Privacy Policy

Last updated: July 2026 · Draft pending legal review

Who we are

Oxford Petals & Co. (Oxford, UK) is the data controller for personal data collected through oxfordpetals.com. Contact: hello@oxfordpetals.com.

What we collect and why

• Your order details (name, email, phone, billing address, purchase history) — to fulfil orders and subscriptions, take payment and provide customer service. Legal basis: contract.
• Recipient details (name, address, phone, your gift message) — to deliver flowers you send. We use recipient details only to make the delivery, never for marketing to them without their own consent. Legal basis: legitimate interests.
• Payment data is handled by Stripe; we never see or store full card numbers. See stripe.com/privacy.
• Preferences you tell us (allergies, pet-safe requirements, dislikes) — stored so we get your flowers right, only because you volunteered them for this purpose.
• Marketing — only if you opt in, or as an existing customer under the soft opt-in. Every email has one-click unsubscribe.

Who we share it with

Stripe (payments), Vercel (website hosting), our email provider, delivery couriers where used (name, address and phone for the drop only), and our accountant where required. We never sell data.

How long we keep it

Order records six years (tax law); marketing lists until you unsubscribe; recipient details twelve months after the last delivery.

Your rights

Access, correction, deletion, restriction, portability and objection — email hello@oxfordpetals.com and we will respond within one month. You can complain to the ICO at ico.org.uk.