Privacy Policy

Last updated: 6 October 2026

1. General Provisions

1.1. This Privacy Policy describes how Cozy Cabin Design OÜ collects, uses, stores and protects personal data in connection with the use of the CandlePro online store and website candlepro.eu.

1.2. The controller of personal data is:

Cozy Cabin Design OÜ
Registry code: 16433942
Address: Vana-Madise tee 9, Naage village, Harku municipality, Harju County, 76919, Estonia
Email: info@candlepro.eu
Website: candlepro.eu

Hereinafter referred to as CandlePro, we, us, or the Data Controller.

1.3. A data subject is a natural person whose personal data is processed by CandlePro, including website visitors, customers, registered account users and newsletter subscribers.

1.4. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”), the Estonian Personal Data Protection Act and other applicable legislation.

1.5. We process personal data lawfully, fairly and transparently and only to the extent necessary for the purposes described in this Privacy Policy.

2. Personal Data We Process

2.1. Depending on how a customer uses our website and services, we may process the following personal data:

  • first and last name;
  • company name and registry code where an order is placed on behalf of a company;
  • billing and delivery address;
  • telephone number;
  • email address;
  • order information, including products purchased, quantities, prices and order history;
  • payment-related information, such as the selected payment method and payment status;
  • customer account information where the customer creates an account with CandlePro;
  • customer service correspondence;
  • information relating to returns, complaints and warranty claims;
  • newsletter and marketing communication preferences and consent records;
  • technical information relating to the use of the website, such as IP address, browser type, device type and information collected through cookies and similar technologies.

2.2. CandlePro does not store customers’ complete payment card details where payments are processed through a third-party payment service provider. Information necessary for processing a payment is transmitted to the relevant payment service provider.

2.3. We generally obtain personal data directly from the customer, for example when an order is placed, a customer account is created, a person subscribes to our newsletter or contacts us.

3. Purposes and Legal Bases for Processing Personal Data

3.1. Processing and fulfilling orders

We process customers’ names, contact details, delivery addresses, order information and payment-related information in order to accept and fulfil orders, arrange payments and organise delivery.

Legal basis: Article 6(1)(b) GDPR – processing necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract.

3.2. Processing payments

Payment-related information is processed to enable customers to pay for orders and to confirm payments.

Legal basis: performance of a contract and, where applicable, compliance with legal obligations.

3.3. Delivery of goods

We provide the information necessary for delivery to the transport, courier or parcel delivery service selected by the customer.

Legal basis: performance of a contract.

3.4. Customer service

We process customers’ contact details, order information and correspondence in order to answer enquiries, resolve issues and handle returns, complaints and warranty claims.

Legal basis: depending on the circumstances, performance of a contract, compliance with a legal obligation, or CandlePro’s legitimate interest in providing effective customer service and protecting its legal rights.

3.5. Accounting and compliance with legal obligations

We process information relating to orders and transactions to the extent necessary to comply with accounting, taxation and other legal obligations.

Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation.

3.6. Fraud prevention and website security

We may process technical data and order-related information in order to prevent fraud, misuse, security incidents and other unlawful activities and to protect our information systems.

Legal basis: Article 6(1)(f) GDPR – CandlePro’s legitimate interest in protecting its online store, customers and business.

3.7. Marketing and newsletters

Where a customer has provided the necessary consent, we may use their email address to send newsletters, promotional offers, discounts and other marketing communications.

Customers may withdraw their marketing consent at any time by using the unsubscribe link contained in our emails or by contacting us.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Legal basis: Article 6(1)(a) GDPR – consent, or, where permitted by applicable law, another appropriate legal basis in the context of an existing customer relationship.

4. Disclosure of Personal Data and Service Providers

4.1. CandlePro may disclose personal data to service providers only to the extent necessary for them to provide the relevant service.

Such service providers may include:

  • online store, website hosting and IT service providers;
  • payment service providers, including Montonio;
  • transport, courier and parcel delivery providers selected by the customer;
  • accounting and financial service providers;
  • email and newsletter service providers, including Smaily;
  • website analytics and cookie management service providers;
  • other service providers necessary for operating the online store or complying with CandlePro’s legal obligations.

