Privacy notice
The short version. We collect what we need to send flowers to the right door and nothing else. We never see your card number. We do not sell your details to anybody, ever.
You can ask us for a copy of what we hold, or ask us to delete it, by replying to any of our emails.
Who is responsible for your information
We are the data controller for the information described here. That means we decide what is collected and why, and we are accountable for it.
Hana Blossom Limited, a company registered in England and Wales under company number 16550074.
Registered office and studio: Flat 8 Oaks View, Epsom, Surrey, KT19 8NG.
Email: hello@hanablossom.co.uk · Phone: +44 7982 361407
Not registered for VAT, so no VAT is charged and none is shown.
What we collect, and why
When you order
Your name, email address and phone number. The name, address, phone number and any access notes for whoever is receiving the flowers. The message you want written on the card. What you ordered and when it is going.
Why we are allowed to: we need it to perform the contract you entered into when you ordered. Without it there is no order.
About the person receiving the flowers
If you send flowers to somebody else, you give us their details and they did not. We rely on our legitimate interest in delivering what you asked us to deliver. We use those details only to get the flowers to them, we do not add them to any mailing list, and we do not keep them to market to later. If you are the recipient and you would rather we did not hold your address, tell us and we will remove it once the delivery is done.
When you pay
We never see or store your card details. The payment form on our checkout belongs to Stripe and your card goes straight to them. We receive confirmation that a payment succeeded, the amount, and the last four digits, which is what lets us match a payment to an order.
When you enquire about a wedding, event or stationery
Whatever you put in the form: names, date, venue, guest numbers, budget range, and anything you tell us about what you want. We use it to answer you and to prepare a proposal. If you do not go ahead, we keep the enquiry for two years so that we recognise you if you come back, and then we delete it.
When you make an account
Your email address, and your name if your sign-in provider gives it to us. If you sign in with Google or Apple we receive your email address and an identifier for your account with them. We never receive your password, and we do not ask for one. Signing in gives us no access to your contacts, your calendar, your files or anything else.
When you visit the site
We count page views so we can see which pages people actually use. It is anonymous, it sets no cookies and it does not follow you to other websites. You can turn it off on the cookies page.
If you ask to hear from us
Your email address, on the basis of your consent. Every email we send has an unsubscribe link and leaving takes one click. Order confirmations are not marketing: those we send because you bought something, and they continue whether or not you are on the list.
Who else sees it
Only the companies that make the site work, and only the part each of them needs. None of them may use your information for their own purposes.
- Stripe
- Takes the payment. Your card details go to them, not to us.
- Resend
- Sends the confirmation and the notification emails.
- Vercel
- Hosts the site and the database, and counts page views.
- Google or Apple
- Only if you choose to sign in with them, and only to confirm it is you.
Some of these are based outside the UK. Where information leaves the UK it is protected by the safeguards that UK data protection law requires, such as the UK International Data Transfer Agreement or an adequacy decision.
We will also hand over information if the law requires it. We have never been asked and we would tell you if we could.
How long we keep it
- Orders and payments
- Six years after the end of the financial year they fall in, because HMRC requires a limited company to keep its records that long.
- Enquiries that did not become bookings
- Two years, then deleted.
- Your account
- Until you ask us to close it. Orders already delivered stay in the accounts, as above.
- Mailing list
- Until you unsubscribe.
- Sign-in links
- Fifteen minutes. Only a scrambled version is ever stored, never the link itself.
Your rights
You can ask us to:
- Show you what we hold about you, free of charge.
- Correct anything that is wrong.
- Delete it, where we are not required to keep it.
- Stop or limit what we are doing with it.
- Hand it over to you or to someone else in a usable format.
- Withdraw your consent to marketing at any time.
Email us and we will answer within one month. We will not ask you why.
If you are not happy with how we have handled something, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but you do not have to.
Keeping it safe
The site is served over an encrypted connection and nothing that identifies you is stored in your browser except the cookies listed on the cookies page. Orders and addresses are visible only to us, behind a login. Printed delivery sheets are destroyed once the round is done.
Changes
If we change how we use your information we will update this page, and we will tell you directly if the change is one you would want to know about.
Last updated 19 September 2026.