Privacy policy

Last updated: September 3, 2026

This Privacy Policy explains how LOTTY'S FLOWERS LTD, trading as Lotty's Flowers ("Lotty's Flowers", "we", "us" or "our"), collects, uses and shares personal information when you visit lottysflowers.com, place an order, make an enquiry, sign up for marketing or otherwise interact with us.

Who we are

LOTTY'S FLOWERS LTD is a company registered in England and Wales under company number 15459588. Our registered office and shop address is 2b Market Place, Faversham, Kent, ME13 7AG, United Kingdom. For the purposes of UK data protection law, LOTTY'S FLOWERS LTD is the data controller.

Personal information we collect

Depending on how you interact with us, we may collect:

  • Contact information: your name, billing or delivery address, email address and telephone number.
  • Order and transaction information: products viewed, placed in your basket or ordered; delivery or collection details; order value; payment method; payment confirmation; discounts; subscriptions, pre-orders or cancellations; and previous purchases.
  • Recipient information: where flowers or gifts are ordered for somebody else, the recipient's name, delivery address, telephone number, delivery instructions and card message.
  • Payment information: payment information is processed securely by Shopify and the relevant payment provider. We normally receive payment confirmation and limited transaction details, but we do not normally see or store your complete payment-card number.
  • Account information: account login details, preferences and settings if you choose to create a customer account.
  • Enquiry and communication information: information you provide when contacting us, including customer-service, wedding, funeral or event enquiries and any relevant dates, venues, preferences or correspondence.
  • Marketing information: your email-marketing preferences and interactions with our marketing emails.
  • Technical and usage information: IP address, browser, device, network information, cookie identifiers and information about how you use our website, including pages viewed, clicks and shopping activity.

Please avoid including unnecessary sensitive or confidential information in card messages, delivery instructions or enquiries.

Where we obtain information

We obtain personal information directly from you, automatically from your device when you use our website, from a purchaser arranging a gift for a recipient, and from service providers that support our website, payments, analytics, advertising and communications.

How and why we use personal information

We use personal information for the following purposes and lawful bases:

  • To provide our products and services: to process payment, prepare and fulfil orders, arrange delivery or collection, manage subscriptions or pre-orders, provide order updates and handle cancellations, complaints or refunds. We do this to perform our contract with the purchaser or to take steps requested before entering into a contract.
  • To deliver gifts: our own team uses the recipient's name, address, telephone number and delivery instructions to complete the requested delivery and resolve delivery problems. We do this in our legitimate interests and those of the purchaser and recipient in delivering the gift successfully.
  • To respond to enquiries: including wedding, funeral and event enquiries, provide quotations and customer support, and maintain appropriate records. We do this to take requested pre-contract steps and for our legitimate interests in providing good customer service.
  • To operate and improve our business: to understand website performance, improve our products and website, troubleshoot problems and measure the effectiveness of our services. We rely on our legitimate interests where appropriate and on consent where cookies or similar technologies require it.
  • For security and fraud prevention: to protect customers, payments, our website and our business, investigate suspicious activity and enforce our terms. We rely on our legitimate interests and, where applicable, our legal obligations.
  • To comply with the law: including tax, accounting, regulatory, court or law-enforcement requirements. We process this information where necessary to meet a legal obligation.
  • For email marketing and advertising: as described below. We rely on consent or another basis permitted by applicable electronic-marketing law.

Gift recipients

If you place an order for somebody else, you confirm that you are authorised to provide the recipient information needed to fulfil the order. We use that information only for the delivery, related customer service, fraud prevention and any legal obligations. We do not add gift recipients to our email-marketing list unless they separately choose to subscribe.

Email marketing

We send promotional communications by email only. We may send them when you have consented or where the law permits us to contact an existing customer about similar products. You can unsubscribe at any time using the link in any marketing email or by contacting us. Unsubscribing from marketing will not stop essential messages about an order, delivery, payment or account.

Cookies, analytics and advertising

Our website uses cookies and similar technologies. Some are strictly necessary for functions such as the shopping basket, checkout, security and remembering privacy choices. Subject to your consent choices and applicable law, we also use:

  • Microsoft Clarity to understand how visitors use our website through information such as clicks, scrolling, heatmaps and session recordings;
  • Google services, including analytics and advertising tools, to measure website use and marketing performance and, where enabled, show relevant advertising; and
  • Meta tools, including Facebook and Instagram advertising technology, to measure advertising and create or reach advertising audiences.

