Privacy Policy
Last updated: October 2026
Kosmos of Flowers ("we", "us", "our") is committed to protecting your personal data. This policy explains what information we collect, how we use it, and your rights under applicable data protection law, including the UK GDPR and the Data Protection Act 2018.
1. Who We Are
Kosmos of Flowers is the data controller responsible for your personal data.
Contact: YOUR-EMAIL@EXAMPLE.COM
2. Data We Collect
We may collect and process the following categories of personal data:
- Identity data — first name, last name, and recipient name where supplied.
- Contact data — email address, phone number, delivery and billing address.
- Transaction data — details of purchases, selected bouquets and sizes, delivery or collection dates, graduation university where supplied, gift messages, and event or corporate enquiries.
- Technical data — IP address, browser type, device type, pages visited, time on site (via cookies and analytics tools).
- Marketing preferences — your opt-in or opt-out choices for communications.
- Communications data — messages sent to us via email or contact forms.
Payments are handled through the payment methods enabled at checkout and their respective processors. We do not receive your full payment card number.
3. How We Collect Your Data
- Directly from you — when you place an order, create an account, contact us, or sign up to our mailing list.
- Automatically — when you browse our website via cookies and similar tracking technologies.
- Third parties — from payment and service providers, and from analytics or advertising providers where these services are enabled and any required consent has been obtained.
4. How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Processing and fulfilling your order | Performance of a contract |
| Sending order confirmations and delivery or collection updates | Performance of a contract |
| Managing enquiries, order changes, refunds and customer service | Performance of a contract / Legal obligation |
| Sending marketing emails (where opted in) | Consent |
| Improving our website and user experience | Legitimate interests |
| Fraud prevention and security | Legitimate interests / Legal obligation |
| Complying with legal and regulatory obligations | Legal obligation |
5. Cookies
We use cookies to operate our website, remember your preferences, and analyse traffic. These include:
- Essential cookies — required for the store to function (cart, session, checkout).
- Analytics cookies — to understand how visitors use our site (e.g. Google Analytics).
- Marketing cookies — to show you relevant ads on third-party platforms (e.g. Meta Pixel), only with your consent.
You can manage your cookie preferences via our cookie banner or your browser settings. Withdrawing consent for non-essential cookies will not affect the functionality of your order.
6. Sharing Your Data
We do not sell your personal data. We may share it with:
- Shopify Inc. — our e-commerce platform provider (data processed under Shopify's privacy policy).
- Delivery providers — where needed to deliver your flowers (recipient name, address, contact information and delivery instructions).
- Payment processors — the payment providers made available at checkout, to complete transactions.
- Email marketing platforms — where used and where marketing communications are permitted.
- Analytics providers — where enabled, for site measurement and advertising subject to applicable consent requirements.
- Legal authorities — where required by law or to protect our legal rights.
7. International Transfers
Some service providers may process data outside the UK. Where required, international transfers will be covered by an applicable adequacy arrangement or appropriate contractual safeguards.
8. Data Retention
- Order and transaction records are kept for the period required by applicable accounting, tax and legal obligations.
- Marketing data is retained until you unsubscribe or withdraw consent.
- Customer account data is retained for as long as your account is active, plus a reasonable period thereafter.
- Technical and analytics information is retained in accordance with the settings and retention periods of the services we use.
9. Your Rights
Under UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — request deletion of your data where there is no lawful reason to retain it.
- Restriction — ask us to pause processing of your data in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interests or for direct marketing.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at YOUR-EMAIL@EXAMPLE.COM. We normally respond within one month, subject to any lawful extension.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.
10. Security
We use appropriate technical and organisational measures to protect personal data. Our online store is hosted on Shopify, and payment information is processed through the payment services available at checkout.
11. Third-Party Links
Our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites and encourage you to read their policies separately.
12. Changes to This Policy
We may update this policy from time to time. The current version will always be available on this page. We will notify you of significant changes by email where required.
13. Contact
For any privacy-related queries or to exercise your rights:
Kosmos of Flowers
Business address: [INSERT BUSINESS ADDRESS]
Email: YOUR-EMAIL@EXAMPLE.COM