Saffron and PetalPlace an order

Privacy policy

Your information, handled thoughtfully.

This notice explains what personal information Saffron and Petal collects, why we use it and the choices you have.

Last updated: 6 November 2026

1. Who we are

Saffron and Petal is the controller of the personal information described in this notice. You can contact us about privacy at saffronandpetal@gmail.com.

2. Information we collect

Depending on how you use our service, we may collect:

  • Your name, email address, telephone number and communications with us.
  • Recipient and delivery details, occasion, requested delivery date and collection or delivery preference.
  • Hamper choices, personalisation, gift message and other order instructions.
  • Optional dietary or allergy information you choose to provide.
  • Payment status, transaction and order references. Card details are handled by our payment provider and are not stored by us.
  • Technical information such as IP address, browser type and security or server logs when you visit the website.

We usually receive this information directly from you. For gifts, the buyer supplies the recipient’s name, delivery address and any relevant delivery contact details. We may also receive payment or order-status information from Square and technical information from our hosting provider.

Anyone who has an order number can check its basic progress and last-updated time through Track order. This lookup does not show names, addresses, contact details, hamper contents or payment details. Your original tracking link provides your fuller order summary; keep that link safe.

3. How and why we use your information

PurposeLawful basis
Answer enquiries, prepare quotations and take steps requested before an orderContract
Process, personalise, deliver and support orders, payments, cancellations and refundsContract
Keep tax, accounting and business records and comply with legal requestsLegal obligation
Protect the website, prevent fraud and improve our customer serviceLegitimate interests in running a safe, effective business
Send optional news or offersConsent, which you may withdraw at any time
Use allergy or health information solely to handle an enquiry or orderYour explicit consent

You do not have to provide optional information. However, we need core contact, order and delivery details to answer your request or fulfil an order. We do not use automated decision-making or profiling that produces legal or similarly significant effects.

4. Who we share information with

We share only what is reasonably necessary with trusted service providers, which may include Square for payments and order administration, Cloudflare for website hosting and security, email or communications providers, delivery or courier services, and professional advisers such as accountants. We may also disclose information where the law requires it. We do not sell personal information.

Some providers may process information outside the UK. Where this happens, we use providers and safeguards recognised by UK data protection law, such as adequacy regulations or approved contractual protections. Contact us if you would like more information.

Gift recipient privacy

We use recipient details to arrange delivery, fulfil the gift request and handle related queries, relying on our legitimate interests in delivering gifts requested by customers. We do not add recipients to marketing lists unless they separately choose to opt in. We share only necessary delivery details with the carrier and use those details only for the relevant service and necessary records. Recipients can contact us to exercise their privacy rights.

5. How long we keep information

  • General or unsuccessful enquiries: normally up to 12 months after our last contact.
  • Order, payment, invoice and accounting records: as required by tax and accounting law, generally up to six years.
  • Allergy or dietary information: only as long as needed to prepare and support the relevant order, unless the law requires longer.
  • Technical and security logs: for the period reasonably needed for security, troubleshooting and provider operations.
  • Marketing preferences: until you withdraw consent or the information is no longer needed.

We may keep information longer where necessary to resolve a dispute, establish or defend legal claims, or meet a legal requirement.

6. Keeping information secure

We use appropriate organisational and technical measures to limit access, protect accounts and reduce the risk of loss, misuse or unauthorised disclosure. No online service can guarantee absolute security.

7. Your data protection rights

Depending on the circumstances, you may ask us to give you a copy of your information, correct it, delete it, restrict its use, transfer it, or stop particular uses. You may withdraw consent at any time without affecting earlier lawful use.

Your right to object

You can object to processing based on our legitimate interests. You can always object to direct marketing.

These rights are not always absolute. We normally respond within one month and will explain if an exemption applies. Contact us using the email above. We may need to confirm your identity.

8. Cookies and similar technology

Our current website does not intentionally use analytics or advertising cookies. If you create a hamper or add a personalised message card to an enquiry, temporary browser session storage remembers your choices while you move to the enquiry page and is removed when your browser session ends. Cloudflare may use essential technology for security and delivery, and Square may use necessary technology on its hosted payment pages under its own privacy and cookie information. If we add non-essential cookies later, we will explain them and request consent before they are used.

9. Questions and complaints

Please contact saffronandpetal@gmail.com first so we can try to help. You can also complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Make a data protection complaint to the ICO

10. Changes to this notice

We will update this page when our services or use of personal information changes. The date at the top shows when it was last revised.