Privacy Policy

Last updated: 20 September 2026

This Privacy Policy explains how The SoArt Limited (“The SoArt”, “we”, “us” or “our”) collects, uses, stores and shares personal information when you visit thesoart.co.uk, place an order, contact us, subscribe to marketing communications, or otherwise interact with us.

We are committed to protecting your privacy and handling your personal information fairly, transparently and securely in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

1. Who We Are

The data controller responsible for your personal information is:

The SoArt Limited
Company number: 16682050
Registered office: 2 Laurel Bank, Finchley Park, London, England, N12 9JP
Website: thesoart.co.uk
Email: hello@thesoart.co.uk
Telephone: +44 7511 005858

If you have any questions about this Privacy Policy or how we use your personal information, please contact us using the details above.

2. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information.

Identity and Contact Information

This may include:

• your name;

• billing address;

• delivery address;

• email address;

• telephone number; and

• account or customer profile information, where applicable.

Order and Delivery Information

When you place an order, we may collect information relating to:

• products ordered;

• personalised wording or customisation requests;

• delivery instructions;

• requested delivery date and time;

• order history;

• returns, refunds or complaints; and

• communications relating to your order.

Gift Recipient Information

Many of our products are purchased as gifts.

If you place an order for another person, you may provide us with the recipient's:

• name;

• delivery address;

• telephone number;

• delivery instructions; and

• gift message.

In these circumstances, we receive the recipient's personal information from the person placing the order rather than directly from the recipient.

We use this information only as reasonably necessary to prepare, manage and deliver the order and deal with any related delivery or customer service issues.

Please avoid including sensitive or unnecessary personal information in gift messages or delivery instructions.

Payment and Transaction Information

Payments are processed through Shopify and/or our authorised payment service providers.

The SoArt does not directly store complete payment card numbers, security codes or full card details.

We may receive limited payment and transaction information such as:

• payment status;

• payment method;

• transaction reference;

• billing information; and

• limited card information, such as the last four digits, where made available by our payment provider.

Communications

We may collect information that you provide when you:

• email us;

• contact us by telephone;

• use a website contact form;

• communicate with us through social media or messaging services;

• request information;

• make a complaint; or

• exercise your data protection rights.

Technical and Usage Information

When you use our website, we and our service providers may collect information such as:

• IP address;

• browser type;

• device type;

• operating system;

• pages visited;

• website interactions;

• referring website;

• approximate location derived from technical information; and

• cookie or similar technology identifiers.

Some of this information is collected through cookies and similar technologies.

Marketing Preferences

We may record:

• whether you have agreed to receive marketing;

• your communication preferences;

• when and how consent was provided, where applicable; and

• whether you have unsubscribed or objected to marketing.

3. Where We Obtain Your Information

We generally obtain personal information:

• directly from you when you place an order, contact us or use our website;

• from another customer where they provide your details as the recipient of a gift or delivery;

• automatically through our website and cookies or similar technologies;

• from Shopify and our payment providers in connection with transactions;

• from delivery or courier providers in connection with an order; and

• from other service providers we use to operate our business.

4. How and Why We Use Your Personal Information

UK data protection law requires us to have a lawful basis for using personal information.

The lawful basis depends on why we are using the information.

Processing and Fulfilling Orders

We use personal information to:

• process orders;

• take and confirm payment;

• prepare products;

• provide personalised products;

• arrange delivery;

• send order and delivery updates;

• process cancellations, refunds or replacements; and

• provide customer service.

Where you are the customer, our lawful basis is generally performance of a contract with you or taking steps at your request before entering into a contract.

Delivering Gifts to Other Recipients

Where a customer provides another person's details so that we can deliver flowers, balloons or another product to them, we generally rely on our legitimate interests in fulfilling the customer's order and providing our delivery service.

We limit the recipient information we use to what is reasonably necessary for these purposes.

Customer Service and Communications

We may use your information to:

• respond to enquiries;

• resolve delivery issues;

• manage complaints;

• investigate problems;

• provide after-sales assistance; and

• keep appropriate records of our communications.

Depending on the circumstances, we rely on performance of a contract, legitimate interests, or legal obligations.

