Privacy policy

PRIVACY POLICY (UNITED KINGDOM)

French Bloom SAS, www.frenchbloom.com (UK site)

Effective: 2 November 2026

This Privacy Policy explains how French Bloom SAS, a French simplified joint-stock company (société par actions simplifiée) whose registered office is at 32 rue Washington, 75008 Paris, France, registered with the Paris Trade and Companies Register (RCS Paris) under number 884 108 119, VAT number FR19884108119 (“French Bloom”, “we”, “us”), collects, uses and shares your personal data when you visit our website, make a purchase, join our loyalty program “The Club”, or otherwise communicate with us (together, the “Services”).

This Policy applies to customers and visitors in the United Kingdom. We process your personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”). It should be read together with our Terms of Sale and our Terms of Use.

Please read this Policy carefully. By using our Services, you acknowledge that you have read it.

---

1. Controller and contact

French Bloom SAS is the controller of your personal data for the purposes of the UK GDPR.

French Bloom SAS
32 rue Washington, 75008 Paris, France
Email: ordersupport@french-bloom.com
RCS Paris 884 108 119, VAT number FR19884108119

For any question about this Policy or to exercise your rights, contact us at the details above.

2. Personal data we collect

“Personal data” means any information relating to an identified or identifiable person. Depending on how you interact with the Services, we may collect:

• Contact details: name, billing and delivery address, phone number, email address.
• Order and transaction data: items viewed, added to your basket, purchased, returned or exchanged; order history; delivery details; gift card and discount code use.
• Payment data: payment method and payment confirmation. Card details are processed by our payment providers and are not stored on our own servers.
• Account data: username, password, preferences and settings.
• Loyalty program data: points earned and redeemed, discount codes, activity in The Club.
• Date of birth: where our website asks you to confirm your age.
• Communications: messages and information you send to our customer service, survey responses, and your marketing preferences.
• Device and usage data: IP address, approximate location derived from your IP address, browser and device type, pages visited, date and time of visits, and similar technical data collected through cookies and similar technologies.
• Business contact data: where you deal with us on behalf of a business, such as your name, role, business address, email and phone number.

We do not intentionally collect special category data (such as health data, racial or ethnic origin, or religious beliefs). Please do not send us such data.

3. How we collect personal data

We collect personal data:

• directly from you, when you create an account, place an order, join The Club, subscribe to our emails, enter a promotion or survey, or contact us online, by phone, by email or on social media;
• automatically, through your device, cookies, web beacons and similar technologies when you use our website or open our emails;
• from third parties, such as our service providers, payment, delivery and analytics providers, advertising and social media partners, and publicly available sources.

If you choose not to give us certain data, we may not be able to provide some Services, such as processing your order.

4. Why we use your personal data, and our legal bases

We use your personal data for the purposes below, relying on the legal bases set out in the UK GDPR:

Where we rely on legitimate interests, we balance them against your rights and interests. You can ask us for more information about this balancing exercise using the contact details above.

5. Direct marketing

We send you marketing emails and SMS messages only where you have consented, or where PECR allows us to do so (for example where you bought from us and we market similar products, and you were given a chance to opt out). Every marketing message includes a simple way to unsubscribe, and you can also unsubscribe at any time by contacting us at ordersupport@french-bloom.com. If you unsubscribe, we may still send you non-promotional messages, such as order and account notifications. We do not sell your personal data to third parties for their own marketing.

6. Who we share your data with

We may share your personal data with:

• Shopify, which hosts our online store and provides related technology;
• payment providers (such as card networks, PayPal and Shop Pay);
• delivery and logistics providers, including the carriers that deliver your orders;
• IT, hosting, customer service, analytics and marketing providers, including the platform that operates The Club (Smile.io), Didomi (cookie consent), HubSpot, Google and Meta, and email or advertising tools;
• professional advisers and auditors (legal, accounting, tax);
• authorities, courts, regulators and law enforcement, where required by law or to protect our rights;
• a buyer or successor, in the event of a merger, sale or restructuring of our business;
• other third parties, where you instruct us or consent.

