Privacy policy

We collect what we need to make and deliver your bouquet, and nothing else. We do not sell your details to anyone, ever. Your card number never touches our servers. If you want your data deleted, email us and it will be.

• To fulfil an order: your name, email address, phone number, the delivery address and any delivery notes or gift message you write.
• If you create an account: the above, plus a securely hashed version of your password and any addresses you choose to save. We never store your actual password.
• Payment: the last four digits and brand of your card, and the Square payment reference. The full card number, expiry and CVV go directly from your browser to Square and are never seen by this website.
• If you contact us: whatever you write in the message form.
• Newsletter: just your email address, if you ask for it.

Only the people needed to complete your order: Square (payment processing — see Square’s own privacy policy), our email provider (to send your receipt), and our hosting provider (to run the site).

We do not sell, rent or trade your personal information to anyone for any purpose.

We use one essential cookie to keep you signed in. It contains a random session identifier and nothing else. We do not run advertising or cross-site tracking cookies.

Your cart is stored in your own browser’s local storage, not on our servers, and is cleared when you complete an order.

Order records are kept for seven years, because Australian tax law requires it. Account details are kept until you ask us to delete them. Newsletter subscriptions are kept until you unsubscribe. Contact messages are kept for two years.

Under the Australian Privacy Act you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email sharon@immaculatebouquets.com.au and we will action it within 30 days. Deleting your account does not delete the order records we are legally required to retain, but it does remove your saved addresses and sign-in details.

The site is served over HTTPS. Passwords are hashed with bcrypt. Session tokens are stored as one-way hashes, so even a database breach would not hand anyone a working login. Payment card data is handled entirely by Square, which is PCI-DSS Level 1 compliant.

This site is not directed at children and we do not knowingly collect information from anyone under 16.

Email sharon@immaculatebouquets.com.au. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.