Privacy Policy

This Privacy Policy explains how Whimsy Blooms (“we”, “us” or “our”) collects, uses, discloses and protects personal information through whimsyblooms.com (the “Site”) and the Orders placed on it. It applies to people who use the Site, place an Order or contact us (“you”), to Recipients whose information a sender gives us, and to people at Fulfillment Partners and other businesses that we contact or that contact us.

Capitalized terms not defined here have the meanings given in our Terms of Service.

Terms used in this policyCopy link

• “Order” means a request to buy Products placed through the Site, including each delivery made under a Subscription.
• “Products” means the flowers, plants, arrangements, containers, add-ons and other items offered on the Site.
• “Recipient” means the person to whom you ask us to deliver an Order. You may be the Recipient.
• “Fulfillment Partner” means a florist, florist network, grower, shipper, courier or other third party that prepares, ships or delivers Orders for us, including anyone it passes an Order to.
• “Subscription” means a plan under which we deliver Products and charge you on a recurring schedule.
• “Delivery Date” means the date you select for delivery at checkout or, for later Subscription deliveries, the date set by the Subscription schedule.

These definitions repeat those in the Terms of Service. If they differ, the Terms of Service definitions control.

Information you give usCopy link

• Your name, email address and phone number.
• The Recipient’s name, delivery address and phone number.
• Your card message, the occasion you choose, and the Products in your Order.
• The Delivery Date and the Recipient’s ZIP code.
• Messages you send us, including claims and any photographs you include with them.

Payment informationCopy link

You enter your card details on our payment processor’s checkout page. The payment processor collects and stores them. We do not receive or store your full card number. We receive the payment amount and status, and may receive limited details such as the card brand, the last four digits of the card and your billing address.

Cookies and information stored in your browserCopy link

Your cart is kept in your browser’s local storage on your own device. It holds the Products you choose, the Delivery Date, the Recipient’s ZIP code, the occasion and your card message. We receive it when you start checkout. It stays on your device until you clear it or complete an Order.

On your first visit, the Site also saves a first-visit note in local storage recording how you arrived: the path of the first page you opened, the domain name of the website that linked you to it, and any campaign labels in that page’s address (its utm_source, utm_medium, utm_campaign, utm_term and utm_content parameters). The note leaves out the rest of both addresses. We receive it with your cart when you start checkout, keep it with your Order records and use it to measure which pages, websites and campaigns lead to Orders. It stays on your device until you clear it. The Site replaces it on your first visit after it is 30 days old, and sooner when you arrive through a link with campaign labels while the note has none, such as a calendar reminder saved from a holiday page.

The Site also keeps working notes in your browser so that its pages agree as you move between them. Local storage holds a copy of the items in an Order whose payment the Site could not confirm. Session storage, which your browser clears when you close the tab, holds a ZIP code you entered that is outside the delivery area, the occasion you chose, add-ons you saved for your next bouquet or subscription, and whether you returned from the checkout page. These notes stay on your device and are not sent to us.

We do not use advertising or analytics cookies. Our hosting provider may set cookies that are strictly necessary for security and protection against automated abuse. The payment processor’s checkout page sets its own cookies, which its privacy policy governs.

Information collected automaticallyCopy link

When you visit the Site, our servers and hosting provider record technical information such as your IP address, browser and device type, the pages you request, the referring page, and the date and time. Our systems also log records of Order processing, which may include Order details. Site pages also load a measurement script from our hosting provider. It records information such as the page viewed, the referring page, the browser and device type, the country derived from your IP address and how quickly the page loaded and responded, and gives us aggregated statistics. It does not set cookies or use local storage. When you start checkout, we also receive the first-visit note described in Section 2 (Cookies and information stored in your browser).

Information from othersCopy link

Fulfillment Partners may tell us about the status of a delivery, including problems and proof of delivery. The payment processor tells us whether a payment succeeded and may flag possible fraud. If someone sends you an Order, we receive your information as a Recipient from the sender.

We collect the names and business contact details of florists, suppliers and other businesses, including from their public websites, to find and work with Fulfillment Partners and suppliers.

We use personal information to:

• process, prepare and deliver Orders, including printing your card message;
• charge Subscriptions and schedule their deliveries;
• send receipts, notices and replies to your messages;
• handle claims, cancellations and refunds;
• find, contact and work with Fulfillment Partners, suppliers and other businesses;
• manage our email and business records, including with software and artificial intelligence tools that read, sort, summarize, draft and send email;
• detect and prevent fraud and abuse and keep the Site secure;
• keep tax, accounting and business records and comply with the law;
• enforce our Terms and establish, exercise or defend legal claims;
• understand how the Site is used and which pages, websites and campaigns lead to Orders, and improve the Site and our marketing.

