Privacy policy

Last updated: 13/08/2026

1. About this Privacy Policy

This Privacy Policy explains how Blue Lantern Ltd, trading as Kan Jade, collects, uses, stores and shares personal information when you:

  • visit or use https://kanjade.com (the “Website”)

  • create or use a customer account

  • purchase or return a product

  • subscribe to marketing

  • submit a review

  • contact us

  • otherwise interact with Kan Jade

Blue Lantern Ltd is the controller of the personal information described in this Privacy Policy, except where another organisation acts as a separate controller.

Our details are:

Blue Lantern Ltd, trading as Kan Jade
Company number: 16874990
Registered in England and Wales
Registered office: 71–75 Shelton Street, Covent Garden, London, England, WC2H 9JQ
Email: support@kanjade.com

Our registered office is provided through a third-party registered-office service. It is not a retail shop, customer-service location or returns facility. Privacy enquiries should be sent by email to support@kanjade.com.

In this policy, “personal information” means information relating to an identified or identifiable individual. Information that has been irreversibly anonymised so that no individual can be identified is not personal information.

2. Personal information we collect

The personal information we collect depends on how you interact with us.

Identity and contact information

This may include:

  • your name

  • billing address

  • delivery address

  • email address

  • telephone number

  • account username or identifier

Order and transaction information

This may include:

  • products viewed, added to a basket or purchased

  • order numbers

  • purchase dates and amounts

  • delivery details

  • payment status

  • discounts used

  • returns, cancellations and refunds

  • correspondence concerning an order

  • previous transactions with us

Payment information

Payments are processed through Shopify and the payment providers made available at checkout.

We may receive limited payment-related information, such as:

  • the payment method used

  • payment status

  • transaction reference

  • billing address

  • limited card details, such as the card type and final digits

We do not normally receive or store your complete payment-card number or security code.

Payment providers process payment information under their own privacy notices and security obligations.

Account information

If customer accounts are available and you create one, we may process:

  • your login email or username

  • an account identifier

  • saved addresses

  • order history

  • account settings

  • preferences

Passwords and authentication information are handled through Shopify or the relevant authentication provider. We do not have access to your password in readable form.

Communications and customer-service information

This may include:

  • emails and messages you send us

  • enquiries, requests and complaints

  • information provided when arranging a return

  • photographs you provide concerning a damaged or faulty product

  • records of our responses

Please do not send us sensitive personal information unless it is necessary for us to deal with your request.

Reviews and submitted content

If you submit a product review, photograph or other content, we may process:

  • your name or chosen display name

  • your review and rating

  • photographs or other content submitted

  • the product purchased

  • verification that a purchase occurred

  • any incentive or benefit connected with the review

Reviews may be displayed publicly on the Website. Do not include personal information in a review that you do not want to make public.

Device, Website and usage information

When you use the Website, we and our technology providers may collect:

  • IP address

  • browser type and version

  • device type

  • operating system

  • approximate location derived from an IP address

  • cookie and similar technology identifiers

  • pages viewed

  • links or buttons selected

  • referring website

  • dates and times of visits

  • basket activity

  • information about errors, security events and Website performance

Some of this information is collected through cookies, pixels, tags, local storage and similar technologies. Further information is provided in the “Cookies and similar technologies” section below.

Marketing information

If you subscribe to marketing or where we are otherwise legally permitted to contact you, we may process:

  • your name and email address

  • marketing preferences

  • the date and method by which you subscribed

  • records of consent or opt-out

  • whether a marketing email was delivered, opened or selected, where permitted and

  • information used to understand the effectiveness of our marketing

3. How we collect personal information

We may collect personal information:

Directly from you

For example, when you:

  • place an order

  • create an account

  • contact us

  • request a return

  • subscribe to marketing

  • submit a review

  • provide information through the Website

Automatically

We may collect information automatically when you use the Website through cookies and similar technologies.

