Privacy Policy

Last updated: 8 October 2026

This policy explains what we do with your personal information when you visit or buy from scoopandbloom.co.uk. We have tried to write it in plain English rather than legalese.

Who is responsible for your data

The data controller is PTM Solutions Limited, trading as Scoop & Bloom, a company registered in England and Wales (company number 09327661), registered office Hilton House, Block A, Lord Street, Stockport, SK1 3NA.

For anything to do with your data, email david@scoopandbloom.co.uk.

What we collect

What	When
Name, email address, delivery and billing address, phone number	When you place an order
What you ordered, when, and for how much	When you place an order
Email address and first name	If you sign up to our mailing list
Messages you send us	When you contact us
Device type, browser, pages viewed, how you arrived at the site	Automatically, while you browse

We never see your card details. Payments are handled entirely by Shopify Payments and, where offered, PayPal. Your card number does not pass through us and we do not store it.

Why we use it, and our lawful basis

To fulfil your order — take payment, pack it, post it, email you tracking, handle returns. Lawful basis: performance of our contract with you.
To keep our accounts — order and payment records. Lawful basis: our legal obligation under tax law.
To answer your questions and deal with complaints. Lawful basis: performance of our contract, or our legitimate interest in running the shop properly.
To send you marketing emails about new lines and offers. Lawful basis: your consent, which you gave by signing up and can withdraw at any time. Every email has an unsubscribe link and we honour it immediately.
To understand how the site is used and improve it. Lawful basis: your consent for non-essential cookies, or our legitimate interest in aggregated, non-identifying statistics.
To prevent fraud and keep the site secure. Lawful basis: our legitimate interest in protecting the business and our customers.

Who we share it with

We do not sell your personal information to anyone, ever. We share it only with the companies that make the shop work:

Shopify — hosts the shop, processes orders and payments. Shopify's privacy policy.
Royal Mail and any other carrier we use — your name, delivery address and, where you have provided it, your email or phone number for delivery notifications.
Our email provider — your email address and name, if you are on the mailing list.
Apps installed on our Shopify store that are needed to run it, such as the pick-and-mix builder.
Our accountant, and HMRC — order records, for tax.
Law enforcement or regulators — only where we are legally required to.

Where your data goes

Some of these providers are based outside the UK, including in the United States. Where data is transferred outside the UK we rely on the safeguards permitted by UK data protection law, such as the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision covering the receiving country.

How long we keep it

Order and payment records: seven years from the end of the relevant financial year, because tax law requires it.
Customer account details: for as long as you keep the account, and then deleted on request.
Mailing list: until you unsubscribe, and then we keep a record of the unsubscribe so we do not email you again by mistake.
Emails and messages: two years, unless they relate to an ongoing matter.
Analytics: as set by the provider, typically 14 to 26 months.

Cookies

Cookies are small files stored by your browser. We use:

Essential cookies that make the shop work — keeping your basket, keeping you logged in, remembering your cookie choice. These cannot be turned off.
Analytics cookies that tell us, in aggregate, which pages people look at and where they came from.
Marketing cookies that let us measure whether our advertising works.

We only set analytics and marketing cookies if you agree. You can change your mind at any time using the cookie settings on this site, or by clearing cookies in your browser. Blocking essential cookies will stop the shop working.

Your rights

Under UK data protection law you have the right to:

ask for a copy of the personal data we hold about you;
have inaccurate data corrected;
have your data deleted, where we have no overriding legal reason to keep it;
restrict how we use your data while a concern is being resolved;
object to us using your data on the basis of legitimate interests;
receive your data in a portable, machine-readable format;
withdraw consent at any time, including for marketing.

Email david@scoopandbloom.co.uk and we will respond within one month. There is no charge.

We do not use your data for automated decision-making or profiling that has a legal effect on you.

Children

We sell sweets, so children are obviously welcome to enjoy what we send — but the shop is intended to be used by adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us their details, email us and we will delete them.

Keeping it safe

The site runs over HTTPS. Access to customer data is limited to the people who need it to pack and post orders, and is protected by strong, unique passwords and two-factor authentication. We cannot promise that any system is impossible to breach, but if a breach occurred that put your rights at risk we would tell you and the Information Commissioner's Office without delay.

Complaining

If you are unhappy with how we have handled your data, please tell us first so we can try to fix it. You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk