Privacy Policy

Who we are

QA Blossom Test is a florist. Our website address is https://qa-blossom-1111.floristgrow.co.uk. We are the data controller for the personal information we collect through this website.

What data we collect

When you place an order or contact us, we may collect:

• Your name, email address, phone number and delivery address
• Recipient name and delivery address (if different from yours)
• Payment information (processed securely by our payment provider — we do not store card details)
• Order history and correspondence
• Your card message, and any delivery instructions

If someone sent you flowers. The person who ordered them gave us your name, delivery address and any message for you, and sometimes your phone number. We use these only to deliver the order, keep the record of it and deal with any problem with it, as this page describes, and you have the same rights over them. When we deliver, our driver may take a photo as proof of delivery and add a short note, such as where the flowers were left. The email telling the person who ordered that the flowers have been delivered includes that note and a link to the photo, and anyone with that link can open the photo.

Your account

If you create an account on this website, it is an account with QA Blossom Test only. Other shops on the FloristGrow platform can’t see it, and you can’t use it to sign in to them.

Delivery photos

When your order is delivered, our driver may take a photo as proof of delivery and add a short note. The email telling you your order has been delivered includes the note and a link to the photo, and anyone with that link can open the photo. If a delivery could not be made, any reason, note or photo the driver adds is for our own records and is not sent to you. The same goes for any reason the driver gives for not taking a photo. We keep all of this with your order until seven years after the date of the order, when we delete it, or sooner if this shop closes (see below).

How we use your data

We use your data, and rely on these legal bases, as follows: to take, make and deliver your order and contact you about it, and to run your account if you create one (to perform our contract with you); to deliver to the person you are sending flowers to (our legitimate interest, and theirs, in getting the flowers to them); to keep the records tax law requires, such as VAT invoices (a legal obligation); and to keep this website secure, stop fraud and spam, take a photo as proof of delivery, tell the person who ordered how their flowers were delivered and deal with any complaint, refund or dispute (our legitimate interests). You need to give us your name, contact details and delivery details to place an order; without them we cannot take or deliver it.

Data sharing

We do not sell your personal data. Our website and ordering system run on FloristGrow, a platform provided by Pinwheel Media Ltd (company number 16851462), which handles your data on our behalf and only on our instructions. Pinwheel and the companies it uses may process your data to run this website and fulfil your order. They provide hosting (Vercel and Railway, in the United States, and a backup server run by OVHcloud in the United Kingdom), payments (Stripe, in the United States and elsewhere), order, delivery, account and enquiry emails (Resend, in the United States) and a check that our forms are sent by a person (Cloudflare, in the United States and on its global network). If QA Blossom Test offers the AI shopping assistant, Anthropic and Supabase are also used, as described in the next section. Anthropic may also receive your details if someone at QA Blossom Test types them into FloristGrow’s AI help chat, as described in “AI help chat used by QA Blossom Test” below. If we contact FloristGrow’s support team about your order, what we send is handled by the providers Pinwheel uses for its support, which are listed in Pinwheel’s own privacy policy at floristgrow.co.uk/privacy.

Where your data is processed outside the UK, we rely on UK adequacy regulations or, where they do not apply, on the UK’s approved data transfer contracts. You can ask us which safeguard applies to any provider.

AI shopping assistant

Shops on the FloristGrow platform may offer an AI-powered shopping assistant (“AI concierge”) — a chat icon you can open to ask about flowers, occasions, or general questions about the shop. If you cannot see a chat icon on this website, QA Blossom Test does not currently offer it, and nothing in this section applies to you.

If QA Blossom Test offers this feature and you use it, the exact text you type is sent to Anthropic (Anthropic Ireland, Limited and Anthropic, PBC), a third-party AI company whose service runs in the United States, together with QA Blossom Test’s current product catalogue and some basic shop information (such as opening hours, delivery areas and contact details), so that Anthropic’s AI model can generate a reply. Anthropic processes this as a sub-processor of FloristGrow’s technology provider, Pinwheel Media Ltd (company number 16851462) — see “Data sharing” above.

Please bear this in mind before you type something into the chat: if your message includes personal information — for example, your name, someone else’s name, or a delivery address — that text is sent to Anthropic as part of the conversation, because the assistant has no way to filter this out. We recommend keeping personal or sensitive details out of the chat and using the checkout form for anything order-specific.

The assistant cannot look up, change or cancel an existing order and has no access to your account or order history — for anything about an existing order, please contact us directly.

Your conversation is held in temporary server memory for the length of your chat session (capped at the most recent 40 messages) and is not saved to a permanent database; it is cleared once your session ends or the underlying service restarts. Your browser also keeps a few small items for the assistant while the tab stays open, as our Cookie Policy explains. Separately, a short record that a conversation happened and, where relevant, which product it recommended is kept for service analytics. That record is held by Supabase, Inc., a database provider, in the European Union, and does not include the wording of your messages.

Anthropic’s service runs in the United States, so using the assistant means your message is sent to, and processed in, the United States as part of generating a reply. That transfer is covered by Anthropic’s data processing terms, which apply automatically to our use of their service and which put the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in place — the safeguards UK data protection law recognises for sending personal data outside the UK. Under those terms Anthropic acts only as a processor, handling your message on instructions rather than for its own purposes.

