Privacy Policy
This Privacy Policy explains how www.topcandy.co.uk (“we”, “us”, or “our”) collects, uses, and shares your personal information when you visit, browse, or make a purchase from our website (the “Site”).
Contact
If you have any questions about this policy, want more details on how we handle your data, or wish to make a complaint, you can contact us at:
📧 Email: customer.care@topcandy.co.uk
📮 Postal address: 91 Princess Street, Manchester, M1 4HT
What we Collect and Why
We collect personal information from you in a few different ways:
A. Device Information
-
Purpose: To load our Site correctly for you, keep it secure, and understand how it’s used.
-
Collected via: Cookies, log files, web beacons, tags, pixels.
-
Shared with: Our store platform provider, Shopify.
-
Examples: Browser type, IP address, time zone, pages viewed, links clicked.
B. Order Information
-
Purpose: To fulfil your orders, process payments, arrange delivery, send order confirmations, screen for fraud, and (if you agree) send marketing updates.
-
Collected from: You, when placing an order.
-
Shared with:
-
Shopify – store hosting & order management
-
PayPal – payment processing
-
Royal Mail – delivery services
-
Trustpilot – customer reviews
-
-
Examples: Name, billing/shipping address, payment info, email, phone number.
C. Customer Support Information
-
Purpose: To assist with your queries, returns, and complaints.
-
Collected from: You, when contacting us.
-
Shared with: Shopify (if case management is handled through their systems).
-
Examples: Your name, email, order details, and any messages you send us.
Minors
Our Site is not intended for children under 13. We do not knowingly collect their data. If you believe your child has given us personal information, please contact us so we can delete it.
Sharing Your Information
We share your data only to help run our business, deliver orders, and comply with the law. This includes:
-
Service providers (Shopify, PayPal, Royal Mail, Trustpilot)
-
Analytics & advertising platforms (Google Analytics, Shopify Audiences)
-
Legal requests (court orders, regulatory requirements)
Behavioural Advertising & Analytics
We use analytics and advertising tools to show you products and offers we think you’ll like:
-
Google Analytics – See Google Privacy Policy and opt-out here.
-
Shopify Audiences – Helps show relevant ads to potential customers based on anonymised data.
Opt-out of targeted ads:
-
Google: Ad Settings
-
Digital Advertising Alliance: Opt-out Portal
How We Use Your Personal Information
We use your information to:
-
Process and deliver your orders
-
Communicate with you
-
Provide customer service
-
Send marketing (if you’ve opted in)
-
Improve our website and services
Legal Basis (UK & EU Residents)
Under UK GDPR and EU GDPR, we process your information based on:
-
Consent
-
Contract performance
-
Legal obligations
-
Legitimate interests (e.g., fraud prevention, website improvement)
Retention
We keep your information as long as needed for the purposes above, unless you request deletion.
Your Rights
If you are in the UK or EEA, you have the right to:
-
Access your data
-
Request correction or deletion
-
Restrict or object to processing
-
Data portability
How: Email customer.care@topcandy.co.uk.
Complaints can also be made to the ICO: Make a complaint
International Transfers
Shopify stores and processes data in Canada, the US, and other countries. See Shopify GDPR Whitepaper for details.
Cookies
We use cookies to make the Site work and improve your experience. This includes:
-
Necessary cookies – to run the store and checkout
-
Analytics cookies – to understand site use
-
Advertising cookies – to deliver relevant ads
You can control cookies in your browser settings. Learn more at All About Cookies.
