Privacy & Cookie Policy

Privacy & Cookie Notice

KandyToys Limited   •   Last updated: 21 July 2026

1. Who we are

KandyToys Limited ("KandyToys", "we", "us") is the controller of the personal data described in this notice.

Registered office and trading address: Hill Barton Business Park, Sidmouth Road, Clyst St. Mary, Exeter, Devon, EX5 1DR

Telephone: 01395 234600   •   Email: enquiries@kandytoys.co.uk

Company registration number: 07380842   •   ICO registration number: Z2787484

We are a business-to-business wholesaler. We do not sell to consumers through this website, and this website is not directed at children.

2. What this notice covers

This notice explains how we collect and use personal data about:

• contacts at our customers, prospective customers and suppliers;
• individuals applying for a trade account, including sole traders, partners, company directors and personal guarantors;
• visitors to kandytoys.co.uk ("our site") and people who contact us by phone, email or at trade shows.

A separate privacy notice for our employees and job applicants is contained in our staff handbook.

3. Personal data we collect

Information you give us. When you apply for a trade account, place an order, sign up at a trade show or correspond with us, this may include: your name and job title; business or trading name and business type; invoice, delivery and registered office addresses; telephone, fax and mobile numbers and email addresses; company and VAT registration numbers; the trading terms you request; and the details of trade references you provide. Where the applicant is not a limited company, we also collect the business owner’s name, home address and contact details. Where a personal guarantee is given, we collect the guarantor’s name, address, date of birth and signature, and the name, address, occupation and signature of the independent witness.

Information we collect automatically. Technical data when you visit our site, including IP address, login information, browser type and version, operating system, and information about your visit such as pages viewed, products searched for and length of visit.

Information we receive from other sources. Information from Creditsafe and Companies House (see section 5), our credit insurer, the trade references you provide, publicly available sources, and third parties who help us run the business, such as payment, delivery and IT providers.

4. How we use your data and our lawful bases

Where we rely on legitimate interests, we have considered and balanced these against your rights and interests. You can ask us for more information about this, or object — see section 10.

5. Credit checks

Before opening a trade account, and periodically during a trading relationship, we carry out checks using Creditsafe — the only credit reference agency we use — together with information published by Companies House. For limited companies these checks mainly involve company information but may include personal data about directors. For sole traders and partnerships, the checks relate to the individuals themselves.

These checks draw on existing records only. We do not share your payment performance data with credit reference agencies; your payment history with us is used internally.

We may share limited customer information with our credit insurer for the purpose of obtaining and maintaining credit insurance cover on your account. If false or misleading information is provided in connection with an account application or personal guarantee, details may be passed to fraud prevention agencies.

6. Who we share your data with

We share personal data, only where necessary, with:

• delivery and courier companies fulfilling your orders;
• payment service providers processing your payments;
• Creditsafe and our credit insurer (see section 5);
• Microsoft, whose Dynamics 365 platform is our main business system, and other IT providers that host our systems and website;
• our bank, accountants, auditors, insurers and professional advisers;
• HMRC, regulators, fraud prevention agencies and law enforcement, where we are legally required to do so.

We do not sell personal data to anyone.

7. International transfers

Our systems, and those of our service providers, hold personal data in the United Kingdom, and we do not transfer personal data outside the UK. If that ever changes, we will put appropriate safeguards in place — such as a UK adequacy decision or the UK International Data Transfer Agreement — and update this notice.

8. How long we keep your data

• Trading and account records, including invoices: 6 years after the end of the financial year to which they relate.
• Credit assessment records: 6 years after the end of the financial year to which they relate.
• Prospect and marketing contact details: reviewed every 2 years and removed where there has been no engagement.
• Website technical logs: 12 months.

When personal data is no longer needed it is securely deleted from our systems, and any paper copies are shredded or confidentially destroyed.

9. Security

Personal data is stored on secure servers operated by us or our service providers, with access restricted to staff who need it. Where you hold a password for our site, you are responsible for keeping it confidential. Transmission of information over the internet is never completely secure, but once we receive your data we use appropriate procedures and security measures to protect it.

10. Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you, free of charge;
• have inaccurate or incomplete data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing, including objecting to direct marketing at any time;
• data portability in certain circumstances;
• withdraw consent, where processing is based on consent.

To exercise any of these rights, contact enquiries@kandytoys.co.uk. We will respond within one month.

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

11. Marketing

We may email business contacts about products, promotions and events we consider relevant to their business, relying on legitimate interests. Every marketing email includes a clear option to opt out, and we honour opt-outs promptly.

12. Cookies

Our site uses the following cookies, all of which are strictly necessary for the site to function or to remember your cookie preference:

We do not use analytics, advertising or other non-essential cookies. If that changes, we will update this notice and seek your consent first.

13. Third-party links

Our site may contain links to other websites. Those sites have their own privacy notices and we are not responsible for their practices.

14. Changes to this notice

We will post any changes on this page and, where the changes are significant, notify account holders by email.

15. Contact

Questions, comments and requests regarding this notice are welcome at enquiries@kandytoys.co.uk, or in writing to KandyToys Limited, Hill Barton Business Park, Sidmouth Road, Clyst St. Mary, Exeter, Devon, EX5 1DR.