This policy explains what personal data we collect when you order from bloomgram.co.uk, what we do with it, and your rights under UK GDPR. We try to keep it plain English.

Who we are

bloomgram is a UK small business. The data controller is the owner of bloomgram.co.uk. Contact: via our contact form.

What we collect

• From you, the sender: name, email address, billing address, the message you write, and payment details (processed by Stripe — we never see card numbers)
• About the recipient: their name and delivery address, supplied by you
• From the recipient (optional): if they choose to send a thank-you photo, we collect that photo, any message they include, and their email address if they provide one
• Automatically: a session ID and visitor ID (no real name attached) for cart-abandonment reminders and analytics

Why we collect it

• To fulfil your order (process payment, pack and ship the gift) — legal basis: contract
• To send transactional emails (order confirmation, despatch, delivered, thank-you-received) — legal basis: contract
• To send marketing emails (offers, news) — only if you opt in. Legal basis: consent. You can unsubscribe at any time
• To prevent fraud and meet our legal obligations — legal basis: legitimate interest / legal obligation

Who we share it with

• Stripe — payment processing
• Evri — for delivery (name + address only)
• Resend — for sending transactional and marketing emails
• Supabase & Hostinger — our database and hosting providers (UK/EU data centres)

We never sell your data. We never share it for anyone else's marketing.

How long we keep it

• Order records: 6 years (HMRC requirement)
• Marketing email list: until you unsubscribe
• Thank-you photos: kept indefinitely unless you ask us to delete them
• Visitor/session IDs: 12 months

Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the data we hold about you
• Ask us to correct anything wrong
• Ask us to delete your data (subject to legal retention rules)
• Withdraw consent for marketing at any time
• Complain to the Information Commissioner's Office

Use our contact form to exercise any of these rights. We'll respond within 30 days.

Cookies

We use a small number of cookies to keep the site working and remember whether you have visited before. No advertising cookies or third-party tracking pixels are used.

Changes

We'll update this page if anything material changes. Significant changes will be notified by email to active subscribers.