Our legitimate interests include providing effective customer service, resolving disputes and protecting our business.

Accounting, Tax and Legal Compliance

We may use and retain transaction and customer information where necessary to:

• maintain business and accounting records;

• comply with tax requirements;

• comply with legal or regulatory obligations;

• respond to lawful requests; and

• establish, exercise or defend legal claims.

Our lawful bases are legal obligation and, where applicable, our legitimate interests in protecting our legal rights.

Fraud Prevention, Security and Business Protection

We may process information to:

• prevent or detect fraud;

• protect our website and systems;

• investigate suspicious transactions;

• protect our customers;

• enforce our Terms and Conditions; and

• establish or defend legal claims.

We generally rely on our legitimate interests in protecting our customers, our business, our website and our legal rights.

Payment providers and Shopify may also carry out their own fraud and security checks.

Improving Our Website and Services

We may analyse how customers use our website in order to:

• understand website performance;

• identify technical problems;

• improve website usability;

• understand which products or pages are useful to customers; and

• improve our products and services.

Where this involves non-essential cookies or similar technologies, we obtain consent where required.

For limited processing that does not require consent, we may rely on our legitimate interests in operating and improving our business.

5. Marketing Communications

We may send you information about our flowers, balloons, arrangements, events, offers or other products and services where permitted by law.

Where consent is required, we rely on your consent.

In some circumstances, UK electronic marketing rules allow us to contact existing customers about our own similar products or services under the “soft opt-in” rules. Where we rely on this exception, our data protection lawful basis is generally our legitimate interests in marketing our products to existing customers.

Where applicable, you will be given an opportunity to opt out when your details are collected and in every subsequent marketing communication.

You can unsubscribe from marketing at any time by:

• using the unsubscribe option contained in our marketing messages; or

• contacting us directly at hello@thesoart.co.uk.

Withdrawing consent or opting out of marketing does not affect service messages that are necessary in connection with an order.

We may retain limited information on a suppression list after you unsubscribe so that we can respect your preference and avoid contacting you again for marketing purposes.

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Some cookies are necessary for our website to function, for example to:

• keep the shopping basket working;

• process checkout;

• maintain security; and

• remember essential website settings.

Other cookies may be used for:

• analytics;

• website performance;

• personalisation; and

• advertising or marketing.

Where required by law, non-essential cookies and similar technologies are only used after you have provided the appropriate consent.

You can accept, reject or manage non-essential cookies using the cookie banner or cookie settings available on our website.

You can change your cookie preferences at any time.

7. Who We Share Personal Information With

We do not sell your personal information.

We may share personal information where reasonably necessary with trusted third parties that help us operate The SoArt, including:

Shopify

Our online store is hosted and supported by Shopify. Shopify processes information that is necessary to provide our ecommerce platform, checkout and related services.

Payment Providers

We share information with payment processors where necessary to process transactions, prevent fraud, issue refunds and manage payments.

Delivery and Courier Providers

We may provide delivery companies, couriers or drivers with information such as:

• recipient name;

• delivery address;

• telephone number; and

• delivery instructions.

We only provide information reasonably necessary to complete the delivery.

Technology and Service Providers

We may use service providers that assist us with:

• website hosting and ecommerce services;

• email;

• customer communications;

• analytics;

• website security;

• cloud storage;

• marketing; and

• other business operations.

Where appropriate, these providers process personal information on our behalf and are required to handle it securely and appropriately.

Professional Advisers

We may share information where reasonably necessary with our:

• accountants;

• insurers;

• legal advisers;

• financial advisers; and

• other professional advisers.

Government Authorities and Regulators

We may disclose information where required or permitted by law, including to:

• HM Revenue & Customs;

• courts;

• regulators;

• law enforcement authorities; and

• other public authorities.

Business Transfers

If all or part of The SoArt is sold, transferred, reorganised or merged with another business, personal information may be transferred as part of that transaction, subject to applicable data protection requirements.

8. International Transfers

Some of our service providers, including technology and ecommerce providers, may process or store personal information outside the United Kingdom.

Where a transfer of personal information outside the UK is subject to UK international data transfer rules, we take steps to ensure that an appropriate level of protection is in place.

