Privacy policy

Last updated: 11 October 2026

This policy explains what personal data Super Duper Candle Company collects, why, who it's shared with, how long it's kept and what your rights are. It covers our shop at superdupercandlecompany.com and our other websites, superdupergroup.co.uk and cardcompany.superdupergroup.co.uk.

Who we are

Super Duper Candle Company is a trading name of Elliot Petrosellini-Lancaster, a sole trader based in the UK. He is the controller of your personal data, which means he decides how and why it's used. "We" and "us" in this policy mean him.

For anything about your personal data, email privacy@petromedia.co.uk.

Our shop is closed at the moment. We still hold records of past orders, customer accounts and our mailing list, and this policy explains how we look after them.

The short version

  • We use your details to take, deliver and support your orders, and to keep the records the law requires.
  • Our shop runs on Shopify. Card payments are handled by Shopify Payments or PayPal. We never see your full card number.
  • We only send you marketing emails if you've said yes, and every email has an unsubscribe link.
  • Google's tag (Google Analytics and Google Ads) runs as soon as a page of our shop loads. Other analytics and advertising tools wait until you accept them in our cookie banner. See "Cookies and similar technologies" below, including how to opt out of Google's.
  • We don't sell your data.
  • You can ask for a copy of your data, or ask us to correct or delete it.

What we collect, why, and our lawful basis

UK data protection law says we need a lawful basis for each use of your data. Ours are: contract (we need it to sell and deliver what you ordered), legitimate interests (we have a fair reason that doesn't override your rights; you can object), consent (you said yes and can change your mind at any time) and legal obligation (the law makes us keep it).

Orders and delivery

  • What: your name, email address, phone number, billing and delivery addresses, what you ordered, discount codes used, any notes you add, and payment details (handled by our payment providers, see below).
  • Why: to take payment, send order confirmations and delivery updates, deliver your order and deal with any problem or refund. Basis: contract.
  • Records: we keep order and payment records for tax and accounting. Basis: legal obligation.
  • Delivery: we give your name, delivery address and, where the courier needs them for delivery updates, your email address or phone number to the courier you chose at checkout. Our delivery partners are Royal Mail, Parcelforce, DHL and Evri (formerly Hermes).
  • Fraud checks: Shopify checks orders for signs of fraud using details such as your IP address and the order details. If an order is flagged, we look at it ourselves before deciding what to do. Basis: legitimate interests (protecting you and us from fraud).

Payments

  • Card, Apple Pay, Google Pay and Shop Pay payments are handled by Shopify Payments, which uses Stripe to process them. If you pay with PayPal, PayPal handles your payment.
  • We see only the type of card, the last four digits and the expiry date, never your full card number.
  • Stripe and PayPal also use your details for their own fraud checks and legal duties, and for that they are controllers in their own right. If you use Shop Pay, Shopify is the controller of your Shop Pay account. Their own privacy policies apply.
  • Basis: contract.

Your CandleClub account

  • What: if you create an account, your name, email address, password (stored scrambled by Shopify, so we can't see it), saved addresses, phone number if you add it, and your order history.
  • Why: so you can check out faster, see past orders and manage your details. Basis: contract.

CandleClub rewards

  • If you join our CandleClub rewards and referral scheme, it's run for us by Smile.io.
  • What: your name, email address, the points you've earned and spent, the orders that earned them, and who you referred or who referred you.
  • Why: to run the scheme you joined. Basis: contract.

Marketing emails

  • What: your email address, your name if you give it, when and where you signed up, and whether you open or click our emails.
  • Why: to tell you about new candles, offers and when the shop re-opens. Basis: consent. We only add you if you ticked a box or signed up yourself, for example in the "Sign up and save" form, at checkout or in the "notify me when we re-open" form.
  • Every email has an unsubscribe link, or you can email privacy@petromedia.co.uk. Unsubscribing doesn't affect emails about an order you've placed.
  • We send these emails with Mailchimp or Shopify Email. Both tell us whether an email was opened or a link clicked, so we can see what people find interesting and stop emailing people who have lost interest.

Back-in-stock alerts

  • If you ask us to tell you when a product is back in stock, we use an app in our Shopify shop to do it.
  • What: the email address (or mobile number, if you choose a text message) you give us, and the product you're waiting for.
  • Why: to tell you once when that product is back. Basis: consent (you asked us to).
  • The form also has a separate box to join our newsletter. We only add you to our marketing list if that box is ticked when you send the form.

