Privacy notice

Last updated 19 October 2026.

1. Who is responsible for your data

The controller of personal data collected through candyonbone.com is:

SPV Consulting Estonia OÜ

Pärnu mnt 10
10148 Tallinn
Harju maakond, Estonia
Registry code 12610821 · VAT EE101697736

Privacy contact

privacy@candyonbone.com

Because the publisher is established in the European Union, we process personal data in accordance with the General Data Protection Regulation (GDPR) and Estonian data protection law. Readers in Canada also have rights under Canadian federal and provincial privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA); where those give you a stronger right, we will honour it.

2. What we collect, and why

a. Newsletter subscription

If you subscribe to the Monthly Letter we collect your email address and nothing else. No name, no postal address, no date of birth, no financial information. We also record the date and time you subscribed and confirmed, which is the evidence of consent the law requires us to keep.

• Purpose: to send you the newsletter you asked for.
• Legal basis: your consent (GDPR Article 6(1)(a)).
• Double opt-in: after you submit the form we send one email asking you to confirm. If you do not confirm, nothing further is sent and the address is deleted.
• Withdrawing consent: every email has an unsubscribe link, and you may also write to the privacy address above. Withdrawal takes effect immediately and costs nothing.

b. Server logs

Our web server records technical information for each request — IP address, date and time, the page requested, the referring page, and browser and operating system identifiers. This is standard, automatic, and necessary to serve and secure the site.

• Purpose: delivering the site, diagnosing faults, and protecting against attacks and abuse.
• Legal basis: our legitimate interest in operating a secure, functioning website (GDPR Article 6(1)(f)).
• Retention: log data is kept for a short period for security and diagnostic purposes and then deleted or aggregated.

c. Advertising and measurement

This site is promoted through paid advertising, and advertising platforms commonly provide a measurement tag that records that a visitor arrived from an advertisement.

How this site is configured: any such measurement tag is loaded only after you choose “Accept all” on the cookie banner. If you choose “Essential only”, or ignore the banner, no advertising or measurement script is loaded and no advertising cookie is set. The site functions identically either way, and no content is withheld.

At the time of this update, no advertising measurement tag is active on candyonbone.com. If one is added later it will operate on the consent-gated basis described above, and this section will be updated to name the provider, the data it receives and the applicable transfer safeguards.

• Legal basis, if you accept: your consent (GDPR Article 6(1)(a)), withdrawable at any time by clearing this site’s stored data in your browser, which restores the banner.

We may also receive aggregated, non-identifying campaign reporting from advertising platforms — numbers of impressions and clicks. That reporting does not identify individual readers to us.

d. Links you click in an advertisement

When you arrive from an advertisement, the link may carry campaign parameters in the address (for example a campaign or click identifier). We keep those in your browser’s session storage for the duration of your visit so that a subscription can be attributed to the right campaign. They are discarded when you close the browser, and we do not place personal or sensitive data in URLs.

3. Cookies and similar storage

We use as little as we can get away with.

You can delete all of it at any time through your browser’s settings for this site. Doing so restores the consent banner.

4. Fonts, images and external content

All fonts used on this site are served from our own server. We do not load fonts, icons, analytics, social-media widgets, comment systems, video players or advertising creative from third-party content networks, so simply reading a page on this site does not disclose your IP address to any third party. Links to official government sources are ordinary links: nothing is requested from them until you choose to click.

5. Who we share data with

We do not sell personal data, and we do not share it for anyone else’s marketing. Your email address is disclosed only to:

• our email delivery provider, acting as a processor under a data processing agreement, solely to send the newsletter you asked for;
• our hosting provider, which processes server log data as a processor;
• a public authority, where we are legally required to disclose it.

Where a processor is outside the European Economic Area, the transfer is made on the basis of an adequacy decision or the European Commission’s standard contractual clauses.

6. How long we keep things

• Newsletter address: until you unsubscribe, after which it is deleted, except for a minimal suppression record so that we do not email you again by mistake.
• Unconfirmed subscriptions: deleted shortly after the confirmation window passes.
• Server logs: a short retention period for security and diagnostics.
• Correspondence: kept as long as needed to deal with the matter and any follow-up.

7. Your rights

You have the right to:

• ask what personal data we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our processing;
• receive your data in a portable form;
• withdraw consent at any time, without giving a reason and at no cost.

Write to privacy@candyonbone.com. We respond within one month. There is no charge, and you do not need to explain why.

8. Complaints

If you are unhappy with how we have handled your data you may complain to a supervisory authority.

• Estonia (our lead authority): Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) — aki.ee/en.
• European Economic Area: the supervisory authority in your country of residence.
• Canada: the Office of the Privacy Commissioner of Canada — priv.gc.ca.

9. Children

This site is intended for adults. We do not knowingly collect personal data from children, and the newsletter is not directed at them.

10. A note on security

We will never ask you, by email, telephone or on this website, for a Social Insurance Number, bank account details, credit card number or government account password. No part of this site needs them, and anyone requesting them in our name is not acting for us. If you receive such a request, please report it to privacy@candyonbone.com.

11. Changes to this notice

If we change how we handle personal data — including activating an advertising measurement tag, or changing when it loads — we will update this notice and the date at the top of it before the change takes effect.