Privacy policy

Controller and contact

Updated: 24 October 2026. Candy Mix en Match (CandyMixMatch), Lutuliweg 13, 8161 DN Epe, Netherlands, Chamber of Commerce 80493106, is the controller for the processing described here. Privacy questions and requests: hello@candymixmatch.com. WhatsApp: +31 6 2799 6876.

Information and purposes

For orders and customer service, we process contact, order and delivery details, payment status and information you provide. This is necessary to perform the contract, handle returns and complaints and meet statutory record-keeping duties. Payment providers process the payment details required for your selected method; we do not automatically receive your full card details.

When you use the website, technical information such as IP address, browser, device, pages visited and cookie choices may be processed for operation, security and, where permitted, analytics or marketing. For privacy requests, the privacy app processes information including your email address and IP address for handling and verification. Do not include passwords or payment card details in a request.

Legal bases and marketing

We use an appropriate legal basis for each purpose: performance of a contract, a legal obligation, consent or a legitimate interest, such as security and customer service, after balancing your interests. Using the website alone does not constitute consent.

For newsletters and electronic marketing, we rely on consent or the statutory existing-customer exception for our own similar products, with an easy opt-out. Use the unsubscribe link in a message to opt out. Where consent is required for tracking or targeted advertising, a general legitimate interest does not replace it.

Cookies and privacy choices

Necessary cookies support functions such as the cart and security. For other cookies and similar technologies, we ask for consent where applicable rules require it. The cookie banner lets you accept, reject or manage your preferences. You may withdraw consent through the available cookie preferences. If you cannot find them, contact us. Browser settings offer an additional way to manage cookies. Privacy request pages are for data requests; they do not replace cookie consent.

Recipients and international transfers

Shopify provides the store platform. For payments, delivery, support, privacy requests and, where applicable, analytics or marketing, we use service providers insofar as they are enabled for the function used. We share the necessary information for those purposes. Google Analytics, Shopify marketing functions or Mailchimp may be involved only where actually used and with the required legal basis or consent. See also Shopify's privacy policy.

Providers may process information outside the EEA or United Kingdom. Where needed, we use an applicable adequacy decision, standard contractual clauses and required additional safeguards. You may request information about the recipients and safeguards relevant to your data.

Retention and security

We keep information no longer than needed for its purpose. Core tax records are generally kept for 7 years where Dutch tax retention duties require it. Other order, contact, account and request information is kept as necessary for performance, handling and any legal claims. Cookies have the periods stated in the current cookie information. A deletion request does not override statutory retention duties.

We take appropriate technical and organisational security measures. No security is absolute; report potential misuse or security issues to our contact address.

Your rights and complaints

Depending on applicable law, you have rights of access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Use the privacy app or email us directly; an account is not required to make a request. We verify identity where necessary and normally respond within one month under the GDPR/UK GDPR; we explain any legally permitted extension in good time.

You may complain to the Dutch Autoriteit Persoonsgegevens or your competent supervisory authority; in the United Kingdom, this is the ICO. Regional opt-out rights are provided where the relevant rules apply. The store does not seek to knowingly collect children's information. Contact us if a child has provided information requiring review or deletion.

For relevant changes, we update this notice and provide additional information where needed. The same notice applies through the footer and checkout.

Shopify Network Intelligence

Our store is hosted by Shopify. Shopify processes information when you visit or buy from our store. Shopify Network Intelligence is enabled: Shopify uses customer information together with information from interactions with other stores and Shopify to provide services and improve products, personalisation, security and advertising targeting. Information may be shared with Shopify and service providers in other countries, with applicable safeguards. We request consent for advertising and tracking where required, and you may withdraw it. Read Shopify’s Consumer Privacy Policy and use Shopify’s privacy portal for information on access, deletion, objection and withdrawal of consent for this processing.