Reviews

  • If we invite you to review us, Trustpilot emails you the invitation a few days after your order arrives. To do this we give Trustpilot your name, email address and order number. Basis: legitimate interests (hearing what customers think and showing honest reviews). You can opt out using the link in the invitation or by emailing us.
  • If you write a review, it's published on Trustpilot under Trustpilot's own terms and privacy policy, and Trustpilot is the controller of it.

Messages, live chat and damage claims

  • What: what you tell us when you email us, use our contact form or chat with us: usually your name, email address, order number and message.
  • Live chat: if you use our live chat, it's provided by Chatra. It stores an identifier in your browser so your conversation carries on as you move between pages.
  • Damage claims: if an order arrives damaged, we ask for photos of the item and its packaging, including the outside of the delivery box. That photo may show your delivery label.
  • Why: to answer you and sort out any problem. Basis: contract where it's about an order, otherwise legitimate interests (answering people who contact us).

Our other websites

superdupergroup.co.uk has a contact form, and cardcompany.superdupergroup.co.uk has a form to hear when Super Duper Card Company opens. Both sites are built with Carrd, which passes what you type in the form to us. Basis: legitimate interests for the contact form (answering you), and consent for the Card Company mailing list.

Both sites load fonts from Google, and an old Google Analytics script. That script no longer collects analytics data, but when it loads, Google receives your IP address and browser details, as it does for any file your browser downloads from Google.

Cookies and similar technologies

Cookies are small files saved in your browser. Some are needed for the shop to work: they remember your basket, your currency and country, that you're logged in, and your cookie choice. These are always on.

Google's tag also runs on every page without waiting for your choice (see "Google Analytics and Google Ads" below). Shopify's own analytics and marketing cookies, and the other analytics and advertising tools in our shop, are only used if you accept them in the cookie banner. You can change your mind at any time: clear this site's cookies in your browser and the banner will ask you again.

Type Who What it does
Essential (always on) Shopify Runs the basket, checkout, login, currency and your cookie choice (for example _shopify_essential, cart, localization, _tracking_consent).
Google tag (runs when the page loads) Google Google Analytics and Google Ads: counts visits, shows us which pages and products people look at, and measures whether our Google ads and free listings lead to sales (for example _ga, _gcl_au).
Analytics (with consent) Shopify Counts visits and shows us which pages and products people look at (for example _shopify_analytics).
Marketing (with consent) Shopify, Meta (Facebook and Instagram), Mailchimp, and Microsoft (Bing) if we advertise there Measures whether our ads and emails lead to sales, and lets these companies show our ads to people who have visited our shop (for example _shopify_marketing, _fbp, _uetsid).

Shopify publishes the full list of its own cookies at shopify.com/legal/cookies.

Google Analytics and Google Ads

Our shop uses Google's tag, through Shopify's Google & YouTube app, for Google Analytics, Google Ads and Google Merchant Center. It doesn't wait for your answer to the cookie banner: it runs as soon as a page loads.

  • What it collects: the pages you view, the products you look at, add to your basket or buy (with the order value), how you reached our shop (for example from a Google ad or search), your device and browser, and your approximate location worked out from your IP address. Google receives your IP address and sets cookies such as _ga (up to 2 years) and _gcl_au (90 days).
  • Why: to see how the shop is used, to measure whether our Google ads and product listings lead to sales, and so Google can show our ads to people who have visited our shop. Basis: legitimate interests. You can object at any time using the options below or by emailing us.
  • Google also uses this information under its own privacy policy. See how Google uses information from sites that use its services.
  • How to opt out: install Google's Analytics opt-out browser add-on; turn off personalised ads in Google's Ads Settings; or block or delete cookies in your browser settings (the basket and login won't work without the essential ones).

Other advertising

If you accept marketing cookies, the Meta pixel records the pages you view and what you add to your basket or buy. Shopify may also send the same purchase events directly to Meta from its servers. We use this to measure our ads and to show our ads to people who have visited our shop. For data collected through its pixel, Meta and we are joint controllers. Meta also uses the data for its own purposes under its own privacy policy. If we advertise on Microsoft Bing, Microsoft's tag works in the same way, also only if you accept marketing cookies. Basis: consent. If you don't accept, none of this runs.

You can also control ads in your Facebook and Microsoft settings.

