Privacy Policy

Privacy Policy

Last updated: 22 August 2026

This policy explains how CBDBLOOM collects and uses your personal data, and what rights you have. We are committed to protecting your privacy and handling your data transparently.

Who we are (data controller)

The data controller is CBD Bloom Ltd, company number 57578521, registered office Stretford Road, Trafford, England, M16 9BE, United Kingdom.

ICO registration number: 937866A

Data protection contact: sales@cbdbloom.co.uk

What data we collect

Data Why we collect it Lawful basis
Name, delivery and billing address, email, phone To process and deliver your order Performance of a contract
Payment details To take payment (handled by our payment provider — we do not store card numbers) Performance of a contract
Order history To provide support, handle returns and meet accounting duties Contract / legal obligation
Account login details To let you manage your account Performance of a contract
Marketing preferences and email address To send you offers and updates, if you have opted in Consent
Website usage and cookie data To improve the site and measure performance Consent
Age confirmation To confirm you are 18 or over Legal obligation / legitimate interests

Who we share data with

We share personal data only with providers who help us run the business, and only as far as needed:

  • Payment processing: Revolut, PayPal and UK bank transfer
  • Delivery and couriers: Royal Mail
  • Website hosting: Hostinger
  • Email and marketing: we do not currently use an email marketing platform
  • Analytics: none currently in use

We do not sell your personal data.

International transfers

Some of our providers may process data outside the UK. Where that happens we rely on the UK International Data Transfer Addendum or equivalent safeguards approved under UK GDPR.

How long we keep data

  • Order and transaction records: 6 years, to meet HMRC requirements
  • Account data: for as long as your account is open, then 12 months after closure
  • Marketing consent records: until you unsubscribe, then 24 months
  • Website analytics: 14 months

Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Have inaccurate data corrected
  • Have your data erased in certain circumstances
  • Restrict or object to how we process your data
  • Data portability
  • Withdraw consent at any time, where we rely on consent

To exercise any of these, email sales@cbdbloom.co.uk. We will respond within one month.

Marketing

We do not currently send marketing emails. If we introduce marketing communications in future, we will only send them where you have opted in, or where you have bought from us and we are offering similar products, and every message will include an unsubscribe link.

Cookies

See our Cookie Policy for details of the cookies we use and how to control them.

Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) across the site and at checkout.

Complaints

If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.