or other tracking technologies are non-essential, they will only be activated where you have provided the necessary consent through our Cookie Settings Banner.

 

9. Controlling cookies

When you first visit our website, you are presented with our cookie settings pop-up banner, allowing you to manage non-essential cookies.

 

You can update your preferences or withdraw your consent at any time:

 

  • By clearing the cookies stored in your web browser (which resets your site preferences and displays the consent banner on your next visit).

  • By adjusting your web browser settings to block or delete cookies entirely (refer to your browser's "Help" documentation or visit allaboutcookies.org for step-by-step guidance).

 

By deleting our cookies or disabling future cookies, you may not be able to access certain areas or features of our website.

 

10. Privacy rights and who to contact

For details on your data protection rights or to raise questions regarding this policy, please refer to Section 14 and Section 15 of our main Privacy Policy or contact us at hello@candyspace.com

 

11. Changes to the policy

We reserve the right to update or modify this policy at any time. Any material revisions will be reflected on this page or communicated via website announcements.