Session recordings

If we use session recording, it's provided by Better Replay and only runs if you accept analytics cookies. It records how visitors use the shop: mouse movements, clicks, scrolling and the pages you visit. This helps us find parts of the shop that are confusing or broken. What you type into forms, including payment and password fields, is hidden from the recording. Better Replay deletes recordings after a set period, and we don't keep copies. Basis: consent.

Other apps in our shop

Some apps in our shop, such as a product quiz or a store map, load small pieces of code from their own servers. Those servers see your IP address and browser details when the code loads, in the same way as any website you visit.

Who we share it with

We share your data only with the companies we need to run the shop. They act on our instructions (as our "processors") unless we've said above that they're a controller in their own right.

  • Shopify (Shopify International Limited, Ireland, with data stored by Shopify in Canada, the US and elsewhere): runs our shop, checkout, customer accounts and order records.
  • Shopify Payments (using Stripe) and PayPal: take payments.
  • Royal Mail, Parcelforce, DHL and Evri: deliver orders.
  • Mailchimp (Intuit, US) and Shopify Email: send marketing emails.
  • Google (US): analytics and advertising through Google's tag (see above), and fonts and an old analytics script on our Carrd sites.
  • Meta (Ireland and US), and Microsoft (US) if we advertise on Bing: advertising, only with your consent.
  • Trustpilot (Denmark): review invitations, if we send you one.
  • Chatra: live chat, if you use it.
  • Smile.io (Canada): CandleClub rewards, if you join.
  • Better Replay: session recordings, if we use them and you accept analytics cookies.
  • Our back-in-stock app: stock alerts you ask for.
  • Carrd (US): builds and hosts superdupergroup.co.uk and cardcompany.superdupergroup.co.uk, and passes their form messages to us.
  • Our email provider: stores the emails you send us.
  • Our accountant and HMRC: order and payment records, where needed for tax.

We may also share data if the law requires it, for example with the police or a court, or to protect our legal rights. We don't sell your data.

Data sent outside the UK

Some of the companies above are based in, or store data in, other countries, including Ireland and the rest of the EU, Canada and the United States. The UK treats the EU and Canada as giving an adequate level of protection. For the US and other countries without that status, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework where the company is certified, or otherwise by the company's contract terms with us (the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses). You can ask us for details.

How long we keep it

  • Orders, invoices and refunds: 6 years from the end of the tax year in which the order was placed, because tax law requires it. After that they are deleted.
  • CandleClub account: until you ask us to close it. If there has been no login or order on an account for 3 years, we close it. Order records are then kept only for the period above.
  • Messages, chat and damage claims: 2 years after your last message, or with the order record if they're about an order. Damage-claim photos are deleted 12 months after the claim is settled.
  • Marketing list: until you unsubscribe. If you haven't opened or clicked any of our emails for 2 years, we remove you. When you unsubscribe, we keep your email address on a "do not contact" list so we don't email you again by mistake.
  • Back-in-stock alerts: until we've sent the alert, or 12 months, whichever comes first.
  • Cookie choice: 1 year, then the banner asks again.
  • Analytics and advertising data: Google Analytics keeps detailed data for no more than 14 months. Google, Meta and Microsoft keep advertising data under their own policies.

Your rights

You have the right to:

  • get a copy of the personal data we hold about you
  • have it corrected if it's wrong
  • have it deleted (we may still have to keep order records for tax)
  • restrict how we use it while a concern is looked into
  • get the data you gave us in a format you can take elsewhere
  • object to anything we do on the basis of legitimate interests, including Google's tag
  • stop marketing at any time; we'll always stop when you ask
  • withdraw consent at any time, for example by unsubscribing or clearing this site's cookies so the cookie banner asks again. This doesn't affect anything we did before you withdrew it.

To use any of these rights, email privacy@petromedia.co.uk. We'll reply within one month. We may ask you to confirm who you are before we act, so that we don't give your data to someone else. It's free.

We don't make decisions about you based only on automated processing that have legal or similarly significant effects.

Keeping your data safe

Our accounts with Shopify, Mailchimp and the other services above are protected with strong passwords and two-step sign-in, and only people who need access have it. Shopify's checkout is certified to the PCI DSS card security standard.

Complaints

If you're unhappy with how we've handled your personal data, please tell us first at privacy@petromedia.co.uk. We'll acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

We'll update this policy when the way we use personal data changes, for example if we add or remove a service. The date at the top shows when it last changed. If a change matters to you, for example a new use of data you've already given us, we'll tell you by email before it happens.