Privacy policy

Last updated: 16 October 2026

Who we are and how to contact us

The Faux Flower Company is a trading name of Amaranthine Home Ltd, company number 11887154. We are the controller responsible for the personal information we use to run our store and business, except where a provider acts independently as explained below. This policy covers our website, orders, customer support and marketing.

For privacy questions, requests or complaints, email [email protected] or write to The Faux Flower Company, Unit 37, Lansdown Industrial Estate, Cheltenham, GL51 8PL, United Kingdom. You can also call 01242 352 059. Our customer service hours are Monday to Friday, 9am–4pm UK time, excluding bank holidays.

Information we collect

  • Information you give us: your name, contact details, billing and delivery addresses, account information, orders, returns, preferences and correspondence. If you send a gift, we receive the recipient details and message you provide. Please provide only information you are entitled to share.
  • Payments: payment providers process your payment details. We receive transaction information, payment status and limited payment identifiers needed to manage orders and refunds; we do not store your full card details.
  • Website use: device and browser information, IP address, approximate location, referral source, pages and products viewed, cart activity and interactions with our website or messages. Cookies, pixels and similar technologies can connect these interactions with an account or order, subject to applicable privacy choices and consent requirements.
  • Other sources: payment and delivery updates, fraud-risk signals, review submissions, and permitted information from our technology, analytics and advertising partners. Public reviews or social content you choose to share with us may contain your name, image and comments.

We need certain contact, payment and delivery information to fulfil an order. Without it we may be unable to accept payment, deliver goods or resolve an enquiry. Marketing consent is optional and is not a condition of purchase.

Why we use information and our lawful bases

  • Orders and customer service: to take payment, supply goods and gift vouchers, arrange delivery, manage accounts, returns and refunds, and answer purchase enquiries. This is necessary to perform our contract with you or take steps at your request before a contract.
  • Legal obligations: to keep required accounting and tax records, respond to lawful requests and meet applicable consumer and data-protection obligations.
  • Legitimate interests: to protect our business and customers against fraud, keep our services secure, handle complaints and legal claims, administer our business and improve customer service, where those interests are not overridden by your rights. We assess the necessity and impact of these uses. This does not replace consent where consent is legally required.
  • Marketing and optional tracking: to send marketing you have opted into, personalise relevant offers, measure advertising and use non-essential cookies or similar technologies where your consent is required. You can withdraw consent. Any reliance on a lawful exception for a particular communication or technology remains subject to its conditions and your applicable opt-out rights.

Who receives information

We give providers the information needed for their role in operating our business. Categories include ecommerce hosting and checkout; payment, financing and fraud prevention; couriers, shipping and fulfilment; customer support; email and text messaging; reviews; analytics, advertising and personalisation; and accounting, reporting, backups and technical support. Authorised staff and advisers may access information where needed for their work.

Our services include Shopify; payment options such as PayPal and Klarna where selected; shipping services including DHL, Parcel2Go and Zenstores; Gorgias for support; Klaviyo for communications; REVIEWS.io for reviews; Littledata and Google Analytics for measurement; Google, Meta and Microsoft advertising services; and Xero for accounting. Providers and features can change, and not every provider receives information from every visitor or order. Payment services, advertising platforms and review services may also use information as independent controllers under their own notices.

We may disclose relevant information where lawful, necessary and proportionate to meet a legal obligation, protect rights or deal with a justified legal claim. A complaint alone does not automatically entitle another person to your identity. A business reorganisation or transfer may involve information being shared subject to appropriate confidentiality and protection of your rights.

Shopify and connected services

Our store is hosted by Shopify. Shopify processes information about your access to and use of the store to provide and improve its services. Shopify Network Intelligence is enabled: information from your interactions with our store may be combined with information from your interactions with other merchants and Shopify services to provide enhanced services, including personalisation, advertising and fraud prevention. Shopify and its partners may process information in countries other than where you live.

For this processing, including where Shopify acts as a controller, read Shopify’s Consumer Privacy Policy. You can exercise applicable rights and manage Shopify’s use of your information, including relevant advertising and sharing opt-outs, through the Shopify Privacy Portal. You can also contact us about information we control.

