This privacy policy sets out how we use and protect any information that you provide us when you use our website, order from us, correspond with us, work with us, apply to work or train with us, or otherwise use our services. It also tells you about your privacy rights and how the law protects you.

If you have any queries about this policy or how we use your personal information, please contact us at hello@sageflowers.co.uk.

1. About us
This website is operated by SAGEFLOWERS Limited, a company registered in England and Wales (company number 11353201). Our registered office is Unit A, St Andrews Court, Wellington Street, Thame, Oxfordshire, OX9 3WT.

We are the data controller of the personal information you provide to us, and we process it in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

2. What personal data do we collect?
We collect different information depending on how you use our services and how you interact with us. The personal data we may collect includes:

Identity and Contact Information: Including your name, email address, telephone number, and billing and shipping addresses.

Usage Data: Information about how you use our services (including your delivery instructions, order and shopping history, search criteria, preferences, website activity, and attendance at any of our events or workshops).

Technical Data: Such as the device you are using to access our website, your unique device ID, your internet protocol (IP) address, browser type and version, time zone and location, display settings, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.

Marketing and Communications Data: Including any communications we receive from you and your preferences in receiving notifications, marketing and other communications from us.

Transaction Information: We collect information relating to your payments and transactions via our website. This does not include your payment card details, which you provide directly to our payment processors. We do not collect or store payment card details.

Client and Business Contact Information: If you commission us for events, installations, corporate contracts or other projects, we collect business contact details (such as name, job title, organisation, email and phone number), details of your brief and venue, and records of our communications and contracts.

Applicant, Intern and Freelancer Information: If you apply for a role, internship or training place (including through our FutureFlowers programme), or work with us as a freelancer, we collect the information you give us, such as your contact details, CV, experience, references, right-to-work information and any other details you choose to share.

Images and Recordings: We may take photographs or film at events, workshops and installations. We will tell you in advance where this is happening and give you the chance to opt out.

3. How do we collect personal data from you?

A. Personal data you provide to us:

We collect personal data from you when you place an order, register for a subscription, apply to work or train with us, commission us for a project, interact with us in any other way (such as via email, telephone, or social media), or provide a testimonial.

B. Personal data we collect as you use our services:

We collect your technical and usage data, as described above, as you use our services. Some of this data is collected using cookies, beacons and similar technologies (see section 13).

4. How and why we use your personal data.

We will only use your information where: 

A. We need the information to fulfil our contract with you.

If we have entered into a contract to provide you with our services (for example, if you have placed an order, signed up for a subscription, commissioned a project, or registered to attend one of our events), we will need your personal data in order to do so. The personal data that we use will depend on the service(s) we have agreed. For example:

• We will use your identity and contact details so that we can communicate with you about the services we provide, to facilitate providing any services you have requested, and to respond to any requests, queries, issues or concerns you may have.
• We will use your technical information to ensure that our services display and function correctly on your device.
• We (and our service providers) will need your payment information to facilitate any payments you authorise.

B. We have a legitimate interest (reasonable business purpose) in doing so.

We will use your information for our legitimate business reasons where doing so will not unduly affect your rights. We will use your identity, contact, usage and marketing information to keep our records up to date. We will use your usage and technical information to:

• Provide and make improvements to our services, system maintenance, support, reporting, and hosting of data, and troubleshooting;
• Optimise the performance of our website;
• Ensure that our services are secure;
• Analyse how users interact with our services; and
• Develop new products and services.

We may also use any or all of the information above to administer and manage our business in general, to maintain relationships with clients and suppliers, to detect and prevent misuse of our services, and to enforce our Terms and Conditions or any other contract to which we may be a party. If you feel that your interests and fundamental rights outweigh our business purposes, and that we should therefore stop processing your data, you have the right to object (see section 11).

C. You have given us your consent.

If you sign up to our mailing lists, we will send you updates and marketing information that you have consented to receive. You may opt out of receiving any or all of these communications at any time by following the unsubscribe link in any email we send, or by emailing us at hello@sageflowers.co.uk. We may also contact you for market research purposes if you have consented to us doing so.

If you have accepted non-essential cookies on our website, we will use this information for marketing and analytics purposes and to personalise your experience of our website. You can change your cookie choices at any time (see section 13).

D. We need to comply with a legal or regulatory obligation.

In certain circumstances, we may need to retain or use your personal data to comply with regulations and/or the law, for example tax and accounting records.

E. Recruitment and training.

If you apply for a role, internship or training place, we use your information to assess your application, communicate with you, and, if you are successful, to enter into an agreement with you. Our lawful bases are taking steps at your request before entering into a contract, and our legitimate interest in recruiting suitably qualified people.

Where we ask for equal opportunities information (such as ethnic origin) to monitor and support our commitment to diversity, this is optional, is collected on the basis of your explicit consent, and is used only for that purpose. You can withdraw your consent at any time by emailing us.

5. Children

Our Services are not intended to be used by children under the age of 18 years, and we do not knowingly collect children's personal data.