Non-essential technologies will be used only where legally permitted, including where any required consent has been obtained.

From service providers

We may receive information from organisations that help us operate the business, including:

  • Shopify

  • payment providers

  • delivery companies

  • fraud-prevention providers

  • analytics providers

  • marketing platforms

  • review platforms

From other people

A customer may provide another person’s name, address or contact details when:

  • purchasing a gift

  • arranging delivery to another person

  • nominating someone to receive an order

If you provide another person’s information, you should ensure that you are authorised to do so and that the information is accurate.

4. How and why we use personal information

UK data-protection law requires us to have a lawful basis for processing personal information. The applicable basis depends on the purpose for which the information is used.

Processing orders and performing our contract

We use identity, contact, payment and transaction information to:

  • process and accept orders

  • take or confirm payment

  • deliver products

  • provide order updates

  • manage cancellations, returns and refunds

  • provide customer service relating to a purchase

  • administer customer accounts

Our lawful basis is that processing is necessary to take steps at your request before entering into a contract or to perform our contract with you.

If you do not provide information required to process an order, we may be unable to supply the product.

Customer service and communications

We use contact, transaction and communication information to:

  • respond to enquiries

  • investigate complaints

  • provide support

  • resolve delivery or product issues

  • maintain records of our communications

Our lawful bases are performance of our contract where the communication relates to a purchase, and our legitimate interests in providing effective customer service, resolving disputes and operating our business.

Legal and regulatory obligations

We may use and retain personal information to:

  • maintain accounting and tax records

  • comply with consumer-protection obligations

  • respond to valid requests from courts, regulators or public authorities

  • manage product-safety matters or recalls

  • establish, exercise or defend legal claims

  • comply with other legal obligations

Our lawful basis is compliance with a legal obligation. Where a particular use is not strictly required by law, we may rely on our legitimate interests in protecting our legal rights and operating the business responsibly

Security and fraud prevention

We use account, transaction, device and usage information to:

  • protect the Website, accounts and transactions

  • verify or authenticate activity

  • detect and prevent fraud

  • investigate suspicious, abusive or unlawful activity

  • protect our customers, business and service providers

Our lawful basis is our legitimate interests in protecting the security and integrity of our business, customers and Website. In some circumstances, processing may also be necessary to comply with a legal obligation.

Website operation and essential cookies

We use necessary device and usage information to:

  • make the Website function

  • remember products in a basket

  • maintain security

  • process checkout

  • balance Website traffic

  • remember privacy choices

Our lawful basis under data-protection law is normally our legitimate interests in operating a secure and functional Website or performance of our contract.

Strictly necessary cookies and similar technologies do not require consent under the Privacy and Electronic Communications Regulations where the applicable exemption is satisfied.

Analytics and Website improvement

Where any required cookie consent has been obtained, we may use analytics information to:

  • understand how visitors use the Website

  • measure Website performance

  • identify errors

  • improve navigation and content

  • assess the effectiveness of changes

Where personal information is involved, our lawful basis is consent when required. You may withdraw consent at any time through the Website’s cookie settings.

Marketing by email

We may send marketing emails where:

  • you have given valid consent

  • the UK electronic-marketing “soft opt-in” applies because we obtained your details in connection with a sale or negotiation for a sale, the marketing concerns our own similar products, and we gave you a clear opportunity to opt out when collecting your details and in every subsequent message

Where we rely on consent, our lawful basis under UK data-protection law is consent.

Where the soft opt-in applies, we rely on our legitimate interests under UK data-protection law and comply separately with the Privacy and Electronic Communications Regulations.

You may unsubscribe at any time by:

Unsubscribing from marketing will not prevent us from sending necessary service messages concerning an order, return, account or legal matter.

Online advertising

If we use advertising cookies or similar technologies, we and our advertising providers may process device, cookie, usage and transaction information to:

  • measure advertising performance

  • limit how often an advertisement is shown

  • understand whether an advertisement resulted in a visit or purchase

  • display advertising based on browsing activity

We will use non-essential advertising technologies only where legally permitted, including where required consent has been obtained.