Card messages can reveal information about health, bereavement or relationships. We do not ask for that information. We use a card message only to include it with the Order, to handle questions and claims about that Order and to keep our Order records.

We disclose personal information to the following parties:

• Fulfillment Partners, who receive the Recipient’s name, address and phone number, the Delivery Date, the Products, the card message, and the sender’s name and contact details where needed to complete the delivery. A Fulfillment Partner that is a florist network may pass these details to the member florist or courier that completes the delivery. When you place an Order, you direct us to make this disclosure.
• Our payment processor, Stripe, which processes payments and Subscriptions, receives the information you enter on its checkout page and the Order details we send it, and screens payments for fraud. Its privacy policy is at stripe.com/privacy.
• Service providers that run parts of our business for us, such as providers of hosting, domain name, email, logging, analytics, file storage and software services. They include artificial intelligence providers whose tools read, sort, summarize, draft and send our business email, which may include Order details, and help us find and contact Fulfillment Partners.
• Our professional advisers, such as lawyers, accountants and insurers.
• Courts, regulators, tax authorities, law enforcement and others, when we believe disclosure is required by law or legal process, or is needed to protect the rights, property or safety of Whimsy Blooms, our customers or others, or to prevent fraud.
• A buyer, successor or other party in connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business or assets, including during negotiations.
• Anyone else, when you ask us to or agree that we may.

We may use and disclose information that has been aggregated or de-identified so that it no longer identifies anyone. We keep de-identified information in that form and do not attempt to re-identify it.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects, as those terms are defined in state privacy laws. We have not done any of these in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

When you give us a Recipient’s information, you represent that you have the right to give it to us and to let us use and disclose it as this Privacy Policy describes. We use a Recipient’s information only to deliver the Order, to handle questions and claims about it, to prevent fraud, to keep records, to comply with the law and to establish, exercise or defend legal claims.

A Recipient may contact us at hello@whimsyblooms.com with questions or to make a request, following the steps in Section 10 (How to make a request).

We keep personal information for as long as reasonably necessary for the purposes in this Privacy Policy. In general:

• Order and payment records are kept for tax, accounting, chargeback and legal purposes, generally for up to seven years after the Order.
• Messages and claims are kept until they are resolved and then for as long as we need them for our records.
• Server and security logs are kept for a limited period and then deleted.
• Business contact information is kept while we work with or consider working with that business and then for as long as we need it for our records.
• Your browser cart stays on your device until you clear it or complete an Order.

We may keep information longer when the law requires it or when we need it to resolve a dispute or enforce our agreements. Our payment processor and Fulfillment Partners keep the information they receive under their own retention policies.

We use reasonable administrative, technical and physical safeguards suited to the information we handle, including encrypted connections to the Site and limited access to Order data. No method of transmitting or storing information is completely secure, and we cannot guarantee the security of personal information. You are responsible for keeping your own email account and devices secure. If a security breach affects your personal information, we will give any notice of it that the law requires.

The Site is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 13, we will take the steps the law requires, which may include deleting it. You must be at least 18 to place an Order. If an adult sends an Order to a Recipient who is a minor, we use the Recipient’s information only as described in Section 6 (Information about Recipients).

Depending on where you live, and where a state privacy law applies to us, you may have the right to:

• know whether we process your personal information and access the categories and specific pieces of personal information we hold about you;
• correct inaccurate personal information;
• delete personal information we collected from or about you;
• receive a copy of your personal information in a portable format;
• opt out of the sale or sharing of personal information, targeted advertising and certain profiling, although we do not do any of these;
• not be discriminated against for exercising these rights.

These rights arise under laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act and similar laws in other states. Each law has its own conditions and exceptions, and we may deny a request where one applies, for example where we must keep information to comply with the law or complete an Order.

How to make a requestCopy link

1. Email us at hello@whimsyblooms.com with the subject line “Privacy request”.

   Email a privacy request

2. Tell us which right you want to exercise, the state where you live and the email address used for your Orders or, if you received an Order, the delivery address and the date it arrived. The email opens with these lines. Fill in each one:

   • Request (know, correct, delete, copy, restrict, object, withdraw consent or opt out):
   • State or country you live in:
   • Email used for your Orders, or the delivery address and date of an Order you received:

   Copy request text

3. To verify your identity, we will match the information you give us against our records, such as the email address used for your Orders and details of a recent Order or, if you received an Order, the delivery address and the date it arrived. We may ask for more information. We cannot act on a request we are unable to verify.
4. We will respond within the time the applicable law requires. Some laws allow us to extend that time.

An authorized agent may make a request for you. We will ask the agent for your signed permission, and we may ask you to verify your identity directly with us.