Cookies Necessary for the Functioning of the Store
| Name | Function | Duration |
|---|---|---|
| _ab | Used in connection with access to admin. | 2y |
| _secure_session_id | Used in connection with navigation through a storefront. | 24h |
| _shopify_country | Used in connection with checkout. | session |
| _shopify_m | Used for managing customer privacy settings. | 1y |
| _shopify_tm | Used for managing customer privacy settings. | 30min |
| _shopify_tw | Used for managing customer privacy settings. | 2w |
| _storefront_u | Used to facilitate updating customer account information. | 1min |
| _tracking_consent | Tracking preferences. | 1y |
| c | Used in connection with checkout. | 1y |
| cart | Used in connection with shopping cart. | 2w |
| cart_currency | Used in connection with shopping cart. | 2w |
| cart_sig | Used in connection with checkout. | 2w |
| cart_ts | Used in connection with checkout. | 2w |
| cart_ver | Used in connection with shopping cart. | 2w |
| checkout | Used in connection with checkout. | 4w |
| checkout_token | Used in connection with checkout. | 1y |
| dynamic_checkout_shown_on_cart | Used in connection with checkout. | 30min |
| hide_shopify_pay_for_checkout | Used in connection with checkout. | session |
| keep_alive | Used in connection with buyer localization. | 2w |
| master_device_id | Used in connection with merchant login. | 2y |
| previous_step | Used in connection with checkout. | 1y |
| remember_me | Used in connection with checkout. | 1y |
| secure_customer_sig | Used in connection with customer login. | 20y |
| shopify_pay | Used in connection with checkout. | 1y |
| shopify_pay_redirect | Used in connection with checkout. | 30 minutes, 3w or 1y depending on value |
| storefront_digest | Used in connection with customer login. | 2y |
| tracked_start_checkout | Used in connection with checkout. | 1y |
| checkout_one_experiment | Used in connection with checkout. | session |
| checkout_session_lookup | Used in connection with checkout. | 3w |
| checkout_session_token_<<token>> | Used in connection with checkout. | 3w |
| identity-state | Used in connection with customer authentication. | 24h |
| identity-state-<<token>> | Used in connection with customer authentication. | 24h |
| identity_customer_account_number | Used in connection with customer authentication. | 12w |
Reporting and Analytics
| Name | Function | Duration |
|---|---|---|
| _landing_page | Track landing pages. | 2w |
| _orig_referrer | Track landing pages. | 2w |
| _s | Shopify analytics. | 30min |
| _shopify_d | Shopify analytics. | session |
| _shopify_s | Shopify analytics. | 30min |
| _shopify_sa_p | Shopify analytics relating to marketing & referrals. | 30min |
| _shopify_sa_t | Shopify analytics relating to marketing & referrals. | 30min |
| _shopify_y | Shopify analytics. | 1y |
| _y | Shopify analytics. | 1y |
| _shopify_evids | Shopify analytics. | session |
| _shopify_ga | Shopify and Google Analytics. | session |
| customer_auth_provider | Shopify analytics. | session |
| customer_auth_session_created_at | Shopify analytics. | session |
The length of time that a cookie remains on your computer or mobile device depends on whether it is a “persistent” or “session” cookie. Session cookies last until you stop browsing and persistent cookies last until they expire or are deleted. Most of the cookies we use are persistent and will expire between 30 minutes and two years from the date they are downloaded to your device.
You can control and manage cookies in various ways. Please keep in mind that removing or blocking cookies can negatively impact your user experience and parts of our website may no longer be fully accessible.
Most browsers automatically accept cookies, but you can choose whether or not to accept cookies through your browser controls, often found in your browser’s “Tools” or “Preferences” menu. For more information on how to modify your browser settings or how to block, manage or filter cookies can be found in your browser’s help file or through such sites as: www.allaboutcookies.org.
Additionally, please note that blocking cookies may not completely prevent how we share information with third parties such as our advertising partners. To exercise your rights or opt-out of certain uses of your information by these parties, please follow the instructions in the “Behavioural Advertising” section above.
Do Not Track
We do not alter our practices based on browser “Do Not Track” signals due to the lack of industry standards.
Changes to This Policy
We may update this policy from time to time. The updated date will always be shown at the bottom.
Complaints
As noted above, if you would like to make a complaint, please contact us by e-mail using the details provided under “Contact Us” above.
If you are not satisfied with our response to your complaint, you have the right to lodge your complaint with the relevant data protection authority. You can contact your local data protection authority, or our supervisory authority here: https://ico.org.uk/make-a-complaint/
Last updated: 08/08/2025