Version 1.0 · Prepared for publication on 16 October 2026.

1. Who we are and how to contact us

This privacy policy explains how Battle Candy Studios Ltd, trading as Battle Candy, collects, uses, stores and shares personal information when you visit battlecandy.co.uk, contact us, or use our services.

We provide our services to business clients in the United Kingdom. This does not mean that all supplier processing takes place in the UK; section 8 explains overseas processing.

We are registered in England and Wales under company number 12420400. Our registered office and postal contact address is Lytchett House, 13 Freeland Park, Wareham Road, Lytchett Matravers, Dorset, BH16 6FA.

For privacy questions, requests or complaints, email tom@battlecandy.co.uk or write to the address above, marked for the attention of the privacy contact.

We are the data controller for the business activities described in this policy. This means we decide why and how that personal information is used. Where we handle information on a client's instructions, the different arrangements in section 12 apply.

This policy provides information about our use of personal data. Visiting our website, making an enquiry or accepting our service terms does not give consent to marketing, recording or optional tracking.

2. Information we collect and where it comes from

We collect information directly from you when you complete a form, request a consultation, correspond with us, approve work or buy services. This can include:

• your name, business name, role, email address, telephone number and business or billing address;

• your website address, project requirements, desired outcomes, constraints and messages;

• your requested consultation date, time window and availability notes;

• proposals, instructions, approvals, support requests and correspondence;

• invoice, payment and transaction records; and

• your marketing choices, recording choices and requests about your information.

Our website's enquiry forms save the answers needed to handle your request. In a multi-step form, answers may be saved as you move between steps, before you send the final request. Submitted requests are stored for follow-up. We also use our business email when dealing with your enquiry. We also keep delivery and workflow records so we can identify failed or repeated processing.

Technical information processed in running the website may include your IP address, browser and device information, requested pages, request times and error or security events. Section 6 explains cookies and optional measurement. Section 5 explains consultation recordings and transcripts.

For business research and relevant outreach, we may obtain business contact details from company websites, public business directories, Companies House, professional profiles or someone who introduces us. We record the source and business reason for using named contact information. We do not treat public availability as permission for every use.

Please provide only information relevant to your enquiry or project. Do not send passwords, full card details, health information or other sensitive personal information through an enquiry form. If a project needs sensitive information, we must agree suitable arrangements before receiving it. Our services are directed at businesses, not children.

3. Why we use information and our lawful bases

We will only use your personal information where we have a lawful basis. The basis depends on the purpose and your relationship with us.

Where we rely on legitimate interests, we consider whether the use is necessary and balance those interests against your rights and reasonable expectations. You can object as explained in section 10.

We need enough contact and project information to respond, prepare a proposal and provide agreed services. Without it, we may be unable to do so. Optional form fields, marketing consent and recording consent are not conditions of buying a website. Information needed for a contract or invoice is identified when requested.

We will explain any materially different use of your information before that use begins and identify the applicable lawful basis. We will obtain fresh consent where it is required.

4. Business research and marketing

We may research business prospects and contact relevant UK limited companies and limited liability partnerships about our services. Where this involves personal information, we rely on legitimate interests after considering the relevance of the approach and the person's rights. We check the organisation's legal form. When details come from public sources or an introduction, we provide privacy information within one month, or at our first communication if that is sooner.

For sole traders, individual subscribers and ordinary partnerships, we obtain explicit consent before sending marketing emails. We do not rely on the existing-customer soft opt-in exception under our current approach. If the subscriber's status is uncertain, we require consent.

We do not currently run a newsletter service. If we introduce one, sign-up will be separate and optional, with an unticked consent box. Requesting a consultation or buying a service does not subscribe you to marketing.

You can stop marketing at any time by replying to the message, emailing tom@battlecandy.co.uk, or using the unsubscribe link provided in a marketing email. We will stop direct marketing when you object or withdraw consent. This does not stop necessary messages about an enquiry, contract, invoice or support request.

We keep a minimum do-not-contact record and check it before importing marketing contacts or sending marketing. We do not use marketing email-open or click tracking.

5. Planned consultation recording and transcription

We do not currently use OpenAI's Meetings plugin to record consultations. We plan to introduce it to help prepare notes and will update this notice with the arrangements before it is used.

