Privacy notice
Last updated 22 October 2026
This notice explains what Kandid Kobold does with your personal information, and what you can ask us to do about it. We are the data controller for everything described here. If you have a question about any of it, or you want to make one of the requests at the bottom of this page, email kandidkobold@gmail.com.
What we collect, and why
If you buy something
We keep your name, email address, delivery address and the contents of your order, so that we can take the order, post it to you, and answer you if something goes wrong. We need this to perform our contract with you. Orders are kept for six years, because HMRC requires us to keep business records for that long.
We never see or hold your card details. Payments are handled by Stripe, who take the card details directly and tell us only whether the payment succeeded. Stripe have their own privacy notice.
To deliver your parcel we pass your name and address to Royal Mail.
If you make an account
We keep your email address, your username, and anything you choose to add to your profile. If you sign in with Google or Discord instead of a password, we receive your email address and display name from them and keep those. We also keep your wishlist, your campaign bookings and your email preferences. This is how the account works at all, so we rely on our contract with you and on our legitimate interest in running the site.
If you turn on browser notifications, we store the subscription your browser gives us so we can send them. You can turn this off in your browser at any time.
When you simply visit
We record the pages that are requested, and alongside each one: your IP address, the make of your browser and device, your approximate country, and the site that linked you to us. We use this to see how many people visit, which products interest them, which pages are broken, and whether a visitor is new or has been here before. We also use it to spot and block anything hammering the site.
Your IP address counts as personal information. We keep these records for 90 days and then delete them automatically. They are visible only to us, we do not sell them, and we do not use them to build advertising profiles or share them with advertisers. The country is worked out on our own server using an offline database from DB-IP — your address is not sent to anyone to do it. We rely on our legitimate interest in understanding and protecting our own site.
Cookies
We set a cookie when you sign in, to keep you signed in. That is what it is for and all it is for. We do not use advertising or third-party tracking cookies. If you block it you can still browse the site, but you will not be able to stay signed in.
Who else sees your information
Only the suppliers we need to run the shop: Stripe for payments, Royal Mail for delivery, our email provider to send you order confirmations and session reminders, and Google or Discord if you choose to sign in with them. We do not sell your personal information to anyone.
Where it is kept
The site and its database run on our own hardware in the United Kingdom. Backups are held in the UK. Some of the suppliers listed above may process data outside the UK under their own safeguards.
Your rights
You can ask us to:
- give you a copy of the information we hold about you;
- correct anything that is wrong;
- delete your information, where we are not required to keep it;
- stop using it for a particular purpose, or object to us using it;
- send it to you, or to someone else, in a portable format.
Email kandidkobold@gmail.com and we will respond within one month. You can unsubscribe from marketing email at any time from your account settings or the link in the email itself; we will still send you messages about orders you have placed.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.
Changes
If we change how we use your information we will update this page and change the date at the top.