Privacy policy
Fleuriste London Ltd trading as Luxe Petals
Version 1.9 · Last updated: 11 August 2026
1. Who we are
Luxe Petals is a florist at 12 Streatham High Road, London SW16 1DB.
This website, luxepetalslondon.com, is operated by Fleuriste London Ltd, a private limited company registered in England and Wales under company number 12194910, trading as Luxe Petals and Luxe Petals London.
Fleuriste London Ltd is the data controller for the personal information described in this policy. That means we decide why and how your information is used, and we are responsible for looking after it.
| Company | Fleuriste London Ltd |
| Trading as | Luxe Petals · Luxe Petals London |
| Company number | 12194910 |
| Registered office and trading address | 12 Streatham High Road, London, England, SW16 1DB |
| info@luxepetalslondon.com | |
| Telephone | 020 3759 1977 |
| 07908 066434 |
We are registered with the Information Commissioner's Office under registration reference ZC219447.
To contact us about anything in this policy, including to exercise your rights, email info@luxepetalslondon.com or call 020 3759 1977. Please put "Privacy" in the subject line so we route it correctly.
2. What this policy covers
This policy explains what personal information we collect when you visit our website, place an order, collect from our shop, receive a delivery, contact us, or ask us about weddings, funerals or events. It explains what we do with that information, who receives it, and what rights you have.
It does not cover other websites we link to. If you follow a link elsewhere, that site's own privacy policy applies.
3. The information we collect
3.1 Information you give us
| Category | Examples | When |
|---|---|---|
| Contact details | Name, email address, telephone number | Orders, contact and consultation forms, WhatsApp, phone calls |
| Delivery and billing details | Recipient name, delivery address, billing address, postcode | Placing an order for delivery |
| Order details | Products ordered, sizes and colours, price, order date, requested delivery or collection date | Placing an order |
| Message content | What you write to us about your order or your enquiry | Contact form, WhatsApp, email, telephone |
| Payment information | The payment method used and the outcome of the payment | Checkout |
| Account details | Your email address and, if you create an account, your saved addresses and order history | Creating a customer account |
We do not see or store your full card number. Card details are entered directly into our payment providers' systems and processed by them. We receive only confirmation of the payment and limited details such as the card type and the last four digits.
3.2 Please do not send us sensitive information
We do not ask for information about health, religious or philosophical beliefs, ethnicity, or any other special category of personal data, and we do not need it to prepare your flowers.
Please do not share this kind of information with us unless it is genuinely necessary.
If a design genuinely requires us to use information of this kind, we will ask you for a separate, explicit statement of consent, and record it, before we process it. We will not simply assume that mentioning something gives us permission to use it.
If we receive special category information incidentally, we do not use it unless it is genuinely necessary and we have first obtained and recorded your separate explicit consent. If it is not necessary, we delete it as soon as reasonably possible. We do not share special category information with delivery drivers.
You can ask us at any time to remove such detail from our records while keeping your order record intact.
3.3 Information we collect automatically
When you visit the website, technical information about your visit is collected: IP address, device and browser type, pages viewed, referring page and similar. This is described in section 8.
3.4 Information from other people
If someone orders flowers to be delivered to you, we receive your name, address and any message they ask us to include. We use it only to make that delivery.
4. Why we use your information, and our legal basis
Under UK GDPR we must have a lawful basis for everything we do with your information. This is ours.
| What we do | Why | Lawful basis |
|---|---|---|
| Take and fulfil your order; prepare your flowers; arrange delivery or collection | To do what you asked us to do | Contract, Article 6(1)(b) |
| Contact you about your order — details, timings, collection, delivery, or a problem | To perform the order | Contract, Article 6(1)(b) |
| Answer your enquiry about a wedding, funeral, event or consultation | To take steps at your request before entering a contract | Contract, Article 6(1)(b) |
| Take payment and prevent fraud | To complete the sale and protect the business | Contract, Article 6(1)(b), and legitimate interests, Article 6(1)(f) |
| Pass delivery details to the person delivering your order | To complete the delivery | Contract, Article 6(1)(b), and legitimate interests, Article 6(1)(f), where the recipient is not the person who ordered |
| Keep accounting and tax records | We are required to | Legal obligation, Article 6(1)(c) |
| Handle a complaint, a return or a legal claim | To resolve the matter and defend our position | Legitimate interests, Article 6(1)(f) |
| Keep the website secure and working | To run the site safely | Legitimate interests, Article 6(1)(f) |
| Analytics cookies and similar technologies | To understand how the site is used | Consent, Article 6(1)(a), and PECR regulation 6 |
| Advertising and marketing technologies, including personalised advertising | To advertise and to measure our advertising | Consent, Article 6(1)(a), and PECR regulation 6 |
| Send marketing emails or messages | To tell you about our flowers | Consent, Article 6(1)(a) |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and concluded that it is not. You can ask us to explain that assessment, and you can object — see section 11.
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect anything done lawfully before you withdrew it.
Section 3.2 explains how we handle special categories of personal data. We do not rely on your having volunteered such information as permission to use it.
