Privacy Policy
Thula & Bloom
Last updated: 23 October 2026
1. Introduction
At Thula & Bloom, we value your privacy and are committed to protecting your personal information.
We believe that shopping for natural skincare, wellbeing products and thoughtful gifts should be a simple, enjoyable and secure experience.
This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, purchase our products, subscribe to our communications or contact us.
Thula & Bloom is an independent business based in Kent, United Kingdom.
For the purposes of UK data protection legislation, Thula & Bloom is the data controller responsible for the personal information we collect.
2. Information We Collect
When you interact with Thula & Bloom, we may collect the following information:
Personal details: Your name, email address, telephone number, billing address and delivery address.
Order information: Details of products purchased, order history, payment status and delivery information.
Payment information: Payments are processed through secure third-party payment providers. We do not directly store your complete credit or debit card details.
Communications: Information you provide when contacting us, submitting an enquiry or requesting customer support.
Marketing preferences: Your preferences regarding newsletters, product launches, special offers and promotional communications.
Website information: Technical information such as your IP address, browser type, device information and website usage, collected through cookies and similar technologies where applicable.
We only collect information that is reasonably necessary for our business activities.
3. How We Use Your Information
We use your personal information to:
Process, fulfil and deliver your orders.
Communicate with you about purchases, deliveries, returns and enquiries.
Provide customer service and respond to requests.
Maintain accurate business, accounting and transaction records.
Improve our website, products and shopping experience.
Send occasional newsletters, product announcements and special offers where permitted.
Protect our business and customers against fraud or misuse.
Comply with our legal and regulatory obligations.
We do not sell your personal information to third parties.
4. Our Legal Basis for Processing Information
Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases for processing personal information:
Contractual necessity: To process purchases, arrange deliveries and fulfil our obligations to customers.
Legal obligations: To maintain records required for accounting, tax and other applicable legal requirements.
Legitimate interests: To operate and improve our business, provide customer support, maintain website security and manage customer relationships, where these interests do not override your rights.
Consent: Where required, to send marketing communications or use optional cookies and tracking technologies.
You may withdraw your consent at any time.
5. Online Payments and Website Security
Our website is hosted by Squarespace, which provides our online shopping platform and website infrastructure.
Payments are handled through secure payment processing services available through our online shop.
We do not directly collect or store complete payment card information.
We take reasonable steps to protect the personal information entrusted to us against unauthorised access, misuse, loss or disclosure.
However, no method of electronic transmission or storage can be guaranteed to be completely secure.
6. Sharing Your Information
We only share personal information where necessary to operate our business, fulfil orders or comply with the law.
This may include:
Squarespace: Our website hosting and e-commerce platform.
Payment providers: To securely process transactions and refunds.
Delivery services: To arrange shipment and delivery of purchased products.
Email service providers: To send order confirmations and permitted marketing communications.
Professional advisers or authorities: Where necessary for accounting, taxation, legal or regulatory purposes.
We only share information relevant to the services being provided, subject to applicable data protection requirements.
We do not sell or rent customer mailing lists or personal information.
7. Marketing Communications
From time to time, we may share news about Thula & Bloom, including new product launches, seasonal collections, special offers and events.
We will only send electronic marketing communications where you have provided consent or where we are otherwise permitted to do so under applicable UK marketing laws.
You can unsubscribe from marketing emails at any time using the unsubscribe link provided or by contacting us directly.
Unsubscribing will not prevent you from receiving essential communications relating to your orders.
8. Cookies and Website Analytics
Our Squarespace website uses cookies and similar technologies to help it operate, support shopping functionality and understand how visitors interact with our website.
These may include:
Essential cookies: Necessary for basic website functions, security and online checkout.
Analytics cookies: Help us understand website traffic and improve the browsing experience.
Third-party cookies: May be used by payment providers or other website services and integrations.
Where required by law, we request your consent before using non-essential cookies.
You can manage your preferences through our website's cookie controls, where available, or through your browser settings.
For further information about how Squarespace handles personal information, please refer to its privacy policy.
9. How Long We Keep Your Information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.
Order and transaction records are retained for the periods required by applicable accounting and tax laws, generally up to six years or longer where legally necessary.
Customer correspondence is retained for as long as necessary to resolve enquiries, manage customer relationships or address potential disputes.
Marketing information is retained until you unsubscribe, withdraw consent or it is no longer required for the relevant purpose.
Where appropriate, information will be securely deleted or anonymised when no longer needed.
10. International Data Transfers
Thula & Bloom does not directly transfer customer personal information overseas.
However, our website is hosted by Squarespace, and certain services used to operate our online shop may process or store information outside the United Kingdom.
Where international processing occurs, we rely on our service providers to maintain appropriate data protection safeguards in accordance with applicable UK data protection laws.
11. Your Data Protection Rights
Under UK data protection legislation, you may have the right to:
Request access to the personal information we hold about you.
Ask us to correct inaccurate or incomplete information.
Request deletion of your information, where applicable.
Request restrictions on how your information is processed.
Object to certain types of processing.
Withdraw consent where processing is based on consent.
Request the transfer of your information where the right to data portability applies.
These rights may be subject to certain legal exceptions.
To exercise your rights, please contact us using the details below.
We aim to respond to valid data protection requests within one calendar month, in accordance with applicable law.
12. Children's Privacy
Our website and online shopping services are intended for adults.
Although we offer products suitable for babies and children, purchases should be made by a parent, guardian or other responsible adult.
We do not knowingly collect personal information directly from children for marketing purposes.
13. Changes to This Privacy Policy
We may update this Privacy Policy periodic