What is collected, and why.

Flora & Flame Ritual is a sole trader based in Pontefract, West Yorkshire, United Kingdom. For the purposes of UK GDPR and the Data Protection Act 2018, the studio is the data controller for everything described on this page. There is one person handling it, and that person is the one who makes the products.

If you want to ask about, correct or delete anything held about you, email info@floraandflameritual.com or ring 07479 646488. The studio postal address is available on request; it is not published here because it is a private residence.

Nothing is collected simply by reading this website. There is no analytics package, no advertising pixel, no session recording and no tracking cookie, which is why you have not been asked to accept anything. Data reaches the studio only when you deliberately send it.

When you place an order

Your name, email address, delivery address, billing address, phone number, what you bought, what you paid and any gift note you wrote. Card details are entered on Stripe's own checkout and are never seen by, or transmitted to, this website.

When you use the contact form

Your name, email address, an optional phone number, the subject you chose and your message.

When you join the studio list

Your email address only, plus the date you joined so consent can be evidenced.

When you join a waitlist for a sold-out product

Your email address and which product you asked about.

Held in your own browser

Your basket is stored in your browser's local storage on your own device. It never reaches the studio until you go through checkout, and clearing your browser data deletes it.

To make and send your order — contract

Processing your order, packing it, posting it, emailing you a confirmation, an invoice and a tracking number, and handling any return or refund. Without this information the order cannot be fulfilled.

To reply to you — legitimate interests

Answering an enquiry you sent. You contacted a shop with a question; replying is the obvious expectation on both sides.

To send the studio list — consent

Only if you asked for it, by ticking the box at checkout or entering your address on the offers page. You can withdraw at any time and every email carries a one-click unsubscribe.

To keep accounts — legal obligation

HMRC requires records of sales to be kept. This is why order records outlive a deletion request, as explained below.

To prevent spam — legitimate interests

The forms carry a hidden field that automated submissions fill in and people never see, and a short-term rate limit keyed to your IP address. Neither is used to profile you and neither is stored beyond the request.

Your data is never sold, rented, or shared for anyone else's marketing. It is not passed to an advertising platform, a data broker or a social network. The only third parties involved are the ones needed to take a payment, send an email and post a parcel:

Stripe

Payment processing, invoicing and refunds. Stripe receives your name, email, billing and delivery address, phone number and card details, and is the only party that ever holds the card details. Stripe is PCI-DSS Level 1 certified and acts as an independent controller for its own compliance purposes.

Resend, or the studio's email provider

Delivery of transactional email — order confirmations, tracking, replies and the studio list. They receive your email address and the contents of the message sent to you.

Royal Mail

Your name and delivery address, printed on the label, so the parcel can reach you.

Vercel

Website hosting. Server logs may briefly record IP addresses as a normal part of serving a page and protecting against abuse.

Some of these providers operate outside the UK. Where data is transferred internationally it is covered by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision — whichever applies to that provider.

• Order records, including invoices: six years after the end of the relevant tax year, because HMRC requires it.
• Contact form enquiries: two years, then deleted. Long enough to recognise a returning customer and to handle any dispute about an order.
• Studio list subscriptions: until you unsubscribe, plus a note of the unsubscribe itself so you are not added again by accident.
• Waitlist signups: until the product comes back and you have been told, then deleted.
• Your basket, in your own browser: until you clear it, complete an order, or clear your browser data.

Under UK GDPR you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, object to it being used, ask for its use to be restricted, or ask for it in a portable format. You can also withdraw consent to marketing at any time.

Email info@floraandflameritual.com and you will get a reply within one working day and a full response within a month, at no charge. There is one exception to deletion: records of a completed sale must be kept for six years for tax purposes, so those cannot be erased on request — though they will not be used for anything else in the meantime.

If you are not satisfied with how a request has been handled, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. Raising it with the studio first is usually faster.

This website sets no tracking or advertising cookies, which is why there is no consent banner. Your basket is kept in your browser's own local storage on your device — technically necessary for a shop to work at all, and never transmitted anywhere until you check out.

When you go to pay, Stripe's hosted checkout sets its own cookies necessary for processing the payment and preventing fraud. That happens on Stripe's domain under Stripe's own privacy policy, not this one.

Nothing here is aimed at children and the studio does not knowingly collect data from anyone under 16. If you believe a child has sent information to the studio, email and it will be deleted.

This policy was last updated on 26 August 2026. If it changes materially — a new provider, a new purpose — the date here changes and anyone on the studio list is told in the next email rather than left to notice.