These providers may receive device identifiers, IP address, website activity and information about interactions with adverts. Advertising tools may use this information to create audiences or personalise advertising. We ask for consent before using non-essential tracking technologies where required by law. You can accept, reject or change your choices through the cookie or privacy settings available on our website. We do not sell personal information for money.

Who we share information with

We share personal information only where reasonably necessary with:

  • Shopify, which hosts our online store and provides ecommerce, checkout, customer-account, email and related services;
  • payment providers and financial institutions that securely process and verify payments;
  • technology and service providers supporting our website, order and delivery scheduling, cloud storage, communications, security and customer service;
  • Microsoft, Google and Meta for analytics or advertising where enabled and consistent with your consent choices;
  • professional advisers, insurers, regulators, courts, law-enforcement bodies or other authorities where reasonably necessary or legally required; and
  • a purchaser or new owner of the business if our business or assets are reorganised, sold or transferred, subject to appropriate confidentiality protections.

Deliveries are completed by our own team. Recipient details are provided only to team members who need them to prepare or complete the delivery.

Shopify

Our store is hosted by Shopify, which processes personal information to provide and improve its services. Shopify and its service providers may process information outside the United Kingdom. Shopify may also process information in its own capacity for certain enhanced features and network services. More information is available in the Shopify Consumer Privacy Policy and through the Shopify Privacy Portal.

International transfers

Some of our service providers operate outside the United Kingdom. Where personal information is transferred internationally, we rely on an applicable adequacy regulation or appropriate contractual and organisational safeguards, such as the UK International Data Transfer Agreement, UK Addendum or recognised standard contractual clauses.

How long we keep information

We retain personal information only for as long as necessary for the purpose for which it was collected and to meet legal, accounting, fraud-prevention and dispute-resolution requirements. In particular:

  • order, invoice and accounting records are generally retained for six years from the end of the company financial year to which they relate;
  • customer-service, complaint, wedding and event-enquiry records are generally retained for up to two years after the last contact or completion of the relevant order or event, unless we need them for longer to establish, exercise or defend legal claims;
  • email-marketing information is retained while you remain subscribed, and we may retain a minimal suppression record after you unsubscribe so that we respect your choice; and
  • cookie, analytics and advertising data is retained according to our selected settings and the relevant provider's retention periods.

We may retain information for longer where required by law, where a dispute or investigation is ongoing, or where reasonably necessary to prevent fraud or protect our legal rights.

Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to:

  • request access to the personal information we hold about you;
  • ask us to correct inaccurate or incomplete information;
  • ask us to delete your information;
  • ask us to restrict how we use your information;
  • object to processing based on legitimate interests;
  • receive certain information in a portable format;
  • withdraw consent at any time where we rely on consent; and
  • object at any time to the use of your information for direct marketing.

These rights are not absolute and may be subject to legal exceptions. To exercise a right, contact us using the details below. We may need to verify your identity and will normally respond within one month.

Security

We use reasonable technical and organisational measures to protect personal information. However, no method of transmission or storage is completely secure, so please do not send sensitive or confidential information through an unsecured channel.

Children

Our website and services are not directed at children under 16, and we do not knowingly collect personal information from children for marketing or profiling. A parent or guardian may contact us to request the deletion of information provided by a child.

Third-party links

Our website may contain links to websites or services operated by other organisations. Their privacy practices are governed by their own policies, and we are not responsible for those external services.

Changes to this policy

We may update this Privacy Policy to reflect changes to our practices, technology or legal requirements. We will publish the updated version on our website and revise the date shown at the top.

Contact and complaints

If you have a question, wish to exercise your rights or want to complain about our use of personal information, please contact:

LOTTY'S FLOWERS LTD
2b Market Place
Faversham, Kent
ME13 7AG
United Kingdom

Email: shop@lottysflowers.com
Telephone: 01795 227564
Company number: 15459588

You also have the right to complain to the Information Commissioner's Office (ICO), the United Kingdom's data protection regulator. Information about making a complaint is available at ico.org.uk/make-a-complaint.