This Privacy Policy explains how Candy Air Legal processes personal data when you use candyairring.christmas. It applies to visitors, prospective clients, and other individuals who communicate with us through the site.
This section introduces how personal information, user rights, and support pathways are addressed in the document below.
We may process identification details, contact details, professional information, message content, technical identifiers, and usage data. In a legal services context, this may also include information contained in enquiries, case-related communications, and documents that users choose to provide.
We collect data directly from users when they complete forms, send messages, or otherwise interact with the site. We also receive technical and usage information automatically from devices, browsers, and cookies. Where relevant, we may obtain limited information from hosting, security, analytics, or communication providers acting on our behalf.
Essential cookies are used to operate the site and maintain security. Preference cookies may remember selected settings. Analytics cookies, if used, help us understand how the site is accessed and used. Cookies may be session-based or persistent depending on their function.
You may block or delete cookies through your browser settings. If the site provides a cookie banner or preference tool, you can use it to accept or reject non-essential cookies. Disabling some cookies may affect site functionality or limit certain features.
We use personal data to operate and secure the site, respond to enquiries, manage client or prospective client communications, provide requested information or services, maintain records, monitor performance, prevent misuse, and comply with legal and professional obligations. Where permitted, we may also use data to improve site functionality and to manage internal administration.
We may share personal data with trusted service providers that support hosting, security, maintenance, communications, analytics, or document handling. These recipients act under contractual or other confidentiality obligations and may process data only for the services they provide to us. We do not authorise them to use the data for their own unrelated purposes.
We may disclose personal data where necessary to comply with legal obligations, respond to lawful requests, protect rights or safety, or establish, exercise, or defend legal claims. This may include sharing information with courts, regulators, law enforcement, or other public authorities when required or permitted by law.
Use the contact details below for privacy questions or requests relating to this policy.
Where GDPR applies, we process personal data on a lawful basis such as consent, performance of a contract, compliance with legal obligations, legitimate interests, or another basis permitted by law. We aim to limit processing to what is necessary for the stated purpose and to respect data protection principles.
Where GDPR applies, you may have rights to access, rectify, erase, restrict, object to processing, and request portability of certain data. If processing is based on consent, you may withdraw consent for future processing. You may also lodge a complaint with the competent supervisory authority.
Subject to applicable law, you may have rights to access your data, correct inaccurate information, request deletion, object to certain processing, and ask for restriction or portability where those rights apply. Some requests may be limited where we must keep information for legal, security, or evidentiary reasons.
To protect privacy and security, we may need to verify your identity before acting on a request. We will assess the request in line with applicable law and respond within the period required by law, or explain if an exception applies. If a request is complex or repetitive, we may take additional time where the law allows.
We retain personal data for as long as needed to respond to enquiries, provide services, manage the site, meet legal obligations, resolve disputes, and enforce our agreements. When data is no longer required, we delete it or anonymise it, unless a longer retention period is required by law or justified by a legitimate operational need.
We may revise this policy to reflect changes in our practices, legal requirements, or the services offered through the site. The revised version will apply from the date stated in the policy unless a different effective date is indicated. We encourage users to review the policy periodically.