Our providers process your data on our behalf and under our instructions, or as independent controllers where they use data for their own purposes, in which case their own privacy notices apply. For example, Shopify may process certain data as an independent controller for its own purposes. You can read more in Shopify’s Consumer Privacy Policy and exercise certain rights through the Shopify privacy portal.

7. International transfers

We are based in France, so your personal data is transferred from the United Kingdom to France and processed there. France is covered by UK adequacy regulations, which means the UK recognises it as offering an adequate level of data protection.

Some of our service providers (including Shopify and its sub-processors) may process data in other countries, including the United States. Where the destination country is not covered by UK adequacy regulations, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK-US data bridge for certified recipients. You may ask us for information about these safeguards using the contact details above.

8. Cookies and similar technologies

We use cookies, web beacons and similar technologies to operate the website (for example your basket and session), remember your preferences (including your date of birth entry), measure audience and performance, and, with your consent, show you advertising.

• Strictly necessary cookies enable you to navigate the website and use its features, such as your basket. They do not need your consent.
• Performance cookies (for example Google Analytics, Meta Business, HubSpot and Shopify) tell us how visitors use the website, so we can improve it.
• Functionality cookies remember choices you make.
• Targeting and advertising cookies (for example set by Google, Meta, HubSpot and Shopify) help show you more relevant advertising and measure its effectiveness.

We set performance, functionality and targeting cookies only with your consent, in line with PECR. Most of our cookies expire within thirty (30) days, although analytics cookies may persist for two (2) to ten (10) years. You can accept or refuse non-essential cookies through our cookie banner and change your choice at any time. You can also block cookies in your browser settings, but some features of the website, such as the shopping basket, may then not work. Third parties may set cookies on our website, and their own policies apply to their use of the data.

9. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure and alteration. These include encrypted transmission (SSL/TLS) of sensitive information and access controls. Card details are handled by payment providers that follow industry standards such as PCI-DSS. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. If you have an account, please keep your login details confidential.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (“ICO”) within 72 hours where required and, where the risk is high, inform you without undue delay.

10. How long we keep your data

We keep your personal data only as long as needed for the purposes described above, and as required by law. In particular:

• Order, invoice and accounting data: for the period required by UK and French accounting and tax law;
• Customer account data: for as long as your account is active, and then for a limited period afterwards;
• Marketing data: until you unsubscribe or withdraw your consent, or after a period of inactivity;
• Loyalty program data: for as long as you are a member; points expire after twelve months of account inactivity, as set out in our Terms of Sale;
• Customer service communications: for the time needed to handle your request and any follow-up or dispute;
• Cookies and technical data: for the duration stated in our cookie settings.

When data is no longer needed, we delete or anonymise it.

11. Your rights

Under the UK GDPR, you have the right to:

• be informed about how we use your personal data, which is the purpose of this Policy;
• access the personal data we hold about you and obtain a copy;
• have inaccurate data rectified or incomplete data completed;
• have your data erased, in certain circumstances and subject to our legal retention obligations;
• restrict the processing of your data in certain cases;
• receive your data in a structured, commonly used and machine-readable format, or have it transferred to another controller (data portability), where the processing is based on consent or a contract and carried out by automated means;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We do not currently make such decisions.

To exercise your rights, contact us at ordersupport@french-bloom.com. We may need to verify your identity first. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, and we will tell you if we do. We do not normally charge a fee. These rights are not absolute and may be limited as permitted by law. You may unsubscribe from marketing emails at any time using the link in each email.

12. Complaints

If you are not satisfied with how we handle your personal data, please contact us first at ordersupport@french-bloom.comor by post at the address above, so that we can try to resolve the matter. We will acknowledge your complaint within thirty (30) days and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

• Website: www.ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Children

Our Services are intended for adults and are not directed at children. We do not knowingly collect personal data from persons under 18. If you believe that a child has provided us with personal data, please contact us and we will delete it.

14. Third-party websites

Our Services may contain links to third-party websites, including social media platforms. We do not control them and are not responsible for their content or privacy practices. Information you share in public or semi-public spaces, such as on social media, may be visible to others. We recommend that you read the privacy policies of any website you visit.

15. Changes to this Policy

We may update this Policy from time to time, for example to reflect changes in our practices or in the law. The current version is always available on our website with its effective date, and we will give you notice of material changes where required by law.