Our lawful basis for processing personal information through such technologies is consent where required. You can withdraw consent through the Website’s cookie settings.

Your choices apply to our use of data through the Website. Third-party platforms may provide additional privacy and advertising controls through their own services.

Reviews and customer content

We use review and submitted-content information to:

  • verify and publish genuine reviews

  • moderate unlawful, misleading or inappropriate material

  • answer a review where appropriate

  • improve our products and customer service

  • promote Kan Jade where the necessary permissions exist

Our lawful bases are our legitimate interests in gathering genuine customer feedback, maintaining trustworthy reviews and promoting our products, and consent where required for a particular use.

We will not create or commission fake reviews or conceal genuine negative reviews merely because they are unfavourable.

Business administration and transactions

We may process relevant information for:

  • internal administration

  • audits

  • professional advice

  • insurance

  • financing

  • the sale, restructuring or transfer of all or part of the business

  • business continuity

Our lawful basis is our legitimate interests in managing and developing the business. We will consider and protect the rights and interests of affected individuals.

5. Our legitimate interests

Where we rely on legitimate interests, we consider whether the processing is necessary and whether your rights and interests override ours.

Our legitimate interests may include:

  • operating and improving Kan Jade

  • providing customer service

  • protecting the Website and transactions

  • preventing fraud

  • maintaining accurate business records

  • understanding business performance

  • protecting and enforcing legal rights

  • managing genuine customer reviews

  • marketing our own similar products where legally permitted

You may have the right to object to processing based on legitimate interests. See “Your data-protection rights” below.

6. Cookies and similar technologies

The Website uses cookies and similar technologies, such as pixels, tags, local storage and scripts.

These technologies may be classified as:

  • Strictly necessary: required for security, checkout, basket functions and core Website operation.

  • Functional: used to remember choices or provide enhanced Website features.

  • Analytics: used to understand Website use and performance.

  • Advertising: used to measure or personalise advertising.

We may use strictly necessary technologies without consent where the relevant legal exemption applies.

We will seek consent before using non-essential cookies or similar technologies where consent is legally required. Rejecting non-essential cookies should be as straightforward as accepting them.

You can review or change your choices through the Website’s cookie banner or cookie settings. Withdrawing consent does not affect processing that occurred before withdrawal.

Your browser may also allow you to block or delete cookies. Blocking necessary cookies may prevent parts of the Website, including checkout, from functioning correctly.

The Website’s cookie settings or separate Cookie Policy should identify the cookies and technologies currently in use, their providers, purposes and durations.

7. Who we share personal information with

We disclose personal information only where necessary and in accordance with applicable law.

Recipients may include:

Shopify

Our Website is hosted and supported by Shopify.

Shopify processes personal information to provide hosting, checkout, account, security and ecommerce services. Depending on the relevant feature, Shopify may act as our processor or as a separate controller.

You can read the Shopify Consumer Privacy Policy for more information about Shopify’s own processing.

Payment providers

Payment providers process payment and transaction information to:

  • authorise payments

  • prevent fraud

  • process refunds

  • meet their own legal and regulatory obligations

Payment providers may act as separate controllers for some of their processing.

Delivery providers

We provide delivery companies with information necessary to deliver an order, such as the recipient’s name, delivery address, contact details and delivery instructions.

Technology and professional service providers

We may use providers that support:

  • Website hosting and maintenance

  • email delivery

  • customer service

  • data storage

  • analytics

  • fraud prevention

  • reviews

  • accounting

  • legal advice

  • insurance

  • business administration

These providers are permitted to use information only for the relevant service or for purposes they independently disclose where they act as separate controllers.

Marketing and advertising providers

Where legally permitted, including where any required consent has been obtained, we may disclose limited device, cookie, usage or transaction information to marketing and advertising providers.

