1. Who we are
Cheshire Blooms is the data controller for the information described in this policy.
Independent, family-run floristry studio trading from: Unit 4 Alexandra Industrial Estate, Alexandra Rd, Denton, Greater Manchester, M34 3DX.
For any question regarding your data or to exercise your rights, please contact us at [email protected].
2. What we collect
When you enquire or order: your name, email address, telephone number, and where relevant your postal address, event date, venue, and details of what you would like us to make.
When you pay: the amount, date and method of payment, and our invoice records. We do not see or store your card details — these are handled directly by our secure payment provider.
Funeral and sympathy orders: the name of the person who has died, the funeral director, the date, time and place of the service, delivery details, and the wording you would like on the tribute card.
Allergies and health information: only where you inform us, and strictly so that we can avoid particular flowers or materials. This is treated as sensitive information and is deleted once your order is complete.
When you use our website: technical information such as your IP address, browser type and the pages you visit. See the Cookie Policy for full details.
When you contact us on social media or messaging apps: whatever you choose to send us, including inspiration photographs and palette swatches.
We do not buy personal data, and we do not collect information about children.
3. Why we collect it, and our lawful basis
Under UK data protection law, we must have a lawful basis for processing your personal data. The table below outlines how and why we use your details:
| What we use it for | Lawful basis under UK GDPR |
|---|---|
| Answering your enquiry and preparing a bespoke quotation | Steps taken at your request before entering a contract |
| Fulfilling your order, including stem sourcing, delivery and venue set-up | Performance of a contract |
| Taking payment and managing invoices | Performance of a contract, and legitimate interest in being paid |
| Keeping accounting and statutory tax records | Legal obligation (HMRC compliance) |
| Avoiding flowers or foliage you are allergic to | Your explicit consent |
| Sending occasional seasonal floral updates or anniversary follow-ups | Your consent, which you can withdraw at any time |
| Responding to feedback, queries or defending claims | Our legitimate interest in running the business properly |
| Keeping our website secure, functional and reliable | Our legitimate interest |
4. Who we share it with
We share only what is strictly necessary, and exclusively with trusted partners required to deliver our service:
- Your venue, funeral director, planner or coordinator: where needed to deliver or install your flowers (normally your name, event date, and delivery schedule).
- Couriers or dedicated delivery drivers: where specialized transport is required for large installations.
- Our payment processing providers: for secure, encrypted transaction handling.
- Our certified accountant and HMRC: where required by UK statutory accounting and tax law.
- Our website hosting and email service providers: who securely store operational data on our behalf under data processing agreements.
- We never sell your personal information, and we never share it with third parties for marketing purposes.
We may disclose information where legally required to do so by law or court order, or to establish or defend our legal rights.
5. Card messages and gift orders
Where you order flowers to be delivered to someone else, we use the recipient’s name and delivery address only to complete the delivery, and the message you provide only to handwrite the card.
We do not add gift recipients to any marketing lists, and we delete their personal details once delivery is complete and any receipt query has been resolved.
6. How long we keep it
We only keep your personal information for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting and reporting requirements.
| Information Type | Retention Period |
|---|---|
| Enquiries that do not lead to an order | 12 months from enquiry date |
| Order and event specifications | 7 years from event date (accounting and insurance) |
| Invoices and financial transactions | 6 years after the end of the relevant tax year (HMRC requirement) |
| Allergy and dietary/health notes | Deleted immediately once order is fulfilled |
| Recipient details for gift deliveries | 3 months after delivery confirmation |
| Marketing contacts | Until you unsubscribe, or after 24 months of no engagement |
| Website technical analytics | 26 months maximum |
7. Photographs & portfolio
We photograph the floral arrangements we create for our portfolio, website, and social media channels.
Photographs of floral arrangements alone are not personal data. Where an image includes identifiable people (such as couples or guests), we will never publish it without prior consent.
We do not publish full client surnames or identify specific private venues without permission. Photographs of sympathy or funeral tributes are never shared publicly unless the family has expressly requested and agreed.
If you would prefer us not to photograph or publish images of your flowers, please tell us at any time. We will respect your wishes without question, and it will never affect your order.
8. International data transfers
Where any of our digital service providers (such as cloud backup or secure email) store data outside the UK, we ensure appropriate safeguards are maintained in compliance with the UK International Data Transfer Agreement (IDTA) or UK adequacy regulations.
9. Cookies and website tracking
Our website uses cookies and similar technologies to ensure seamless navigation, secure contact forms, and aggregated traffic insights.
Essential cookies are required for the website to function. Non-essential cookies (such as analytics) are only activated with your consent.
For detailed information on the specific cookies we use and how to control your preferences, please consult our dedicated Cookie Policy.
10. Marketing communications
We will only send you marketing emails or seasonal announcements if you have actively opted in, or if you are an existing client and the communication relates to similar floral services.
Every marketing email includes a clear one-click unsubscribe link. You may also contact us directly at any time to opt out.
We never send marketing communications to anyone who has contacted us regarding funeral or sympathy tributes, unless they have separately requested to join our mailing list.
11. Your legal rights
Under UK data protection law (UK GDPR), you have the following rights:
- Right to be informed: about how we collect and use your personal data (this policy).
-
Right of access: to request a copy of the personal information we hold about you.
-
Right to rectification: to have inaccurate or incomplete data updated promptly.
-
Right to erasure: to request that we delete your data where no overriding legal basis requires its retention.
-
Right to restrict processing: to limit how we use your details while a query is investigated.
-
Right to object: to processing based on legitimate interests or direct marketing at any time.
-
Right to data portability: to receive your data in a structured, commonly used electronic format.
-
Right to withdraw consent: at any time where processing was based on your prior consent.
To exercise any of these rights, please email us at [email protected]. We respond to all requests within one calendar month, free of charge.
We do not make automated decisions or carry out profiling based on your personal data.
12. Complaints & supervisory authority
If you have any concerns about how we handle your information, please contact us first at [email protected] so that we can resolve the matter directly with you.
You also have the statutory right to lodge a complaint with the UK data protection supervisory authority:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 | Website: ico.org.uk
13. Security and safeguarding
We maintain physical, technical and administrative security measures to protect your personal information against unauthorized access, loss, misuse, or alteration.
All digital systems are password-protected with two-factor authentication where supported. Physical consultation notes are kept in locked facilities and safely shredded once no longer required.
While no transmission method is 100% impenetrable, in the unlikely event of a personal data breach posing a risk to your rights, we will notify you and the ICO in accordance with statutory guidelines.
14. Changes to this policy
We may review and update this policy periodically to reflect operational, legal, or regulatory updates. The most current version will always be published on this page with its revision date.