Privacy Policy

Bloomelle respects your privacy and takes the protection of your personal data seriously. This policy explains what personal data we collect, why we collect it, the lawful basis for using it, how long we keep it, and the rights you have. We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is responsible for your data

Bloomelle is the data controller for the personal data described in this policy. If you have any questions or wish to exercise your rights, contact us at anna@bloomelle.co.

2. What data we collect

• Identity and contact details: your name, email address, delivery and billing address, and phone number.
• Order and account details: what you bought, order history, and subscription preferences. We do not store your full card details; payments are handled by our payment providers.
• Communications: emails and messages you send us, and your marketing preferences.
• Technical and usage data: your IP address, device and browser type, and how you use our site, collected through cookies and similar technologies.

3. How and why we use your data, and our lawful basis

• To fulfil your order and manage subscriptions (process payment, deliver, provide support). Lawful basis: performance of our contract with you.
• To meet legal and accounting obligations (tax records, fraud prevention). Lawful basis: legal obligation.
• To send marketing emails about our products and offers, where you have signed up. Lawful basis: your consent, which you can withdraw at any time. We may also contact existing customers about similar products under the "soft opt-in" permitted by the Privacy and Electronic Communications Regulations, and every message includes an easy way to opt out.
• To improve our site, products and service and keep the site secure. Lawful basis: our legitimate interests in running and improving our business, balanced against your rights.

4. Email marketing with Klaviyo

We use Klaviyo, an email marketing platform, to manage our mailing list and send marketing and service emails. When you sign up, your name, email address and relevant order and engagement data (such as whether you opened an email or made a purchase) are stored and processed by Klaviyo on our behalf so we can send you relevant messages and understand what is useful. Klaviyo acts as our data processor under a contract that requires it to protect your data. You can unsubscribe at any time using the link at the foot of any marketing email, or by emailing anna@bloomelle.co, and we will stop sending marketing messages. Unsubscribing from marketing does not stop essential service messages about your orders.

5. Who we share your data with

We share personal data only where necessary, with:

• Shopify, which hosts our store and processes orders;
• payment providers who process your payment securely;
• delivery partners who fulfil your order;
• Klaviyo for email marketing, as described above;
• professional advisers and authorities where we are required to by law.

We do not sell your personal data. Where any provider is based outside the UK, we ensure appropriate safeguards are in place, such as UK-approved standard contractual clauses.

6. Cookies

We use cookies and similar technologies to make the site work, to remember your preferences, to understand how the site is used, and, where you agree, for marketing. You can control non-essential cookies through the cookie settings on our site and through your browser. Turning off some cookies may affect how the site works.

7. How long we keep your data

We keep personal data only as long as we need it. Order and transaction records are kept for as long as required for accounting and tax purposes (generally six years). Marketing data is kept until you unsubscribe or ask us to delete it, and we review our list periodically to remove inactive contacts. Account data is kept while your account is active.

8. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your data;
• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted in certain circumstances;
• restrict or object to certain processing, including marketing;
• data portability, to receive your data in a common machine-readable format;
• withdraw consent at any time where we rely on consent.

To exercise any of these rights, email anna@bloomelle.co. We will respond within one month. You will not usually have to pay a fee.

9. How we protect your data

We use appropriate technical and organisational measures to keep your data secure, including encryption for payments and secure, access-controlled systems. No method of transmission over the internet is completely secure, but we work to protect your data and to notify you and the regulator of any breach where required.

10. Complaints

If you are unhappy with how we handle your data, please contact us first at anna@bloomelle.co so we can put things right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. The current version will always be on this page, with the date it was last updated shown above.

12. Contact

For any question about this policy or your personal data, email anna@bloomelle.co.