Privacy notice

This notice says what this website does with personal information, and the reason for each use. The termscover shop orders, workshop tickets, hire, and payments.

LAURENNE HOPKINS FLOWERS LTD, company number 16301498, registered in England. Registered office: 26 Oxcroft Estate, Oxcroft, Worksop, England, S80 4NA. ICO registration ZC016531.

Data protection contact:contact@laurennehopkinsflowers.co.uk. The public phone is+44 7920 715992. The studio is in Bolsover, Derbyshire. The visit address is on thecontact page.

Contract.Shop orders, workshop bookings, A La Carte hire, wholesale orders, and pay-page payments.

Legal obligation.Keeping financial and accounting records.

Legitimate interests.Responding to what the person asked for: the contact form, the client list, and Dubsado enquiries.

Explicit consent.Dietary and allergy notes on a workshop booking. The booking form asks for that consent, and the box starts unticked. We do not send marketing emails. We would not send them without a separate consent. We send none now.

Card payments are taken on Stripe Checkout, in pounds, with prices that already include VAT at 20%. The card number is entered on Stripe’s page. The records this site writes store a Stripe session id, payment intent id, and customer id. They do not include a card number.

Shop.The basket asks how you want the flowers (collection or local delivery), the date, a collection time if you are collecting, your name, and optional order notes. Local delivery is delivered between 8am and 8pm on that date. Some flowers also carry a gift message or a line note. Checkout then asks Stripe for a billing address and a phone number, and for a UK delivery address when you chose delivery. A paid shop order is stored as an order. Cancelling before you pay returns you to this site and nothing is charged.

Workshops.The events basket asks for the lead booker’s name and email, how many tickets, optional emails for other people on the booking, an optional group name, and an optional food, allergy, or dietary note. If that note has text, the consent box must be ticked before checkout starts. Stripe Checkout asks for a billing address. A paid booking is stored as an event booking, with the consent and the time it was given when a note was sent. The lead booker and each participant are emailed a ticket. Cancelling before you pay charges nothing.

A La Carte deposit.The booking step collects the wedding date, colour palette, preferences, name, email, an optional phone number, and an optional venue or fayre code, then charges either the £100 deposit including VAT or the full menu total including VAT. Stripe Checkout asks for a billing address and a phone number. A paid booking is stored as a wedding booking. Leaving Checkout before you pay returns you to the booking page and does not charge you.

Wholesale.A signed-in florist pays for buckets on a separate checkout. Stripe is given the florist’s email and asks for a billing address and a phone number. Collection only. A paid order is stored with the shop orders, marked as wholesale.

A one-off payment.The pay page takes a name, an amount, and an optional email and note, and sends them to Stripe. That payment is not written into the orders table.

Stripe also emails the customer receipt for a shop or wholesale order. A workshop ticket says a receipt comes from Stripe as well. Stripe keeps its own records under its legal duties. Its privacy policy is atstripe.com/gb/privacy.

The contact form sends your enquiry by email through Resend. It asks for your name, email, an optional phone number, an optional date, what the enquiry is about, an optional location, and a message. The message goes to the studio inbox (or another address set for enquiries), with your email as the reply-to. This site does not write that form into the database.

The wedding estimate page can also open a message in your own email app, with the estimate included. That path is not sent by Resend. Wedding and funeral enquiry pages embed a Dubsado form instead, described below.

After a paid workshop, Resend sends the lead booker a ticket. That email says workshops are not refunded, and that if you cannot attend a box kit is set aside to make at home — reply to arrange collection. Each participant gets a joining note without the payment line. The same moment emails the studio. Shop, wholesale, and A La Carte payments email the studio through Resend. They do not send the customer a Resend confirmation: the customer receipt for shop and wholesale is Stripe’s, and an A La Carte booking has a staff email only.

A florist can ask for a one-time wholesale sign-in link. Resend sends it to the email address they type. The link expires after 20 minutes. It is only sent when that email is already on the florist list.

While a Resend account is active, Resend says email and log data is kept for 30 days on the Free, Pro, and Scale plans. Enterprise plans can keep it for a different period. Resend stores that data in the United States. Choosing a sending region does not move the stored data. After an account is closed, Resend says remaining customer data is deleted within 90 days, and backups within 7 days. This website does not record which Resend plan is in use. The source isresend.com/security/gdpr.

The contact form (/contact/), the wholesale sign-in (/wholesale/unlock/) and the A La Carte booking form (/wedding-flowers/book/) use Cloudflare Turnstile, a security check that tells people from bots and stops spam. When you send the form, our server sends the check result and your IP address to Cloudflare to confirm it is genuine. To run the check, Cloudflare may process your IP address and signals from your browser and device, such as the browser type and connection details. We use it for security and to stop spam, not for advertising. Our lawful basis is legitimate interests: keeping the site and its forms secure and free of spam. Turnstile runs only on these three pages. The shop, workshop and pay pages do not use it.

Paid checkouts are written to Supabase Postgres hosted in the EU (AWS region eu-west-1). The site connects with a database URL. It does not use a public anonymous key as that connection.

