This privacy policy explains how Bloom Craft Studio processes personal data when users contact us, request a consultation, or arrange floral services for weddings and events.
We may process identification and contact details, event and order information, consultation notes, payment-related records, communication content, and technical data such as device and usage information. For wedding and event projects, we may also process preferences about dates, venues, color palettes, floral choices, delivery, and setup arrangements.
We receive data from contact forms, phone calls, consultation appointments, and messages sent in connection with a request or order. We may also obtain technical data automatically when the website is used, and we may create internal records from the progress of a project, including quote preparation, deposit confirmation, and final detail checks.
We may use necessary cookies to support basic site operation, preference cookies to remember settings, and analytics cookies to understand how the site is used. Cookies may be session-based or persistent depending on their function. We do not rely on cookies to collect more information than is needed for the stated purpose.
Where cookies are not strictly necessary, users can usually control them through browser preferences or device settings. Disabling some cookies may affect site functions, form handling, or preference storage. Any consent-based cookie choices should be reviewed and updated through the available browser or site controls.
When the GDPR applies, personal data is processed on a lawful basis such as performance of a contract, steps taken before entering into a contract, legal obligation, legitimate interests, or consent where required. We limit processing to what is relevant for managing inquiries, consultations, quotations, bookings, delivery, setup, and related administration.
Where the GDPR applies, individuals may request access, rectification, erasure, restriction, portability, or objection, and may withdraw consent where processing is based on consent. A request may be refused or limited if the law requires retention or if another lawful ground applies. We may ask for information needed to verify the requester’s identity and to protect the privacy of others.
Subject to applicable law, individuals may have rights to access their data, correct inaccurate information, request deletion, object to certain processing, or ask for restriction of processing. Where processing is based on consent, that consent may be withdrawn for future processing. Some requests may not be fully granted if legal obligations or overriding interests apply.
To exercise a privacy right, the requester should provide the relevant contact details and a clear description of the request. We may need to confirm identity before responding. We will review the request and reply within the period required by applicable law, taking into account any lawful exceptions or extensions.
We keep personal data only for as long as needed for the relevant inquiry, project, accounting, dispute handling, or legal compliance purpose. When data is no longer required, it is deleted, anonymized, or archived in a limited form if retention is still necessary under law or for legitimate recordkeeping.
If this policy is updated, the revised version will apply from the stated effective date. Material changes may be highlighted on the website or through another reasonable notice method. Users should review the policy periodically to stay informed about current processing practices.
We use personal data to respond to inquiries, arrange consultations, prepare quotes, confirm deposits and dates, manage project details, coordinate delivery and setup, process payments, maintain business records, handle customer communication, improve website performance, and meet legal or accounting obligations. We may also use limited technical data to secure the website and diagnose operational issues.
We may share personal data with trusted service providers that support website operation, communication handling, payment processing, recordkeeping, or delivery and setup coordination. These parties act under instructions or contractual terms appropriate to their role and may process data only for the services they provide on our behalf.
We may disclose personal data if required to comply with law, a court order, tax or accounting obligations, or a lawful request from a public authority. We may also share information where disclosure is necessary to establish, exercise, or defend legal claims, or to protect the rights and security of the business, users, or others.
