Privacy Statement
Candy Ventures is committed to being transparent about how it collects and uses personal data and to meeting its obligations under applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”). This Privacy Statement explains how and why we collect, use, store, protect and share your personal information, the legal basis on which we process it, and the rights available to you.
Who is collecting the information?
The data controller responsible for the processing of your personal information is:
Candy Ventures S.à r.l.
2 Millewee
L-7257 Luxembourg
For any questions regarding this Privacy Statement or our processing of your personal information, please email: info@candyventures.lu
What information is being collected?
We may collect personal information when you contact us, communicate with us, visit our website, register for events, request information or otherwise interact with us.
The categories of personal information we may collect include:
- Name;
- Email address;
- Postal address;
- Company name;
- Job title;
- Telephone number;
- Records of correspondence between you and Candy Ventures;
- Your communication and marketing preferences;
- Technical information such as your IP address, browser type, operating system, pages visited, referring website, device identifiers and other information collected through cookies and similar technologies.
How will the information be used?
We may use your personal information for the following purposes:
- To respond to your enquiries and requests;
- To provide you with information, services or materials you have requested;
- To communicate with you regarding our business activities;
- To invite you to business events and networking opportunities;
- To administer and improve our website and user experience;
- To maintain the security of our systems and prevent fraud or misuse;
- To comply with applicable legal and regulatory obligations;
- To establish, exercise or defend legal claims where necessary.
What is the legal basis for processing your information?
Depending on the purpose for which we process your personal information, we rely on one or more of the following legal bases under Article 6 GDPR:
- Consent – where you have given us your consent, for example to receive certain marketing communications or where required for the use of non-essential cookies.
- Performance of a contract – where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
- Legitimate interests – where processing is necessary for our legitimate business interests, including responding to enquiries, managing business relationships, improving our services, operating our website, maintaining security and inviting business contacts to relevant events, provided these interests are not overridden by your rights and freedoms.
- Legal obligation – where processing is necessary to comply with applicable legal or regulatory requirements.
Will the information be shared with any third parties?
We do not sell your personal information.
We may share your personal information with trusted third-party service providers who process information on our behalf, including providers of website hosting, IT support, cloud storage, email services, customer relationship management systems, professional advisers (such as legal or accounting advisers), and where required, regulatory authorities or law enforcement agencies.
Where third parties process personal information on our behalf, they do so only:
- under written contractual arrangements;
- in accordance with our instructions;
- subject to confidentiality obligations; and
- using appropriate technical and organisational security measures.
International transfers
Where personal information is transferred outside the European Economic Area (“EEA”), we will ensure that appropriate safeguards are in place, including the use of European Commission approved Standard Contractual Clauses or other lawful transfer mechanisms where required under applicable data protection law.
How long will the information be kept?
We retain personal information only for as long as necessary for the purposes for which it was collected. Retention periods will depend upon the nature of your relationship with us and the applicable legal or regulatory requirements. For example, enquiry records are typically retained only for as long as necessary to manage the enquiry and any subsequent business relationship, whilst certain financial or legal records may be retained for longer where required by law or for the establishment, exercise or defence of legal claims.
When personal information is no longer required, it will be securely deleted or anonymised.
How is the information protected?
Candy Ventures takes the security of your personal information seriously.
We maintain appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access to personal information is restricted to employees, contractors and service providers who require access in order to perform their duties and who are subject to confidentiality obligations.
Your rights
Under applicable data protection law, you may have the right to:
- access your personal information;
- request correction of inaccurate or incomplete information;
- request erasure of your personal information in certain circumstances;
- request restriction of processing;
- object to processing based on our legitimate interests;
- object at any time to direct marketing communications;
- request the transfer of your personal information to you or another organisation where the right to data portability applies;
- withdraw your consent where processing is based on consent;
- lodge a complaint with the relevant supervisory authority.
Candy Ventures does not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Where you withdraw consent, this will not affect the lawfulness of processing carried out before consent was withdrawn.
Cookies
- Our website uses cookies and similar technologies to ensure the website functions correctly, improve performance, analyse website usage and enhance your browsing experience.
- Where required by law, we will obtain your consent before placing non-essential cookies, including analytics cookies, on your device. You can withdraw or amend your cookie preferences at any time using our cookie management tool.
- We use Google Analytics to help us understand how visitors interact with our website and to improve its performance. Information collected through Google Analytics is processed in accordance with Google’s privacy practices.
- You can also control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.
Complaints
If you have any questions or concerns about how we process your personal data, please contact us in the first instance using the contact details below.
If you are not satisfied with our response, you have the right to lodge a complaint with the Commission nationale pour la protection des données (CNPD) in Luxembourg, or with the supervisory authority in the country where you live or work if applicable.
Contact Details
If you wish to exercise any of your rights, have any questions regarding this Privacy Statement, or would like further information about how we process your personal information, please contact:
This Privacy Statement may be updated from time to time to reflect changes in our business activities, legal requirements or regulatory guidance. The latest version will always be made available on our website.