Privacy Policy
Last updated: 22 August 2026
This policy explains how CBDBLOOM collects and uses your personal data, and what rights you have. We are committed to protecting your privacy and handling your data transparently.
Who we are (data controller)
The data controller is CBD Bloom Ltd, company number 57578521, registered office Stretford Road, Trafford, England, M16 9BE, United Kingdom.
ICO registration number: 937866A
Data protection contact: sales@cbdbloom.co.uk
What data we collect
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Name, delivery and billing address, email, phone | To process and deliver your order | Performance of a contract |
| Payment details | To take payment (handled by our payment provider — we do not store card numbers) | Performance of a contract |
| Order history | To provide support, handle returns and meet accounting duties | Contract / legal obligation |
| Account login details | To let you manage your account | Performance of a contract |
| Marketing preferences and email address | To send you offers and updates, if you have opted in | Consent |
| Website usage and cookie data | To improve the site and measure performance | Consent |
| Age confirmation | To confirm you are 18 or over | Legal obligation / legitimate interests |
Who we share data with
We share personal data only with providers who help us run the business, and only as far as needed:
- Payment processing: Revolut, PayPal and UK bank transfer
- Delivery and couriers: Royal Mail
- Website hosting: Hostinger
- Email and marketing: we do not currently use an email marketing platform
- Analytics: none currently in use
We do not sell your personal data.
International transfers
Some of our providers may process data outside the UK. Where that happens we rely on the UK International Data Transfer Addendum or equivalent safeguards approved under UK GDPR.
How long we keep data
- Order and transaction records: 6 years, to meet HMRC requirements
- Account data: for as long as your account is open, then 12 months after closure
- Marketing consent records: until you unsubscribe, then 24 months
- Website analytics: 14 months
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased in certain circumstances
- Restrict or object to how we process your data
- Data portability
- Withdraw consent at any time, where we rely on consent
To exercise any of these, email sales@cbdbloom.co.uk. We will respond within one month.
Marketing
We do not currently send marketing emails. If we introduce marketing communications in future, we will only send them where you have opted in, or where you have bought from us and we are offering similar products, and every message will include an unsubscribe link.
Cookies
See our Cookie Policy for details of the cookies we use and how to control them.
Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) across the site and at checkout.
Complaints
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.