Depending on the circumstances, this may include:

• transferring information to a country covered by UK adequacy regulations;

• using an approved international data transfer mechanism or contractual safeguards; or

• relying on another transfer mechanism permitted by UK data protection law.

You can contact us at hello@thesoart.co.uk if you would like more information about the safeguards relating to a particular transfer.

9. How Long We Keep Personal Information

We do not keep personal information for longer than reasonably necessary for the purpose for which it was collected, unless we are required or permitted to keep it for longer by law.

Orders, Transactions and Accounting Records

Order, invoice, payment, delivery and other records required for company accounting or tax purposes will generally be retained for six years from the end of the company financial year to which they relate, or longer where required by law.

Customer Service and Complaints

Customer service correspondence and complaint information is retained for as long as reasonably necessary to deal with the matter, maintain appropriate records and protect our legal rights.

It will be reviewed and deleted or anonymised when it is no longer required.

Marketing Information

Marketing information is retained while you remain subscribed or while we otherwise have a lawful reason to use it.

If you unsubscribe or object to marketing, we may retain limited information on a suppression list so that we can respect your preference.

Website and Cookie Information

Retention periods for cookie and analytics information depend on the particular cookie or technology used and the settings of the relevant service provider.

We periodically review the information we hold and delete or anonymise information when it is no longer required.

10. How We Protect Your Information

We take reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;

• accidental loss;

• misuse;

• alteration;

• disclosure; and

• destruction.

We also seek to limit access to personal information to people and service providers who reasonably need access to it.

However, no method of electronic transmission or storage can be guaranteed to be completely secure.

11. Automated Decision-Making

The SoArt does not currently make decisions about customers based solely on automated processing where those decisions produce legal or similarly significant effects.

Our ecommerce and payment providers may use automated systems for fraud prevention, transaction security or payment verification in accordance with their own privacy practices.

12. Your Data Protection Rights

Depending on the circumstances, UK data protection law gives you rights including:

Right of Access

You may request confirmation of whether we process your personal information and ask for a copy of the information we hold about you.

Right to Rectification

You may ask us to correct inaccurate or incomplete personal information.

Right to Erasure

In certain circumstances, you may ask us to delete your personal information.

This right does not apply where we are legally required or otherwise entitled to retain the information.

Right to Restrict Processing

In certain circumstances, you may ask us to restrict the way we use your personal information.

Right to Object

You may object to certain processing based on legitimate interests.

You also have the right to object to the use of your personal information for direct marketing at any time.

Right to Data Portability

In certain circumstances, you may ask to receive personal information that you provided to us in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation.

Right to Withdraw Consent

Where we rely on your consent, you can withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

You will not normally have to pay a fee to exercise your data protection rights.

We may need to request information to confirm your identity before responding to a request.

To exercise your rights, contact:

Email: hello@thesoart.co.uk

13. Data Protection Complaints

If you have concerns about how we have collected, used, stored, shared or otherwise handled your personal information, please contact us first so that we can investigate the matter.

You can make a data protection complaint using:

Email: hello@thesoart.co.uk
Telephone: +44 7511 005858
Post: The SoArt Limited, 2 Laurel Bank, Finchley Park, London, England, N12 9JP

We will handle data protection complaints fairly and without unnecessary delay. We may contact you for further information where necessary and will keep you appropriately informed while we investigate.

If you remain dissatisfied, you have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Further information about making a complaint is available from the Information Commissioner's Office.

14. Third-Party Websites

Our website may contain links to websites, social media platforms or services operated by third parties.

We are not responsible for the privacy practices of those third parties. We recommend reviewing their privacy information before providing personal information to them.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our business;

• changes to our website or services;

• changes to the service providers we use; or

• changes to legal or regulatory requirements.

When we make material changes, we will update the “Last updated” date at the top of this Privacy Policy.

We encourage you to review this Privacy Policy periodically.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise a data protection right, or want to make a data protection complaint, please contact:

The SoArt Limited
Company number: 16682050
2 Laurel Bank
Finchley Park
London
England
N12 9JP

Email: hello@thesoart.co.uk
Telephone: +44 7511 005858