6. How do we share your personal information?

We will share your data:

A. With our trusted third-party service providers.

These include:

• Our approved delivery drivers and couriers, as necessary to fulfil any orders you may have placed.
• Our information technology providers, including our website host Shopify and our mailing list provider Mailchimp.
• Our venue, co-host or client (as applicable), if you wish to attend one of our events and we need to share your identity information for admissions purposes.
• Analysts, consultants, accountants, insurers and other professional advisors whom we retain for advice in respect of our business operations.
• If you have accepted analytics cookies, Google Analytics.
• Our payment processor, Stripe, to which you provide your payment information directly. For information about how they use your personal data, please see the Stripe Privacy Policy.

We only share personal data with service providers that act on our instructions or have their own legal obligations, and we require them to keep it secure.

B. If you choose to share it via social media.

If you choose to interact with us on a public forum, such as social media, our communications may be visible to other users of the platform.

C. If the law requires us to.

We may disclose personal data if required to do so by law, a court or a regulator, or to protect our rights, property or safety.

We do not sell your personal data.

7. International transfers

Our website is hosted by Shopify on servers located in The UK. Some of our service providers, including Stripe, Google (Analytics) and Mailchimp, may process personal data outside the UK, including in the United States. Where this happens, we make sure a lawful transfer mechanism is in place, so that your data remains protected to UK standards.

8. How do we keep your information secure?

We are committed to ensuring that your information is secure in order to prevent unauthorised access or disclosure, and we have put in place appropriate physical, electronic and managerial procedures to safeguard and secure your information. If we become aware of a personal data breach that is likely to put your rights at risk, we will tell you and the ICO as the law requires. However, no transmission of information via the internet or electronic storage is ever completely secure. Although we take appropriate measures to safeguard against unauthorised disclosures of information, we cannot guarantee the security of your data.

9. How long we keep personal data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes through other means, and the applicable legal requirements.

Our usual retention periods are:

• Order, invoice and accounting records: 6 years after the end of the financial year.
• Client and project records: 6 years
• General enquiries: 24 months from our last contact.
• Mailing list subscriptions: until you unsubscribe.
• Unsuccessful job and internship applications: 6 months
• Photographs and recordings: until mutually decided.

When data is no longer needed, we delete or anonymise it.

10. Third-party links

You have the right to:

• Request access to the personal data that we hold about you;
• Require us to rectify the personal data we hold about you, where that data is incorrect or incomplete;
• Require that, in certain circumstances, we delete the personal information we hold about you;
• Require that we restrict the processing of your personal information in certain circumstances;
• Require that we provide you with the information that we hold about you in a structured, commonly used and machine-readable format;
• Object to our processing of your personal data where we rely on our legitimate interests, and object to direct marketing at any time; and
• Withdraw your consent at any time where we rely on your consent, including consent to marketing emails and non-essential cookies. Withdrawing consent does not affect the lawfulness of processing before you withdrew it.

You will not usually have to pay a fee to exercise these rights. We will respond within one month of receiving your request, and we may extend this by up to two further months for complex requests, in which case we will tell you. We may need to ask you for information to confirm your identity.

If you wish to exercise any of these rights, please contact us at hello@sageflowers.co.uk.

Complaints: If you are unhappy with how we have handled your personal data, please contact us at hello@sageflowers.co.uk. We will acknowledge your complaint within 30 days, investigate it, and respond without undue delay. If you are still not satisfied, you have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection issues (www.ico.org.uk).

11. Your rights

You have the right to:

Require us to rectify the personal data we hold about you, where that data is incorrect; 

Require that we restrict the processing of your personal information in certain circumstances;

Request access to the personal data that we hold about you;

Require that, in certain circumstances, we delete the personal information we hold about you;

Require that we provide you with the information that we hold about you in a structured, commonly used, and machine-readable format; and/or

Withdraw your consent to our using your data for marketing purposes at any time.

You also have the right to lodge a complaint with the Information Commissioner’s Office, which is the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, be grateful if you would contact us in the first instance so we can endeavour to deal with your concerns directly. If you wish to exercise any of these rights, please contact us at hello@sageflowers.co.uk.

12. Changes to this policy or your data

We may amend or modify this privacy notice from time to time. We will post any revised version on this page and update the date below. Where changes are significant, we will take reasonable steps to let you know, for example by email if you are on our mailing list.

13. Cookies

Cookies are small text files placed on your device when you visit a website. We use them to make our website work, to understand how it is used, and, if you agree, to personalise your experience and support our marketing.

We use the following types of cookies:

• Strictly necessary cookies keep the website working, for example remembering your basket and security settings. We do not need your consent for these.
• Analytics cookies (Google Analytics) show us which pages are used, so we can improve the website. We only set these if you consent.
• Marketing and personalisation cookies. We only set these if you consent.

We will only set non-essential cookies if you accept them. You can change or withdraw your choice at any time by changing the settings in your browser. Most browsers let you block or delete cookies, but parts of our website may not work properly if you do.

A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

Last updated: 14 October 2026