Before recording or sending audio for transcription, we will explain the purpose and ask each participant for consent. We will offer a consultation without recording, using manual notes instead. You will be able to ask us to stop recording at any time.

Our planned limits are 30 days for audio and 90 days for raw transcripts, with earlier deletion after checking the notes where appropriate. Checked project notes follow the enquiry or client-record periods in section 9. A transcript will not approve a proposal or change your contract. Recordings will not be reused for marketing or unrelated AI work without separate permission.

6. Cookies, analytics and advertising

Our enquiry forms use a first-party cookie to connect your browser with your form session. The cookie name begins site_journey_ and its configured lifetime is 24 hours. It supports the form you request, including moving between steps. Cookie expiry is separate from the retention of answers and enquiry records described in section 9.

The website also uses temporary browser session storage to manage page transitions. This is separate from advertising or analytics. You can control cookies and site storage through your browser, although blocking form-session storage may prevent forms from working correctly.

We use Google Analytics 4 to understand visits and improve the website. We plan to introduce Google Ads tags when we begin advertising, to measure whether adverts lead to enquiries. Google Ads remains planned.

Optional analytics loads only after you accept analytics in the cookie banner. You can reject analytics and still use the website and enquiry forms. Reopen Cookie preferences to change or withdraw your choice. If we introduce advertising tags, we will provide a separate advertising choice before they operate.

Our initial Google Ads use will be conversion measurement only. It will not include remarketing, customer-list uploads or enhanced conversions, which send additional customer information to Google. We will review the data use, update this notice and obtain any required consent before adding those features.

When enabled with your consent, these services may receive device or cookie identifiers, page addresses and interactions such as scrolling, clicks to other websites, supported video engagement, file-download clicks and submitted enquiries. Depending on the interaction, this can include link addresses, video details, file names and link text. Our custom enquiry events use funnel and stage identifiers rather than your form answers. Email-address redaction is enabled. Please do not put personal or sensitive information into website addresses or file names you provide to us. Google explains its handling of partner-site information in How Google uses information from sites or apps that use its services.

Cookies and browser storage

Cookies are small files stored by your browser. Local storage and session storage keep information in your browser in a similar way. We use the following:

The Google cookie periods are separate from our two-month retention setting for detailed Analytics records. Google documents its cookie lifetimes. You can also clear cookies and site storage through your browser. Clearing the stored consent choice means the banner will ask again.

Google Tag Manager manages the Analytics tags on this site. Our current Analytics setup has no linked Google products, Google Signals or user-provided data collection. We do not currently use Google Ads tags.

7. Who receives information

We use suppliers to help operate our business. Depending on the activity, relevant information is shared with:

• Cloudflare for website hosting, enquiry storage and website security;

• Google Workspace for business email, Calendar, Drive, Docs, Sheets and Meet;

• providers used to send and manage business marketing and opt-outs;

• Google for Analytics and Tag Manager, under your analytics choice;

• Zoho Invoice for invoices and billing contacts, and Starling Bank for bank-transfer payments;

• contractors who need information to carry out agreed work under confidentiality and data-protection obligations;

• professional advisers, including accountants, lawyers and insurers, where needed; and

• regulators, courts or public authorities where disclosure is required or otherwise lawful.

Suppliers that process information on our instructions must provide appropriate contractual protections. Some organisations, such as banks, insurers and certain platform providers, act as controllers for their own purposes and explain those uses in their own privacy notices.

We share only the information relevant to the purpose. Access to a client's customer information is governed by section 12 and the agreed processing arrangements.

8. Processing outside the United Kingdom

We serve UK businesses, but some suppliers process information outside the UK. This can include hosting, technical support and work by their sub-processors. We do not promise UK-only storage.

• Cloudflare: its global services may process website and enquiry information outside the UK, including in the United States. Our database has no jurisdiction restriction. Cloudflare's Data Processing Addendum provides for the UK Extension to the EU-US Data Privacy Framework for covered transfers and contractual safeguards, including the UK Addendum, for other restricted transfers.

