The short version
- We only collect what we need to take your order, deliver it and look after you.
- Card payments are handled securely by Stripe. We never see or store your full card number.
- We never sell your personal information.
- You can ask to see, correct or delete your information at any time.
Who we are
This website is run by [YOUR FULL LEGAL NAME], a sole trader trading as Bloom & Beyond ("we", "us" or "our"). We are the "data controller" for the personal information described in this policy, which means we decide how and why it is used.
Address: [YOUR BUSINESS ADDRESS, INCLUDING POSTCODE]
Email: [YOUR CONTACT EMAIL]
Website: bloombeyond.co.uk
We are registered with the Information Commissioner's Office (ICO), registration number [YOUR ICO REGISTRATION NUMBER].
What information we collect
Depending on how you use our website, we may collect:
- Account details: your name, email address and password (stored in a protected, encrypted form).
- Order details: the items you buy, your delivery and billing address, email address and phone number.
- Payment details: payments are taken by Stripe. We receive confirmation that you have paid, plus limited details such as the card brand and the last four digits, but never your full card number or security code.
- Messages: anything you send us when you contact us, such as questions about an order.
- Newsletter sign-up: your email address, if you choose to subscribe.
- Technical information: your IP address, browser type, device and the pages you visit, collected through cookies and similar technologies.
How and why we use your information
We only use your information when the law allows us to. The main reasons are set out below.
| What we use it for | Our legal reason |
|---|---|
| Processing and delivering your order, and sending order updates | To carry out our contract with you |
| Taking payment and helping prevent fraud | To carry out our contract with you, and our legitimate interest in keeping payments secure |
| Keeping accounts, invoices and tax records | To meet our legal obligations |
| Answering your questions and resolving problems | To carry out our contract with you, and our legitimate interest in good customer service |
| Sending marketing emails and our newsletter | Your consent, which you can withdraw at any time |
| Understanding how the website is used so we can improve it | Your consent for non-essential cookies, and our legitimate interest in improving our service |
| Protecting our legal rights | Our legitimate interest in defending or bringing legal claims |
Payments and Stripe
We use Stripe to take card and other online payments. When you pay, you enter your payment details into Stripe's secure payment system. Stripe processes that information under its own privacy policy, which you can read at stripe.com/gb/privacy. Stripe may also carry out checks to help detect and prevent fraud.
We do not see, collect or store your full card number or security code.
Who we share your information with
We only share your information with people who need it to help us run our business:
- Stripe, to take your payment.
- Delivery companies, such as [Royal Mail / your courier], so your order reaches you.
- Website hosting and technology providers, who keep our website and systems running.
- Email providers, who help us send order emails and, if you have subscribed, our newsletter.
- Our accountant or advisers, where needed for tax and legal reasons.
- Authorities, such as HMRC or the police, if the law requires us to.
We do not sell your personal information to anyone.
Transfers outside the UK
Some of our providers, including Stripe, may process information outside the UK. When this happens, we make sure appropriate protection is in place, for example a UK-approved transfer agreement or a country that the UK treats as providing adequate protection.
How long we keep your information
- Order and payment records: usually 6 years, because tax law requires us to keep accounting records.
- Your account: until you ask us to close it.
- Marketing emails: until you unsubscribe.
- Messages and enquiries: up to 2 years after we last spoke to you.
When we no longer need your information, we delete it or make sure it can no longer identify you.
Cookies
We use cookies, which are small files stored on your device. Some are essential, for example to keep items in your basket, keep you logged in and keep the site secure. Others, such as analytics or marketing cookies, are only used if you agree to them. You can change your browser settings to block cookies, but parts of the site may then stop working. For more detail, see our Cookie policy.
Marketing emails
We will only send you our newsletter or marketing emails if you have chosen to receive them. Every email includes an unsubscribe link, and you can also tell us at [YOUR CONTACT EMAIL] at any time. We will still send you important order-related emails, such as your order confirmation and delivery updates.
How we keep your information safe
Our website uses secure (HTTPS) connections, passwords are stored in an encrypted form, and access to personal information is limited to those who need it. No online system can be completely secure, but we take sensible steps to protect your information and will tell you and the ICO if a serious breach ever affects you.
Your rights
Under UK data protection law, you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information, in some cases;
- ask us to limit how we use your information, in some cases;
- object to us using your information for our legitimate interests or for direct marketing;
- ask for your information in a portable format, in some cases; and
- withdraw your consent at any time, where we rely on it.
To use any of these rights, email us at [YOUR CONTACT EMAIL]. We will not charge a fee and will normally reply within one month. We may need to check your identity first to keep your information safe.
Children
Our website is not aimed at children, and we do not knowingly collect personal information from anyone under 13. If you think a child has given us their information, please contact us and we will delete it.
Complaints
If you are unhappy with how we have used your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last changed. If we make an important change, we will let you know on our website or by email.
Contact us
If you have any questions about this policy or your information, please contact [YOUR FULL LEGAL NAME], trading as Bloom & Beyond, at [YOUR CONTACT EMAIL], or write to us at [YOUR BUSINESS ADDRESS, INCLUDING POSTCODE].