The providers and technologies actually used should be identified through the Website’s cookie-management tool or Cookie Policy.

Public authorities and legal recipients

We may disclose information:

  • where required by law

  • in response to a valid court order or regulatory request

  • to establish, exercise or defend legal claims

  • to investigate suspected fraud or unlawful conduct

  • to protect the rights, property or safety of Blue Lantern Ltd, our customers or others

We assess whether a request is valid, necessary and proportionate before disclosing information where we are legally able to do so.

A buyer or successor to the business

If Blue Lantern Ltd or the Kan Jade business is sold, reorganised or transferred, relevant personal information may be shared with professional advisers, potential purchasers and the eventual successor.

Information will be limited and protected as appropriate during that process.

We do not sell personal information for monetary payment.

8. International transfers

Some of our service providers, including Shopify and certain technology providers, may process personal information outside the United Kingdom.

Where a transfer is restricted under UK data-protection law, we will ensure that an approved transfer mechanism applies. Depending on the destination and recipient, this may include:

  • UK adequacy regulations

  • the UK International Data Transfer Agreement

  • the UK Addendum to the European Commission’s Standard Contractual Clauses

  • another legally permitted safeguard or exception

Where required, we or the relevant provider will assess whether the transfer mechanism provides appropriate protection.

You may contact us at support@kanjade.com for further information about the safeguards relevant to your personal information.

9. How long we retain personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

We generally apply the following retention periods:

  • Order, payment and transaction records: normally six years after the end of the financial year in which the relevant transaction occurred, where needed for tax, accounting and legal purposes.

  • Customer-account information: while the account remains active and for a reasonable period afterward, unless earlier deletion is appropriate or longer retention is legally required.

  • Customer-service enquiries and complaints: for as long as necessary to resolve the matter and normally for up to six years where the communication may be relevant to a contract, complaint or legal claim.

  • Marketing subscription records: while you remain subscribed.

  • Marketing opt-out records: retained as a minimal suppression record for as long as necessary to ensure that we respect your opt-out.

  • Cookie-consent records: for the period needed to demonstrate and manage your privacy choices, after which consent may be requested again.

  • Reviews and submitted content: while the review or content remains published or is otherwise reasonably required, subject to applicable removal rights and legal obligations.

  • Security and fraud-prevention records: for as long as reasonably necessary to investigate an incident, protect the business and comply with legal requirements.

We may retain information for longer where necessary because of:

  • an actual or reasonably anticipated legal claim

  • a regulatory investigation

  • suspected fraud

  • product-safety obligations

  • another legal requirement

When personal information is no longer required, we will delete it, anonymise it or securely restrict its use.

10. Security

We use reasonable technical and organisational measures designed to protect personal information against:

  • unauthorised access

  • accidental loss

  • unlawful disclosure

  • alteration

  • destruction

These measures may include access controls, authentication, encryption where appropriate, secure service providers, software updates and staff or contractor access restrictions.

No method of electronic transmission or storage is completely secure. We therefore cannot guarantee absolute security.

You are responsible for keeping your account credentials confidential. Please contact us promptly if you believe that your account or personal information has been compromised.

Do not send complete payment-card details or other unnecessary sensitive information by ordinary email.

11. Children’s information

The Website and our products are intended for a general audience, but orders may be placed only by someone aged 18 or over.

We do not knowingly collect personal information directly from children for the purpose of allowing them to place orders.

A customer may provide a child’s name or delivery information when buying a gift. We will use that information only as reasonably necessary to fulfil the order.

If you believe that a child has provided personal information to us without appropriate authority, please contact support@kanjade.com. We will investigate and delete or restrict the information where appropriate.

12. Automated decision-making

We do not currently make decisions about customers based solely on automated processing that produce legal or similarly significant effects.

Our payment, security or fraud-prevention providers may use automated tools to assess transactions. Where a provider acts as a separate controller, its own privacy notice will explain that processing and any available rights.

