This privacy policy explains how Bloom Craft Studio processes personal data when you use the website, submit an enquiry, or place a flower order. It follows the data lifecycle from collection through use, sharing, retention, and deletion.
This introduction summarizes the subjects addressed in the policy and points to related internal guidance.
Data handling overview
This section outlines the categories of personal information we may process, where that information comes from, the types of cookies used on the site, and the controls available to you.
We collect the information you submit through our contact channels, including your name, email address, phone number if provided, inquiry message, and service preferences. We also process limited technical data such as server request metadata and browser or device information when you use the website.
Most personal data is provided by you when you place a bouquet request, ask about availability, confirm budget or color preferences, or contact us for pickup or delivery arrangements. Technical data is generated automatically when the site is accessed and used for security, delivery, and basic operation.
The confirmed cookie uses are essential site operation and saving privacy preferences. These cookies help the website function properly and remember your choices. No active use of analytics or marketing cookies is confirmed in this policy.
We use essential cookies to support core site functions and cookies that remember privacy preferences. Because tracking is not enabled, we do not state that analytics or marketing cookies are in active use. You may manage cookies through your browser, but disabling essential cookies may affect site operation.
We use personal data to respond to contact form submissions, manage bouquet requests, confirm budget and color preferences, check availability, arrange payment, and coordinate studio pickup or local delivery. We also use technical data to maintain website security, support delivery of the site, and keep the service functioning reliably.
We may share personal data with service providers that support website operation, technical delivery, contact handling, or security functions. These recipients are expected to process data only for the services they provide to us and to protect it under appropriate confidentiality and security obligations.
We may disclose personal data when necessary to comply with applicable law, lawful requests from public authorities, or obligations arising from dispute handling, fraud prevention, or recordkeeping requirements. Any disclosure is limited to what is reasonably necessary for the relevant purpose.
You may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to request portability where applicable. We assess each request in light of the legal basis, the purpose of processing, and any duty to keep records.
To exercise a privacy right, submit a clear request through one of the contact channels in this policy and describe the data or processing concern involved. We may ask for information needed to verify your identity and to locate the relevant records before responding.
We retain personal data for the period needed to handle your enquiry, complete the requested service, maintain business records, resolve disputes, and meet legal or accounting obligations. When the relevant purpose ends, data is deleted, anonymised, or otherwise removed from active use according to our internal lifecycle practices.
If we make material changes, we will update the policy text and use reasonable means to draw attention to the revised version when appropriate. The updated policy applies from its stated effective date.
Bloom Craft Studio processes personal data as a controller for website enquiries, order handling, technical delivery, and security. Where GDPR applies, processing is based on a lawful ground appropriate to the purpose, such as responding to a request, performing a service, meeting legal obligations, or relying on legitimate interests for secure and reliable operation.
Where GDPR applies, users in the European Economic Area may rely on the rights and safeguards described in this policy.
Where GDPR applies, you may request access, correction, deletion, restriction, objection, or portability of your personal data, subject to legal limits and the nature of the processing. If consent is used for a specific activity, you may withdraw it for future processing without affecting prior lawful processing.
