Privacy Policy

1. Overview & Data Controller

AYZANA (“we”, “our”, “us”) respects your privacy and is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For the purposes of applicable data protection law, AYZANA is the Data Controller responsible for your personal data collected via this website (ayzana.co.uk).

2. Personal Data We Collect

We may collect, use, store, and transfer the following types of personal data:

• Identity & Contact Data: Full name, delivery address, billing address, email address, and telephone number.
• Personalisation Data: Any bespoke text, personal names, or dedication notes requested for custom candle label printing.
• Financial & Transaction Data: Order reference, date of purchase, products purchased, and payment confirmation status. (Note: We do not store credit or debit card numbers; all payments are processed securely via tokenized encryption by Stripe).
• Technical & Usage Data: IP address, browser type, device information, operating system, and interaction details gathered via essential and consented cookies.

3. Legal Bases for Processing

Under Article 6 of the UK GDPR, we process your personal data under the following lawful grounds:

• Contractual Necessity: To process your order, hand-pour your chosen candle creations, apply custom artwork, and arrange Royal Mail tracked dispatch.
• Legal Obligation: To maintain accurate financial transaction records for HMRC statutory tax compliance.
• Legitimate Interests: To prevent fraudulent transactions, protect network security, and manage customer service inquiries.
• Consent: Where you have explicitly opted in to receive marketing newsletters or enabled optional performance cookies.

4. Third-Party Service Providers (Data Processors)

We only share data with vetted third-party service providers strictly necessary to operate our store:

• Manufacturing & Dropship Partner: We partner with CD Distribution (Candle Drop UK) to freshly pour, label, cure, and package your candles. Only your name, shipping address, and chosen label artwork are transmitted for order fulfillment.
• Payment Processors: Stripe Payments Europe Ltd processes payments under PCI-DSS Level 1 compliance.
• Postal Carriers: Royal Mail and domestic parcel carriers receive delivery names, addresses, and tracking notification emails.

5. Data Retention

We retain customer order records for 7 years to comply with statutory UK accounting and HMRC tax regulations. Marketing consent data is retained until you withdraw consent by clicking “Unsubscribe” or emailing us.

6. Your Statutory Rights Under UK GDPR

Under the Data Protection Act 2018, you hold the following rights:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may ask us to correct inaccurate or incomplete data.
• Right to Erasure (‘Right to be Forgotten’): You may request deletion of data where retention is no longer legally required.
• Right to Restrict Processing: You may request that we suspend processing your data.
• Right to Data Portability: You may request transfer of your data to another service.

To exercise any of these rights, please email [email protected]. We respond to all verified requests within one calendar month.

7. Complaints & The Information Commissioner's Office (ICO)

If you believe your personal data has been handled unlawfully, you have the right to lodge a complaint with the UK supervisory authority: