Privacy

Bloomiva Ltd is the data controller for any personal data you give us through this website. We hold as little as possible, for as short a time as possible, and we never sell it.

1 · What we collect

• Order data — name, billing & delivery address, email, phone (optional). Required to fulfil your order.
• Payment data — handled by Stripe. We never see your full card number.
• Account data — if you create an account: email, hashed password, order history.
• Marketing — your email, only if you subscribe to the seasonal letter.
• Site analytics — anonymous, aggregated traffic data via Plausible Analytics. No cookies, no fingerprinting.

2 · Lawful basis

Order, payment, and account data are processed on the basis of contract performance. Marketing emails are processed on the basis of consent, which you can withdraw at any time. Analytics is processed on the basis of legitimate interests — we want to know which pages people read, but we don't need to know who they are.

3 · How long we keep it

• Order records: 7 years (UK accounting requirement).
• Account data: until you ask us to delete it.
• Marketing email: until you unsubscribe.
• Analytics: 12 months, aggregated only.

4 · Who we share it with

• Stripe — payment processing.
• Royal Mail / DHL — delivery.
• Postmark — transactional emails (order confirmations).
• Buttondown — newsletter (only if you've subscribed).

We don't share your data with anyone else. Ever. No advertisers, no data brokers, no "marketing partners".

5 · Your rights (UK GDPR)

• Access — ask for a copy of what we hold about you.
• Rectification — correct anything that's wrong.
• Erasure — ask us to delete your data (subject to the 7-year accounting rule for orders).
• Portability — receive your data in a machine-readable format.
• Object — opt out of marketing at any time.
• Complain — to the Information Commissioner's Office at ico.org.uk.

To exercise any of these, write to director@bloomiva.ltd. We respond within 30 days.

6 · Cookies

We use only essential cookies (cart, checkout, login). No tracking cookies. See our Cookie policy for the full list.

7 · International transfers

Some of our processors (e.g. Stripe) transfer data outside the UK. These transfers are covered by the UK International Data Transfer Agreement and Standard Contractual Clauses.

8 · Changes

If we change this policy materially we'll email anyone who's bought from us in the last 12 months and post a banner at the top of the site for 30 days.