If our practices change so that we carry out relevant solely automated decision-making, we will update this Privacy Policy and provide the information required by law.

13. Your data-protection rights

Depending on the circumstances, UK data-protection law may give you the following rights:

Access

You may request confirmation that we process your personal information and obtain a copy of it, together with certain supporting information.

Rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

Erasure

You may ask us to delete personal information in certain circumstances. This right does not apply where we need to retain the information for a legal obligation, legal claim or another lawful reason.

Restriction

You may ask us to restrict how we use personal information in certain circumstances.

Objection

You may object to processing based on legitimate interests. We will stop the processing unless we have compelling legitimate grounds to continue or the processing is needed for legal claims.

You have an absolute right to object to the use of your personal information for direct marketing.

Data portability

Where processing is based on consent or contract and carried out by automated means, you may request certain personal information in a structured, commonly used and machine-readable format. You may also ask us to transmit it to another controller where technically feasible.

Withdrawal of consent

Where we rely on consent, you may withdraw it at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights relating to automated decisions

Where applicable, you may have rights concerning decisions made solely through automated processing that have legal or similarly significant effects.

Complaining to a supervisory authority

You have the right to complain to the Information Commissioner’s Office. Details are provided in the “Complaints” section below.

These rights are not absolute and may be subject to legal conditions or exemptions.

14. Exercising your rights

To exercise a data-protection right, email support@kanjade.com.

Please state:

  • your name

  • the right you wish to exercise

  • the information or activity concerned

  • any information that will help us locate the relevant records

We may request reasonable information to verify your identity. We will not request more information than necessary for that purpose.

You may authorise another person to act on your behalf. We may ask for evidence of their authority and may need to verify your identity directly.

We will normally respond without undue delay and within one month. We may extend this period where permitted for a complex request or multiple requests, in which case we will explain the extension.

We do not normally charge a fee. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, as permitted by law.

15. Marketing choices

You can unsubscribe from marketing emails at any time by:

We may retain a minimal record of your email address on a suppression list so that we do not send marketing to you again.

You can withdraw consent for advertising and analytics cookies through the Website’s cookie settings.

Stopping marketing does not prevent us from sending necessary messages relating to:

  • an order

  • delivery

  • a return or refund

  • account security

  • a product-safety matter

  • another service or legal notification

16. Third-party websites

The Website may contain links to websites, applications or services operated by third parties.

Those organisations may collect and use personal information under their own privacy policies. We do not control and are not responsible for their independent privacy practices.

You should review the relevant third party’s privacy information before providing personal information to it.

A link from our Website does not necessarily mean that we endorse the third party or its privacy practices.

17. Complaints

If you have a concern about how we use personal information, please contact us first at support@kanjade.com. We will investigate and attempt to resolve your concern.

You also have the right to complain to the UK data-protection regulator:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

You may contact the ICO without contacting us first, although the ICO may recommend giving us an opportunity to resolve the matter.

If you normally live or work outside the UK, you may also have the right to contact the data-protection authority in the relevant country.

18. Changes to this Privacy Policy

We may update this Privacy Policy when:

  • our processing activities change

  • we introduce or remove service providers or technologies

  • applicable law or regulatory guidance changes

  • an update is otherwise necessary to keep the information accurate

We will publish the revised policy on the Website and update the “Last updated” date.

Where a change is material, we will provide an additional notice where required by law.

19. Contact us

Blue Lantern Ltd is the controller responsible for the personal information described in this Privacy Policy.

Privacy questions, requests and complaints should be sent to:

Blue Lantern Ltd, trading as Kan Jade
Company number: 16874990
Registered in England and Wales
Registered office: 71–75 Shelton Street, Covent Garden, London, England, WC2H 9JQ
Email: support@kanjade.com

The registered office is used for statutory company purposes. It is not a customer-service or returns facility. Please send privacy enquiries by email.