4.2. Service providers receive only the personal data necessary to provide the relevant service.

4.3. Where personal data is processed outside the European Economic Area (EEA), we ensure that there is an appropriate legal basis and safeguards for the transfer as required by the GDPR, such as an adequacy decision adopted by the European Commission or Standard Contractual Clauses.

4.4. CandlePro may disclose personal data to public authorities or other parties where required by law or where necessary to establish, exercise or defend CandlePro’s legal rights.

4.5. CandlePro does not sell customers’ personal data to third parties.

5. Retention of Personal Data

5.1. Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected or to comply with applicable legal obligations.

5.2. Accounting records relating to orders and sales transactions are generally retained for seven years from the end of the financial year in which the relevant transaction was recorded, unless a different retention period is required by law.

5.3. Customer service correspondence and information relating to returns and complaints is retained for as long as necessary to resolve the relevant matter and, where appropriate, to establish, exercise or defend legal claims.

5.4. Customer account information is retained while the account remains active and, after closure of the account, only to the extent and for the period necessary to comply with legal obligations or protect legitimate interests.

5.5. Personal data processed for marketing purposes is retained until consent is withdrawn or until there is no longer a legitimate need to process the data for marketing purposes. We may retain evidence of the granting or withdrawal of consent where necessary to demonstrate compliance with applicable law.

5.6. The retention period for technical logs and security-related information depends on the type of information and the purpose for which it is processed. Such information will not be retained for longer than necessary to maintain security or investigate potential incidents.

5.7. Once the applicable retention period has expired, personal data will be deleted or anonymised unless further retention is required by law.

6. Cookies and Similar Technologies

6.1. CandlePro.eu may use cookies and similar technologies to ensure the proper functioning of the website, improve the user experience, analyse website usage and, with the user’s consent, for marketing purposes.

6.2. Cookies that are strictly necessary for the operation of the website or for providing a service explicitly requested by the user may be used without separate consent where permitted by applicable law.

6.3. Analytics, advertising, marketing and other non-essential cookies are used only after the user has provided consent, unless otherwise permitted by applicable law.

6.4. Users may change their cookie preferences or withdraw their consent through the cookie settings available on the website.

6.5. More detailed information about the cookies used, their purposes and retention periods may be provided through CandlePro.eu’s cookie settings or cookie notice.

7. Security of Personal Data

7.1. CandlePro implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

7.2. Access to personal data is provided only to persons and service providers who require access in order to perform their duties or provide the relevant services.

8. Rights of the Data Subject

Subject to the conditions provided by applicable law, a data subject has the right to:

8.1. obtain confirmation as to whether CandlePro processes their personal data and request access to such data;

8.2. request correction of inaccurate or incomplete personal data;

8.3. request deletion of personal data where there is no longer a lawful basis for its processing;

8.4. request restriction of the processing of personal data in circumstances provided by law;

8.5. receive personal data provided by the data subject in a structured, commonly used and machine-readable format and, where applicable, request that such data be transmitted to another controller;

8.6. object to the processing of personal data where the processing is based on CandlePro’s or a third party’s legitimate interests;

8.7. object at any time to the processing of personal data for direct marketing purposes;

8.8. withdraw consent to the processing of personal data at any time where processing is based on consent;

8.9. receive information regarding the processing of their personal data;

8.10. lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) if the data subject considers that the processing of their personal data infringes applicable data protection legislation.

Estonian Data Protection Inspectorate: aki.ee

9. Exercising Your Rights

9.1. For questions concerning personal data or to exercise any of the rights described above, please contact CandlePro at:

info@candlepro.eu

9.2. Before providing personal data or fulfilling another data subject request, CandlePro may request additional information where reasonably necessary to verify the identity of the person making the request.

9.3. We will respond to requests within the time limits established by the GDPR, generally within one month of receiving the request. Where permitted by law, this period may be extended in the case of complex or numerous requests.

10. Changes to this Privacy Policy

10.1. CandlePro may amend this Privacy Policy where our data processing practices, services or applicable legislation change.

10.2. The current version of the Privacy Policy will be published on candlepro.eu.

10.3. The “Last updated” date at the beginning of this Privacy Policy indicates when the document was most recently revised.

11. Applicable Law

This Privacy Policy and the processing of personal data by CandlePro are governed by applicable European Union and Estonian law, in particular Regulation (EU) 2016/679 (General Data Protection Regulation) and the Estonian Personal Data Protection Act.