Privacy policy
Last updated: 5 September 2026
Who we are
Buff & Bloom is operated by Lambert & Barclay Limited, the controller responsible for our use of your personal information. This policy covers our website, purchases, customer support and marketing. Contact us at hello@buffandbloom.co or write to Lambert & Barclay Limited, 2 Tower House, Hoddesdon, Herts, EN11 8UR, United Kingdom.
Information we collect
We collect information you provide when you order, contact us, subscribe or submit a review: your name, email, delivery and billing addresses, telephone number where provided, order details, preferences and the content of your communications or reviews. Checkout providers process payment details and provide us with payment status and transaction information. Please do not send card details by email.
Our store and its service providers also receive device and browser information, IP address, cookie identifiers and information about visits, purchases and interactions. Information can come directly from you, automatically through our website, or from payment, delivery, review and platform providers supporting your transaction.
Why we use information
- To take and fulfil orders, process payment, deliver goods and manage returns: to perform our contract with you or take steps you request before purchase.
- To answer enquiries, administer the store, maintain security, prevent fraud and improve our services: our legitimate interests in running a reliable business, subject to your rights; order-related support also supports our contract.
- To maintain required financial records and respond to lawful requests: compliance with legal obligations.
- To send marketing where you have consented, or where applicable law permits it with an opt-out. You can unsubscribe using the link in a marketing message or email us. Buying from us does not require marketing consent.
- To use optional cookies and advertising technologies where consent is required: your consent. You may withdraw it through the available privacy controls.
We need contact, delivery and payment information to complete an order. Without it, we may be unable to supply the goods. Marketing subscriptions and reviews are optional.
Who receives information
We share relevant information with providers needed to operate the store: Shopify for hosting, checkout, analytics and messaging; payment providers including Shopify Payments and PayPal when used; delivery providers for fulfilment and returns; and Judge.me for product reviews and related review services. A review you submit for publication can be visible to other shoppers with the display information associated with it, so avoid including private information in review text.
Authorised store administration and migration tools, including the Shopify ChatGPT integration and Duplify, may access information within their granted permissions when used to help us manage the store. We may also disclose information to professional advisers or authorities where necessary for legal obligations, disputes or protecting rights. We do not claim that your information stays solely within our company.
Shopify and personalised services
Our store is hosted by Shopify. Shopify processes information about visits and purchases and, through Shopify Network Intelligence, combines information from interactions with our store, other merchants and Shopify to provide enhanced services such as security, personalisation and advertising. Shopify can act as a controller for these enhanced services. Information may be shared with Shopify and relevant third parties in other countries for these purposes.
Read Shopify's Consumer Privacy Policy for its processing and use the Shopify privacy portal to exercise rights directly with Shopify.
Cookies and advertising choices
Essential cookies support functions such as the cart, checkout, security and remembering privacy choices. Other cookies and similar technologies can support analytics, reviews, personalisation and advertising. Our UK cookie banner allows choices about optional technologies. Use the banner and available cookie preferences to manage consent. Browser settings can also remove or block cookies, although blocking essential cookies can affect checkout.
You can object to direct marketing at any time. Where applicable, you can opt out of the sale or sharing of information for targeted advertising through our data-sharing opt-out page, or contact us by email. Some Shopify enhanced advertising services may count as sharing or targeted advertising under US state laws. Shopify's integrated privacy tools also recognise applicable Global Privacy Control signals. Choices made in one browser or device may need to be repeated on others.
International processing
Shopify and other providers operate internationally, so information may be processed outside the UK, including in Canada and the United States. Where UK transfer rules apply, transfers must use an applicable adequacy decision or appropriate safeguards, such as approved contractual clauses and the UK addendum where required. Shopify describes its arrangements in its Data Processing Addendum. Contact us for information about safeguards relevant to our processing and how to obtain a copy.
How long information is kept
Retention depends on the purpose and applicable obligations. Order and payment records are kept for the periods needed for accounting and tax obligations, returns, warranties and potential legal claims. Support correspondence is kept while resolving the enquiry and any related dispute. Marketing contact information is kept while the subscription remains active; a limited suppression record may be retained after an opt-out so we do not contact you again. Reviews are retained while relevant to the product and review service, subject to applicable deletion rights. Security records and cookie information are retained according to their security purpose and the relevant technology's lifespan. We assess retention against these criteria rather than keeping information indefinitely without a purpose.
Your rights and requests
Depending on your location and the applicable law, you may request access, correction, deletion, restriction or a portable copy of your information, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. These rights have conditions and exceptions, for example when records must be retained by law.
Email hello@buffandbloom.co to make a request or appeal our response where an appeal right applies. We may ask for information needed to verify your identity or an authorised representative's authority. Requests are normally free; any exception will only apply where permitted by law. We respond within the applicable legal time limit. Exercising privacy rights will not result in unlawful discrimination.
If a payment or fraud-screening decision affects your order, contact us to request an explanation and review. Payment providers may have their own decision processes and privacy notices.
You may complain to the UK Information Commissioner's Office, or your local privacy regulator. You do not have to contact us first.
Security, other websites and updates
We use reasonable safeguards and limit access to information for business purposes, but no internet transmission or storage system is completely secure. External websites and payment services have their own privacy notices. We may update this policy when our services or requirements change; the date above identifies the latest version.