The legal basis for this processing is QA Blossom Test’s legitimate interests in offering a shopping tool that you have chosen to use, and in responding to the specific question you have asked. You can choose not to use the assistant at any time.

AI help chat used by QA Blossom Test

QA Blossom Test may use an AI help chat in FloristGrow’s back office to ask how to use the platform. The help chat cannot see your order or your account. If someone at QA Blossom Test types your details into a question, for example to ask how to change your order, those details are sent to Anthropic (Anthropic Ireland, Limited and Anthropic, PBC) in the United States so that it can write the answer and, if that person asks it to, a draft support ticket, and are kept by FloristGrow on QA Blossom Test’s behalf for 3 months after the chat’s last message. If that person sends the ticket, it is kept in FloristGrow’s support desk and portal for 12 months after its last message. Anthropic may not use those details to train its models. That transfer is covered by Anthropic’s data processing terms, which put the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in place, and under them Anthropic acts only as a processor. The legal basis is QA Blossom Test’s legitimate interests in getting help to run its shop.

Data retention

We keep your order details for our business and tax records. Seven years after the date of your order, we remove from it the payment reference (the Stripe payment ID), the delivery area and any personal data of yours, or of the person you sent flowers to, still on it, including the delivery photo and the driver’s note. The order’s amounts, taxes, refunds, dates and products are kept with no end date, as the record of what was sold and paid for. If you have an account with this shop, the order stays in your order history until your account is deleted. Your account, and the details in it, are kept until you ask us to delete it, or until this shop closes on the FloristGrow platform (see below). If you ordered as a guest, the order stays linked to your guest record, which holds your name, email address, phone number and addresses, until seven years after your latest order or unfinished basket, when those details are removed. We keep any VAT invoices issued to you for our tax records while this shop trades on the FloristGrow platform, and for up to seven years after it closes (see below).

If you ask us to delete your details, we’ll remove your name, contact details, addresses and messages, and those of the person you sent flowers to, from your past orders and replace them with “Deleted customer”. The delivery photo, anything the driver wrote about the delivery and any notes we added to an order are not removed at that point: they stay with the order until seven years after its date, and are then removed as described above. The order itself stays. We keep its amounts, taxes, refunds, dates and products with no end date; its payment reference and delivery area stay only until seven years after the date of the order; and we keep any VAT invoices issued to you. If HMRC has formally asked the platform for documents about this shop or about every shop on the platform, or has said that it is likely to (see below), the details on your orders are kept while that lasts, and if the platform cannot confirm that no such request applies, they are kept until it can; we then finish deleting them.

If we stop trading on the FloristGrow platform, this website closes, and your details are deleted from the platform 30 days after it closes (or, if we asked for a copy of our data, once that copy has been sent to us), apart from VAT invoices, which the platform keeps for 7 years after this website closes unless we ask the platform to send them to us, confirm that we have them, and delete its copy, and apart from the payment reference and delivery area on your orders, which are removed seven years after the date of each order, as described above.

Deleted details are removed from this website at once, apart from a sealed copy that is destroyed after 7 days, kept so that a mistake can be put right. They can stay in backups of the platform for up to 89 days, until those backups expire or are deleted. Backups are used only to recover from a failure.

If you write to us through this website’s contact or enquiry form, the platform keeps what you sent (your name, email address, message and any event details), and a record of each email sent about it, each for no longer than 12 months after it was sent, and then deletes it. The platform also keeps a record of the other emails it sends you that are not about an order, such as a password reset or a welcome to your account, for no longer than 12 months after each was sent. If HMRC, the UK tax authority, has formally asked the platform for documents about this shop or about every shop on the platform, or has said that it is likely to, what you sent and those records are all kept while that lasts, including any that HMRC does not want, so that none that it does want is deleted by mistake; they are then deleted as described above. A record the platform cannot link to any one shop is kept, for the same reason, while such a request about any shop on the platform lasts, because it may be one of that shop’s documents; it is then deleted as described above. If the platform cannot confirm that no such request applies, it keeps what you sent and those records until it can, and then deletes them as described above.

Your details may be kept for longer than this page says where the law requires it: for example, where HMRC, the UK tax authority, has formally asked the platform for documents that include them. They are then kept only until the law allows them to be deleted (or, for what you sent through the contact or enquiry form and the records of emails described in the paragraph above, for as long as that paragraph says), and are then deleted as described above.

Your rights

Under UK data protection law you have the right to ask us for a copy of your personal data, to correct it, to delete it, to restrict how we use it, to object to our using it where we rely on our legitimate interests, and to receive the data you gave us in a format you can reuse. To use any of these rights, contact us at pinwheelindustries@gmail.com. We will reply within one month. If you are unhappy with how we have handled your data, tell us first at pinwheelindustries@gmail.com: we will acknowledge your complaint within 30 days and tell you what we have done about it. You also have the right to complain to the UK’s data protection regulator, the Information Commission (ico.org.uk).

Cookies

We use only the cookies this website needs to work. See our Cookie Policy for details.

Contact

If you have questions about this policy, please email pinwheelindustries@gmail.com.