• Google: Workspace has no selected data region. Workspace and Analytics may process information internationally, including in the United States. Google's Workspace transfer arrangements and Analytics transfer arrangements describe use of the UK Extension to the EU-US Data Privacy Framework for covered US transfers and contractual safeguards for other applicable transfers.

• Zoho Invoice: our account uses Zoho's EU region. UK adequacy regulations cover transfers to the European Economic Area. Zoho's UK privacy notice also describes group and supplier processing in the United States and other countries, subject to data-protection agreements. The EU account region is not a promise that every support activity takes place in the EU.

Where UK adequacy regulations do not cover a transfer, appropriate safeguards are required, such as approved contractual clauses with the UK Addendum and any necessary additional protections. You can contact tom@battlecandy.co.uk for information about the arrangements that apply to your information and how to obtain a copy of the safeguards.

9. How long we keep information

We retain personal information only for as long as necessary for its purpose, including applicable legal, tax and accounting requirements. We consider the type of information, the purpose, the relationship, any dispute and the risk of keeping it longer.

These periods form our retention schedule. Reviews and deletion cover our database, mailbox, working documents and invoice records; they are not all controlled by automatic timers. The six-year client-record rule covers essential evidence, not every working file, duplicate or recording. We delete other material sooner when it is no longer needed.

Deletion from active use may not immediately remove every recovery copy. Cloudflare D1 provides up to 30 days of recovery history on our plan. Google and Zoho also have provider-side deletion and recovery processes. We restrict the use of retained recovery copies and reapply relevant deletions if we restore data. Legal duties or a documented dispute may require us to retain a limited record for longer.

10. Your rights

Subject to the conditions and exceptions in data-protection law, you may:

• ask for access to your personal information and a copy;

• ask us to correct inaccurate or incomplete information;

• ask us to erase information or restrict its use;

• object to processing based on legitimate interests;

• receive certain information in a portable format where the relevant conditions apply; and

• withdraw consent where we rely on it, without affecting the lawfulness of earlier processing.

You have the right to object to direct marketing at any time. You do not need to give a reason for that objection.

Contact tom@battlecandy.co.uk to make a request. We may ask for proportionate information to verify your identity or clarify what you need. We normally respond within one month, subject to the time-calculation rules and permitted extensions in law. If an extension applies, we will explain why. Requests are normally free; any fee or refusal will be limited to circumstances permitted by law and explained to you.

We review website enquiries ourselves. Our planned use of transcription is to help prepare notes, not to make a solely automated decision about you with a legal or similarly significant effect.

11. Security and complaints

We take appropriate technical and organisational measures to protect personal information and limit access to those who need it for the relevant purpose. No method of online transmission or storage is completely secure. We will notify affected people and the regulator of a personal-data breach where the law requires us to do so.

If you are concerned about our handling of your information, email tom@battlecandy.co.uk or write to our registered office. Please explain what happened and the outcome you would like. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed and explain the outcome.

You also have the right to complain to the Information Commissioner's Office. See the ICO's complaint service or call 0303 123 1113. The ICO explains its process and the information it needs when considering a complaint.

12. Information handled for our clients

When we host a client's website, maintain an enquiry system or access customer information on a client's instructions, the client normally determines the purposes of that processing. Their privacy notice explains those purposes and the applicable lawful bases.

Where we act as a processor, we use that information under the client's documented instructions and an agreed data-processing agreement. That agreement covers security, authorised suppliers, assistance with rights and incidents, transfers, retention and return or deletion. We do not use those customer records for Battle Candy's own marketing.

If your request concerns information submitted to a client's website, contact that client first. If you contact us, we will help direct the request to the appropriate controller and assist as required by our agreement and the law. This does not affect our responsibility as controller for our own client contacts, billing or business administration.

13. Changes and other websites

We may update this policy to reflect changes in our services, practices or the law. We will show the updated date and bring material changes to your attention where appropriate. Publishing a revised notice does not create consent for a new purpose.

External websites and platforms have their own privacy notices. Please read those notices when using their services.

Template acknowledgement

Adapted from the Website Contracts privacy policy template, used under its permission to copy, modify and use templates commercially. Changes reflect Battle Candy's services, observed form behaviour, planned processing and current ICO guidance. The publisher does not endorse this adaptation.