• Orders — shop and wholesale. Email, name, amount, currency, what was bought, and the collection or delivery date, time, and address when Stripe or the basket provided them.
• Event bookings — workshop tickets. Email, name, session, quantity, optional group name, optional dietary note, the dietary consent and the time it was given when a note was stored, and any participant emails.
• Clients — a row matched on the email address, or else on the Stripe customer id. The name, email, that customer id, and a label for where the checkout came from (shop, wholesale, workshop, or A La Carte wedding). An existing client keeps their other labels.
• Wedding bookings — the A La Carte deposit or full payment. Name, email, optional phone, wedding date, palette, preferences, the menu lines, whether you paid the deposit or the full amount, and, when a venue or fayre code, a venue page, or a source and medium were sent, those details inside the estimate record on the booking. There is no separate column for them.

A one-off payment on the pay page is not one of these rows. If saving the client fails, the paid order or booking is still stored, without that client link.

The site is built to run on Vercel. Every page loads Vercel Web Analytics and Vercel Speed Insights.

Vercel Web Analytics does not use cookies. Visitors are identified by a hash of the incoming request, and that hash is not used to track someone across different days or different websites. The hash is valid for a single day and then resets. Vercel’s analytics privacy policy says the product works without third-party cookies, and that the visitor session is discarded after 24 hours. Seevercel.com/docs/analyticsandvercel.com/docs/analytics/privacy-policy.

The Speed Insights privacy policy does not say whether that script sets a cookie. It says the measurements are anonymous, are not tied to an individual visitor or IP address, and cannot be used to reconstruct a browsing session or identify a user. The Speed Insights package loaded by this site does not read or write a cookie or localStorage. Seevercel.com/docs/speed-insights/privacy-policy.

The contact page does not embed a map. It links to a Google Maps search for the business name and Bolsover. Opening that link leaves this site. The search is the business name, not the sat-nav postcode. The same page also links to a what3words address for the farm. Following either link is a request to that other site.

Wedding enquiry, the wedding estimate, and the funeral enquiry embed a Dubsado form from hello.dubsado.com. What you type in that frame is sent to Dubsado, not through the contact form on this site. Enquiry answers are kept in Dubsado until we delete them. Enquiries that do not lead to a booking are cleared after 2 years.

Each page asks your browser to load typefaces from fonts.googleapis.com and fonts.gstatic.com. The footer links to the studio’s Instagram and Facebook profiles. Those sites have their own notices.

This website's own code uses localStorage for one flag, lhf_notrack. It is set only when someone opens the site with ?notrack added to the address (a link LHF staff use so that their own visits are not counted in our analytics), and opening the site with ?notrack=off removes it. It holds the value 1 and no personal information, and it is not used for tracking.

The shop basket is kept in sessionStorage, under the name lhf-shop-basket-v2. That holds the flowers, collection or delivery, the date, a collection time when you are collecting, notes, and any gift message. A second sessionStorage flag remembers that you just added something, so the basket can show that once. The browser keeps sessionStorage for the tab. It is not sent to the database until you pay.

An A La Carte estimate and the booking form are kept in sessionStorage underlhf.alc-book: the year, the menu lines, the date, the palette, preferences, your name, email, phone, an optional venue or fayre code, and whether you chose the deposit or the full amount. The success page clears that draft. Leaving Checkout before you pay leaves it in the tab so the form can be restored.

A first-touch note of how you arrived is kept in sessionStorage underlhf.lead: utm_source, utm_medium, the venue page, and a venue code when those were in the address. It is not written when lhf_notrack is set, and it is not written for an automated browser. It stays in the tab and is sent with an A La Carte booking. It is not a cookie.

Wholesale sign-in sets one cookie, lhf_wholesale. It is HttpOnly, sent only on HTTPS, SameSite Lax, and it lasts 14 days. It holds the florist’s id, name, business name, and email. It does not hold the access code. Signing out clears it.

Cloudflare Turnstile is strictly necessary to protect those forms from spam and bots, so it is exempt from consent under PECR. See Cloudflare’s Turnstile privacy information:https://www.cloudflare.com/turnstile-privacy-policy/

Under UK GDPR you can ask for access to the personal information we hold about you, and for rectification, erasure, restriction, objection, and portability. You can also complain to the Information Commissioner’s Office (ICO). The ICO’s site isico.org.uk.

To ask, emailcontact@laurennehopkinsflowers.co.uk. UK GDPR expects a response without undue delay and within one month. This website does not contain its own request form.

Orders, workshop bookings, A La Carte deposits and payments, wholesale orders, pay-page payments, and the emails about them, are kept for 6 years from the 31 March after the transaction. The financial year ends on 31 March. A pay-page payment is not written into the orders table. Stripe keeps that payment under its own legal duties. Any email we keep about it is kept for 6 years from the 31 March after the payment.

Dietary and allergy notes are deleted within 30 days after the workshop. This website has no scheduled job that deletes them. Until one is added, staff delete the note by hand within those 30 days. The record that consent was given, and the time it was given, stay on the booking after the note text is gone.

Enquiries that do not lead to a booking are cleared after 2 years. That covers the contact form and Dubsado enquiries. Enquiry answers stay in Dubsado until we delete them. The contact form is an email, not a database row. Resend’s own copy follows the 30 days above.

The client list is kept for 6 years from the 31 March after the last purchase or booking.

Apart from deleting a dietary note by hand, this website does not yet run a job that removes rows or emails when a period ends.

The wholesale sign-in cookie lasts 14 days, or until you sign out. The wholesale sign-in link expires after 20 minutes. The shop basket and the A La Carte draft stay in the browser tab, and the draft is removed on the booking success page.