5. Orders, payment, delivery and collection
Orders. Orders placed through this website are processed on our Shopify store. We receive your contact details, delivery address and order contents.
Payment. Payments are processed by Shopify Payments, our card processor, which accepts Shop Pay, Visa, Mastercard, American Express and other methods shown at checkout; by PayPal and by Google Pay where available at checkout; and by card or cash in the shop through our point-of-sale system. These providers handle payment information under their own privacy policies.
Delivery. Deliveries are made either by authorised Luxe Petals staff or by third-party delivery drivers or delivery providers.
Whoever makes the delivery receives only what is strictly necessary to complete it: the recipient's name, the delivery address, a contact telephone number, and any access or timing instruction you have given us.
They are not given your payment information, the reason for the order, the details of a funeral or other occasion, the message written on your card, or any other information about you.
We remain responsible for choosing and managing our delivery providers appropriately, and for making sure they handle your information only for the delivery.
Collection. If you collect from the shop, we use your name and contact details to prepare your order and to tell you when it is ready.
Made-to-order items. Funeral wreaths, crosses and bespoke tributes are made to order. We keep the details you give us for as long as we need them to make and deliver the piece, and then only within the order record as described in section 9.
6. Who receives your information
We do not sell your personal information.
Some of the organisations below act on our instructions. Others decide for themselves how they use the information they receive. We have set out what each one does, because it affects who you deal with about that information.
| Who | What they do | How they act | What they receive |
|---|---|---|---|
| Shopify | Runs this website, our checkout, our order and customer records, and our point-of-sale system | On our instructions, as our processor | Order, contact, delivery and site usage data |
| Shopify, for the enhanced services described in section 7 | Analytics, product development, advertising and personalisation for Shopify | As an independent controller, for its own purposes | Customer data as described in section 7 |
| Shopify Payments | Processes card payments | As an independent controller for the payment | Payment and billing data |
| PayPal, where available at checkout | Processes payments | As an independent controller. For UK users the controller is PayPal UK Ltd | Payment data |
| Google, for Google Pay where available at checkout | Processes payments | As an independent controller | Payment data |
| Google, for advertising and measurement | Advertising and measurement through our Google and YouTube sales channel | On our instructions under Google's advertising data processing terms, and for its own purposes as described in Google's own policies | Site usage data, only where you have consented |
| Shopify Inbox and Messaging | Powers chat and messaging with us | On our instructions | Message content and contact details |
| Shopify Flow | Automates internal tasks on our store | On our instructions | Order and customer data held in Shopify |
| Shopify Search & Discovery | Powers search and product recommendations | On our instructions | Site usage data |
| Shopify Claude Connector App | An app published by Shopify that lets us manage the store through an AI assistant. See below | Used only for authorised administration tasks, under our access controls | Store data, including customer names, email addresses, telephone numbers, physical addresses, and device and activity data |
| Meta Platforms, if you message us on WhatsApp | Operates WhatsApp | As the provider of the WhatsApp service, under its own terms | Your telephone number and message content |
| Authorised Luxe Petals staff and third-party delivery drivers or delivery providers | Deliver your order | Some delivery providers act on our instructions, while an established delivery business may have its own legal obligations. We limit the information shared to what is necessary for the delivery | Recipient name, address, telephone and delivery instructions only |
| Google Workspace | Hosts our business email | On our instructions | Emails you send us |
| Our bank and our accountant | Payments, accounts and tax | As independent controllers | Transaction records |
About the Shopify Claude Connector App. It is published by Shopify and lets us run store administration tasks through an AI assistant. Shopify states that the app can access personal data in the store, specifically customer names, email addresses, telephone numbers and physical addresses, together with device and activity data such as geolocation, IP address and browser. We use it only for authorised administration tasks, and access is controlled through our Shopify account. We are reviewing the retention and international transfer arrangements that apply to it, and we will update this policy when that review is complete.
If you message us on WhatsApp, Meta operates the WhatsApp service under its own terms and its own privacy policy. What we do with your message once we receive it is our responsibility, and it is governed by this policy.
We may also disclose information where the law requires it, or to establish, exercise or defend a legal claim.
7. Shopify and Shopify Network Intelligence
This website runs on Shopify. For running the store, Shopify acts on our instructions. Our store is configured so that the customer data it holds is hosted in the European Union.
Shopify also provides what it calls enhanced services, and for those Shopify acts as an independent controller rather than on our instructions. One of these is Shopify Network Intelligence, which is enabled on our store. Shopify uses customer data from our store, together with data from across Shopify, to provide, develop and improve analytics, product customisation, advertising and other services. Shopify states that no other merchant can see our data.
Where these services involve targeted advertising or non-essential technologies, they are subject to your consent, which you give or withhold through our cookie banner and can change at any time through the Cookie preferences link in the footer of every page.
You can read how Shopify handles your information in the Shopify Consumer Privacy Policy at shopify.com/legal/privacy/consumers, and in Shopify's general privacy policy at shopify.com/legal/privacy.
