Privacy Policy

Who we are

Flower Says Craft is the controller of personal information used to operate this storefront and fulfil orders. Our full legal name, postal address and privacy contact details should be added here before public launch. You can currently contact us through the method shown on the storefront or by replying to an order email.

Information we collect

We may collect your name, delivery and billing addresses, email address, telephone number, account and order history, product choices, personalisation instructions, correspondence, device and security information, cookie choices and payment-related status. Payment card details are normally collected directly by our payment provider rather than stored by us.

If you order a customised product, we may also process photographs, artwork, names, dates or other content that you provide. Please only upload information you are entitled to share and avoid unnecessary sensitive personal information.

Why we use information

We use personal information to take and fulfil orders, create personalised goods, collect payment, arrange delivery, provide customer service, manage returns, maintain accounts, prevent fraud, secure and improve the storefront, keep business and tax records, resolve disputes and comply with legal obligations. We use information for marketing only where we have an appropriate lawful basis and provide an opt-out.

Our lawful bases

Depending on the activity, we rely on performance of a contract, compliance with legal obligations, our legitimate interests in operating and securing the business, or your consent. Where consent is the basis, you may withdraw it at any time without affecting processing that already took place.

Who receives information

We share only what is reasonably necessary with service providers such as payment processors, ecommerce and content-management providers, hosting and file-storage providers, delivery carriers, email providers, professional advisers and fraud-prevention or security services. We may also disclose information where required by law, to protect legal rights, or as part of a business transfer. These recipients process information under their own legal duties or our instructions, as applicable.

International transfers

Some service providers may process information outside the United Kingdom. Where data-protection law requires it, we use an approved transfer mechanism and appropriate safeguards. Details of the relevant safeguard can be requested from us.

How long we keep information

We retain order and transaction records for the period needed for customer service and legal, accounting and tax obligations. Account data is kept while the account is active and for a reasonable period afterwards. Customisation files are kept only as long as needed to produce and support the order, unless a longer period is required for a dispute or legal obligation. Security logs and cookie records are kept for proportionate periods based on risk and operational need.

Security

We use proportionate technical and organisational measures designed to protect personal information. No online system is completely risk-free, so please use a strong unique password and contact us if you believe your account or order information has been compromised.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict your personal information, object to certain processing, receive portable data, and withdraw consent. You also have rights relating to solely automated decisions where applicable. We may need to verify your identity before responding, and legal exceptions can apply.

Complaints

Please contact us first so we can try to resolve a concern. You may also complain to the UK Information Commissioner's Office at ico.org.uk, or to another competent data-protection authority where applicable.

Changes to this policy

We may update this policy when our services, providers or legal obligations change. The latest version and effective date will be published on this page.