1. Data Controller Contact Details
Telephone: +44 2072744517
Email: pottedplants@bloomtierrack.com
Company: TONFIAND LIMITED
Address: 29a, 23 Wharf Street, London, England, SE8 3GG

2. Categories of Personal Data Collected
To facilitate our direct-to-consumer retail operations, we collect the following:

Identity Data: Full name and title.

Contact Data: Email address, telephone number, and residential/business delivery addresses.

Transaction Data: Details of products purchased, order reference numbers, and historical transaction records.

Technical Data: IP address, browser type, and operating system (collected automatically via secure cookies to ensure website functionality and fraud prevention).

Communication Data: Records of any correspondence initiated through our official support channels.

Note: We do not knowingly collect data from individuals under the age of 18.

3. Lawful Basis for Processing
We process personal data under the following legal frameworks:

Contractual Necessity: To process, fulfil, and dispatch your orders.

Legal Compliance: To adhere to UK tax, accounting, and consumer protection laws.

Legitimate Interests: To ensure the security of our platform and maintain professional business administration.

4. Secure Payment Processing & PCI Compliance
All financial transactions are processed through Stripe, Inc. via a secure, encrypted gateway.

Data Minimisation: Bloomtierrack does not store, view, or have access to your raw credit/debit card details.

Encryption: All payment information is transmitted directly to Stripe using Secure Socket Layer (SSL) or Transport Layer Security (TLS) encryption.

Compliance: Our payment framework is designed to meet the highest standards of PCI-DSS compliance, ensuring a risk-mitigated environment for all global transactions.

5. Internal Data Usage & Management
Personal data is utilised exclusively for:

Managing and dispatching physical inventory from our controlled warehousing facilities.

Issuing order confirmations, tracking details, and VAT invoices.

Resolving customer service enquiries through our internal support team.

Mitigating transaction risks and preventing fraudulent activity.

6. Controlled Data Sharing
We do not sell or lease personal data. To facilitate order fulfilment, data is shared strictly with:

Logistics Partners: Established couriers (e.g., Royal Mail, DHL, FedEx) for the sole purpose of physical delivery.

Professional Advisers: Auditors or legal consultants where required for statutory compliance.

Regulatory Bodies: Where disclosure is mandated by UK law or international tax regulations.

7. International Data Transfers
As an international retailer, we ensure that any data transferred outside the UK or the EEA (e.g., to our secure global servers) is protected by Standard Contractual Clauses (SCCs) or other legally recognised adequacy mechanisms to ensure a level of protection equivalent to UK law.

8. Data Retention & Security
Retention: Transactional records are retained for 6 years to comply with UK HM Revenue & Customs (HMRC) requirements.

Security: We implement robust administrative and technical security measures to prevent unauthorised access, accidental loss, or disclosure of your personal information.

9. Your Statutory Rights
Under the UK GDPR, you possess the following rights:

The right to Access your data.

The right to Rectify inaccuracies.

The right to Erasure (the “right to be forgotten”), subject to statutory retention requirements.

The right to Restrict or Object to specific processing activities.

To exercise these rights, please contact us at pottedplants@bloomtierrack.com.

10. Policy Governance
TONFIAND LIMITED reserves the right to amend this policy to reflect evolving regulatory standards. Any updates will be published immediately on this page.