8. Cookies and similar technologies
Cookies are small files stored on your device. We use them for different purposes, and not all of them require your permission.
| Category | What they do | Consent needed |
|---|---|---|
| Strictly necessary | Keep your cart, keep you signed in, keep the checkout secure, remember your currency and language, and record your cookie choices | No. The site cannot work without them |
| Preferences | Remember choices you make, such as language | Yes |
| Analytics | Tell us how many people visit, which pages they view, and where they came from | Yes |
| Marketing and advertising | Used to show you advertising and to measure it | Yes |
Your choices. Our cookie banner lets you Accept, Decline, or open Manage preferences and choose category by category. Declining is as easy as accepting.
You can change your mind at any time using the Cookie preferences link in the footer of every page.
If you decline, we will not set analytics, preferences or marketing cookies. Strictly necessary cookies will still be used, because the site cannot function without them.
You can also block or delete cookies in your browser settings. If you do, parts of the site may stop working.
You can view and change the categories of cookies you allow through Cookie preferences. Further information about Shopify cookies is available in Shopify's Cookie Policy.
9. How long we keep your information
We keep personal information only for as long as we need it, and we review these periods at least once a year.
| Information | How long | Why |
|---|---|---|
| Orders, invoices, payment and accounting records | 6 years after the end of the relevant accounting period | UK tax and accounting record-keeping obligations |
| General enquiries that do not lead to an order | 12 months from the last contact | Long enough to follow up or answer a later question |
| Wedding, funeral and event enquiries and briefs | 24 months from the event or the last contact | These occasions are planned well in advance and often revisited |
| Marketing contact details, where you have consented | Until you withdraw consent, or 24 months without any interaction | We do not keep contacts we are no longer in contact with |
| Your customer account profile | For as long as your account remains open | So you can sign in and see your order history |
| Records needed for a complaint, dispute or legal claim | While the matter is open, and for the applicable limitation period afterwards | To resolve and defend claims |
| Website and analytics data | For the period set by the cookie or tool concerned | See section 8 |
If you close your account, we end your access to it and remove the account profile. We keep only your orders, invoices and any other records we are required or entitled to keep, for the periods set out above.
When we no longer need information, we delete it or make it permanently anonymous.
10. Sending information outside the UK
Our Shopify store is configured with data hosting in the European Union.
Some of the organisations we use are based outside the UK, or use infrastructure outside the UK. Where personal information leaves the UK, it must be protected by a safeguard recognised under UK data protection law.
Shopify states in its Data Processing Addendum that it relies on the European Commission's 2021 Standard Contractual Clauses, the International Data Transfer Addendum issued by the UK Information Commissioner's Office, the Standard Contractual Clauses as amended for Switzerland, and, for transfers from Shopify International Limited to its Canadian parent Shopify Inc., the European Commission's adequacy decision for Canada.
Google states in its advertising data processing terms that it relies on Standard Contractual Clauses, and on alternative transfer solutions where those apply.
PayPal states that where it transfers information outside the country where you live, it uses measures including intra-company agreements, model contractual clauses, or the derogations permitted by law.
Other providers we use apply their own safeguards, set out in their own terms.
You can ask us for more detail about any of these transfers by emailing info@luxepetalslondon.com.
11. Your rights
Under UK data protection law you have the right to:
- be told how we use your information — that is what this policy is for;
- ask for a copy of the information we hold about you;
- ask us to correct anything that is wrong or incomplete;
- ask us to delete information, where there is no good reason for us to keep it;
- ask us to restrict how we use it while a concern is resolved;
- object to us using it where we rely on legitimate interests, and to object to direct marketing at any time;
- ask us to transfer information you gave us to you or to another provider, where it is held electronically and we rely on consent or contract;
- withdraw consent at any time, where we rely on it.
How to exercise them. Email info@luxepetalslondon.com or call 020 3759 1977. We may need to check who you are before we act. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if we do.
There is no charge, unless a request is manifestly unfounded or excessive.
If you are unhappy, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
Complaining to the ICO does not affect any other legal rights you have.
12. Children
Our website and our products are intended for adults. We do not knowingly collect personal information from children.
If you believe a child has given us their personal information, contact info@luxepetalslondon.com and we will delete it.
13. How we protect your information
Our website and checkout run over an encrypted connection. Access to our order and customer records is limited to people who need it to do their job, and is protected by individual accounts. We do not store full card numbers. We pass to delivery drivers only what the delivery requires.
No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office as required, and where the risk is high we will tell you.
14. Changes to this policy
We may update this policy. When we do, we will change the version number and the "Last updated" date at the top of this page. Where a change is significant, we will say so on the page.
| Version | Date | Change |
|---|---|---|
| 1.9 | 11 August 2026 | Current version |
15. Contact
Fleuriste London Ltd trading as Luxe Petals
12 Streatham High Road, London, England, SW16 1DB
Company number 12194910
info@luxepetalslondon.com · 020 3759 1977
We are registered with the Information Commissioner's Office under registration reference ZC219447.