Privacy Policy

Last updated: 9 August 2026

1. Who we are

Thistlecraft Florist (“we”, “us” and “our”) is the data controller for personal information collected through thistlecraft.florist and when you contact us or place an order. You can contact us at nikita@thistlecraft.florist, 01443 567048, or Thistlecraft Florist, Tonypandy, CF40, Wales, United Kingdom.

2. Information we collect

Depending on how you use our services, we may collect your name, email address, telephone number, billing and delivery address, order details, delivery date, recipient details, card-message wording, correspondence and information you provide in an enquiry. We also collect limited technical and cookie information about how the website is used.

If you pay online, payment-card information is handled by the payment provider you select. Please do not send payment-card details to us by email.

3. How and why we use your information

We use your information to take and fulfil orders; arrange delivery; communicate about enquiries, changes and customer service; manage refunds or complaints; keep business and tax records; protect the website and prevent fraud; and, where you have agreed, send marketing such as offers or newsletters.

Our legal bases are: performance of a contract or steps requested before a contract; compliance with legal obligations; our legitimate interests in running, securing and improving our business; and consent for optional marketing and non-essential cookies.

4. Who we share information with

We share information only where necessary with service providers that help us run the website and online shop, process payments, deliver orders, provide email or newsletter services, host data, analyse website use or provide professional advice. We may also share information with delivery personnel, funeral directors or venues where you ask us to deliver an arrangement there. We may disclose information where required by law or to protect our rights, customers or business.

5. International transfers

Some service providers may process information outside the UK. Where this happens, we use appropriate safeguards required by UK data-protection law, such as an adequacy regulation or approved contractual protections.

6. How long we keep information

We keep information only for as long as needed for the purpose collected. Order and transaction records are normally retained for up to six years after the end of the relevant accounting period. Enquiries that do not lead to an order are normally retained for up to 24 months. Marketing records are kept until you unsubscribe or withdraw consent, after which we may retain minimal suppression information so that we respect your choice. We may keep information longer where needed for a legal obligation or to establish, exercise or defend legal claims.

7. Marketing

We will send marketing by email only where permitted by law. You can unsubscribe at any time using the link in an email or by contacting us. Withdrawing consent does not affect the lawfulness of processing before it was withdrawn.

8. Cookies

We use necessary cookies to make the website work. Where enabled, optional analytics or marketing technologies are used only in line with your cookie choices. You can change your preferences through the site’s cookie controls and your browser settings. For more information, please see the Cookie Banner shown on the website.

9. Your rights

Subject to applicable law, you may ask us to access, correct, erase, restrict or transfer your personal information, or object to certain processing. You may withdraw consent at any time where consent is the legal basis. To exercise a right, contact nikita@thistlecraft.florist. We may need to verify your identity before responding.

You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint, although we would welcome the opportunity to resolve your concern first.

10. Security

We use reasonable organisational and technical measures to protect personal information. No internet transmission or storage system is completely secure, so please contact us promptly if you believe your information may have been compromised.

11. Children and changes to this policy

Our services are not directed at children, and we do not knowingly collect their personal information without appropriate authority. We may update this policy when our services or legal obligations change. The latest version will always appear on this page.