Privacy Policy

Who we are

Edy's Flowers ("we", "us", "our") is the data controller for the personal information described in this policy. For anything data-protection related, contact us at privacy@edysflowers.co.uk.

Information we collect

Depending on how you use our site, we collect:

• ✿Account details — name, email address, phone number, and a securely hashed password (we never store your password in readable form)
• ✿Order details — recipient name, delivery or collection address, postcode, contact phone number, delivery date and time preferences, and any gift message you write
• ✿Payment information — handled entirely by our payment provider (Stripe or Square); we never see or store your full card number
• ✿Account history — past orders, saved addresses, and active subscriptions
• ✿Newsletter details — your email address, only if you choose to subscribe
• ✿Technical data — basic information like IP address and browser type, automatically logged by our hosting infrastructure for security purposes
• ✿Push notification data — for staff accounts only, a device identifier used solely to alert staff to new orders; this does not apply to customer accounts

Signing in, including Google

You can create an account with an email and password, or sign in with Google. If you choose Google, Google shares your name, email address, and profile picture with us so we can create your account — we never see or store your Google password. You can review or revoke our access at any time from your Google Account's "Third-party apps & services" settings. Google's own handling of your data is governed by the Google Privacy Policy (policies.google.com/privacy).

How we use your information

We use your information to:

• ✿Create and manage your account
• ✿Take payment and fulfil your orders, including calculating delivery fees and checking your address is within our delivery area using the postcode you provide
• ✿Send order confirmations, payment receipts, and delivery/collection updates — these are service emails necessary to fulfil your order, not marketing
• ✿Remind you about an order you started but didn't finish, if we have your email on file
• ✿Send newsletter marketing emails, but only if you've opted in — you can unsubscribe at any time using the link in any email
• ✿Prevent fraud and keep our site secure
• ✿Understand and improve how our site and products are used

Payment processing

Payments are processed securely by Stripe or Square — whichever is active on our store. Your card details go directly to them; our servers never receive or store your full card number. Each processor may handle your data outside the UK under their own legal safeguards. See Stripe's privacy policy (stripe.com/privacy) or Square's privacy policy (squareup.com/legal/privacy) for details.

Who we share your information with

We don't sell your personal information. We share it only with the service providers who help us run our business, each bound to only use it for the purpose we specify:

• ✿Stripe and/or Square — payment processing
• ✿Resend — sending transactional emails (order confirmations, delivery updates)
• ✿Amazon Web Services (S3) — secure file storage for product images
• ✿Google — account sign-in, and delivering push notifications to Android devices (other browsers use Apple's or Mozilla's equivalent push services)
• ✿postcodes.io — we send the postcode you enter at checkout to calculate delivery distance; no other personal details are shared with this service
• ✿Our hosting provider — to run the website itself

Cookies and local storage

We use an essential cookie to keep you signed in and your cart contents are stored in your browser (not on our servers). We don't currently use analytics or advertising cookies. See our Cookie Policy for full details.

How long we keep your information

We keep account information for as long as your account is active. Order records are kept for at least 6 years to meet UK tax and accounting obligations. Newsletter details are kept until you unsubscribe. If you'd like your account deleted sooner, contact privacy@edysflowers.co.uk and we'll action it unless we're required to keep specific records for legal reasons.

Your rights

Under UK data protection law, you have the right to:

• ✿Access the personal information we hold about you
• ✿Correct inaccurate or incomplete information
• ✿Request erasure of your information
• ✿Restrict or object to certain processing
• ✿Receive your information in a portable format
• ✿Withdraw consent at any time, where we rely on consent
• ✿Complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) if you're unhappy with how we've handled your data

Children

Our site is not directed at children, and you must be at least 18 to place an order with us.

International transfers

Some of our service providers (including Stripe, Square, Google, and AWS) may process your information outside the UK. Where this happens, they do so under recognised legal safeguards such as Standard Contractual Clauses or an adequacy decision.

Keeping your information secure

Passwords are hashed, not stored in plain text. Payment details never touch our servers. Our site is served entirely over HTTPS, and any sensitive configuration we store (such as payment provider credentials) is encrypted at rest.

Changes to this policy

We may update this policy from time to time. We'll update the date at the top of this page, and let you know directly if a change materially affects how we use your information.

Contact us

Questions about this policy or your personal information? Email privacy@edysflowers.co.uk.