AppealsCopy link

If we decline your request, you may appeal by replying to our decision with the word “Appeal” in the subject line. We will respond to your appeal within the time your state’s law requires. If we deny your appeal, you may contact your state’s attorney general.

In the past 12 months we have collected the following categories of personal information, as the California Consumer Privacy Act defines them:

• identifiers, such as name, email address, phone number, postal address and IP address;
• customer records described in California Civil Code section 1798.80(e), such as name, address, phone number and limited payment information;
• commercial information, such as the Products ordered and Order history;
• internet or other electronic network activity, such as the pages requested and the technical information in our logs;
• audio, electronic, visual or similar information, such as photographs sent with a claim;
• professional information, such as the business contact details of florists and suppliers.

We collect these from you, from your device, from the sender of an Order (for Recipients), from our payment processor, from Fulfillment Partners and, for business contacts, from public websites. We use them for the purposes in Section 3 (How we use information) and disclose them for business purposes to the categories of parties in Section 4 (How we share information). We keep them for the periods in Section 7 (How long we keep information).

We do not collect sensitive personal information in order to infer characteristics about anyone. A card message may contain sensitive information that a sender chooses to include, and we use it only as described in Section 3 (How we use information). We do not offer financial incentives in exchange for personal information.

Under California Civil Code section 1798.83, California residents may ask about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

We treat a Global Privacy Control signal from your browser as a valid request to opt out of the sale and sharing of your personal information where state law requires us to. Because we do not sell or share personal information or engage in targeted advertising, the Site works the same with or without the signal.

There is no common industry standard for Do Not Track signals, and the Site does not respond to them. We do not track visitors across other websites, and we do not knowingly allow third parties to collect information about your activity on the Site for advertising.

This section applies where the EU General Data Protection Regulation (the “GDPR”) and Spanish data protection law apply to our processing of your personal information.

ControllerCopy link

The controller of your personal information is Whimsy Blooms, established in Spain. You can contact the controller at hello@whimsyblooms.com.

Legal basesCopy link

We process personal information on these legal bases:

• performance of a contract with you, to take, charge, prepare and deliver your Orders and Subscriptions, send receipts and notices, and handle your messages, claims, cancellations and refunds;
• our legitimate interests in operating and protecting our business and in completing the Orders that senders ask us to deliver. On this basis we deliver an Order to its Recipient; detect and prevent fraud and abuse and keep the Site secure; measure how the Site is used and which pages, websites and campaigns lead to Orders, and improve the Site and our marketing; find, contact and work with Fulfillment Partners, suppliers and other businesses; manage our email and records with the service providers described in Section 4 (How we share information); enforce our Terms and establish, exercise or defend legal claims; and carry out a sale or reorganization of our business;
• legal obligation, to keep tax and accounting records, answer lawful requests from authorities and comply with other laws that apply to us;
• consent, for any processing we ask you to agree to. You may withdraw your consent at any time. Withdrawal does not affect processing that took place before it.

Checkout asks for the information we need to accept and deliver an Order. If you do not provide it, we cannot accept the Order. We keep personal information for the periods in Section 7 (How long we keep information).

Your rights under the GDPRCopy link

Subject to the conditions and exceptions in the GDPR and Spanish law, you have the right to access your personal information, to correct it, to delete it, to restrict our processing of it and to receive it in a portable format. We may decline a request where an exception applies. To make a request, follow the steps in Section 10 (How to make a request).

You may object at any time, on grounds relating to your particular situation, to processing of your personal information that is based on our legitimate interests. You may also object at any time to its use for direct marketing.

You may lodge a complaint with a data protection supervisory authority, including the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at aepd.es.

Transfers outside the European Economic AreaCopy link

Some of our service providers, and our Fulfillment Partners, are in the United States or other countries outside the European Economic Area, so we transfer personal information to those countries. For these transfers we rely on adequacy decisions of the European Commission, including the decision for the EU-US Data Privacy Framework where the recipient participates in it, on standard contractual clauses approved by the European Commission, or on another basis the GDPR allows, such as a transfer necessary to perform an Order. To obtain a copy of the safeguards for a transfer, email us at hello@whimsyblooms.com.

The Site is intended for use in the United States. We are established in Spain, and we, our service providers and Fulfillment Partners process and store personal information in Spain, the United States and other countries whose privacy laws may differ from those where you live. Section 13 (Transfers outside the European Economic Area) describes the safeguards for transfers from Spain.

We may change this Privacy Policy by posting a new version on the Site with a new effective date. If a change materially affects how we use personal information we already hold, we will give notice by email or on the Site where the law requires.

Send privacy questions and requests to hello@whimsyblooms.com. For a request, follow the steps in Section 10 (How to make a request).

Email a privacy requestCopy request text