Cookies, analytics and advertising

Essential technologies support functions such as the shopping cart, checkout, security and remembering privacy choices. Other technologies can remember preferences, measure visits and purchases, test website experiences, personalise content and measure or target advertising. These may include cookies, local storage, tracking pixels and events sent from our systems to service providers. Server-side measurement is also subject to applicable data-protection and consent requirements.

Our consent-management service is Pandectes. Where consent is required, you have the right to choose whether optional technologies are used and to withdraw that consent. Use the cookie preference controls when displayed. If you cannot access or change your preferences, contact [email protected] for help. Browser settings can restrict or delete cookies, but may affect store functions and do not by themselves stop every form of data processing.

Advertising partners can receive device identifiers, browsing and purchase events, and permitted customer identifiers to measure campaigns or match audiences. This can constitute “sharing” for targeted or cross-context behavioural advertising under some US privacy laws, even where no money is paid for the information. You may ask us to opt you out where applicable; Shopify’s separate choices are available through its Privacy Portal above. We do not sell customer lists for payment.

Cookies may last for a browsing session or persist for a set period. Lifetimes and providers vary with the feature and your choices. A cookie’s expiry is separate from the retention of information already collected. Provider privacy information is available from Google, Meta and Microsoft.

Klaviyo’s anonymous activity backfill is enabled. Subject to applicable consent requirements, this can store browsing events on your device for up to 14 days and associate them with your profile once you become identifiable, for example after a signup, a message-link visit or an eligible checkout interaction. Klaviyo’s __kla_id cookie can recognise an identified browser for up to two years, although browser restrictions can shorten that period. These device-storage periods do not determine how long a customer profile is retained. See Klaviyo’s backfill explanation and cookie information.

Inventory reviewed: 16 October 2026. The following groups explain the cookies and similar storage identified by our current site scan and review of the live store. Some are used only when you visit account pages, use Shop or checkout, interact with a feature, or arrive through an advertisement. They are not all placed on every visitor’s device. An asterisk (*) means that the rest of a name varies, for example by account, campaign or identifier.

First-party cookies are stored under our website or account domain, even when a service provider sets them. Third-party cookies and embedded storage use a provider’s domain. “Session” storage normally ends with the relevant browser session or tab; browser session restoration can extend it. Persistent local storage has no automatic browser expiry and can remain until the service removes or replaces it, you clear site data, or the browser clears it. Any shorter application expiry below describes when the service stops reusing the stored information, rather than guaranteeing immediate physical deletion.

Cookie periods below are the lifetimes reported in the current scan unless a provider’s documented maximum is stated. Browsers can shorten them, and repeat use can refresh them. Rounded scan figures such as “one year” are approximate. Device expiry is separate from retention of information already received by us or a provider.

Shopping, accounts, security and privacy choices

  • Shopify cart and checkout: cart (up to three months in the scan), cart_currency (two weeks), discount_code (session) and shopify_client_id (one year) support your basket, currency, discounts and checkout. These are first-party cookies.
  • Shopify service and preferences: _shopify_essential, localization, storefront_digest and shopify_override_user_locale (one year) support store operation, regional or language choices and access to protected storefront areas where relevant. _shopify_test tests cookie support (one minute or the session).
  • Shopify accounts and Shop: _identity_session (two years), __Host-_identity_session_same_site and _master_udr (session), login_with_shop_finalize (five minutes), and shopify_pay (one year) support identification, sign-in and payment features. _shop_app_essential (one year) is used on the third-party Shop service. These can depend on which account or Shop features you use.
  • Privacy preferences: Pandectes’ _pandectes_gdpr and Shopify’s _tracking_consent and privacy_signal cookies (one year) record privacy choices or signals. Session storage named pandectes-sync and consentHeader helps pass those choices between components.
  • Cloudflare: the cf_* cookie group was reported on our domain with a one-year lifetime. It supports the delivery and protection of website functions.
  • Shopify technical browser storage: signInWithShop:cartSyncNextRecognitionAt and signInWithShop:cartSyncTransferAttemptedAt are persistent local records used to coordinate Shop cart recognition and synchronisation. shopify:webmcp_adapter_loaded is a persistent technical loading flag; __shopify_agent_context_events and wpm-ri-* are session records used by Shopify’s agent and web-pixel components. Their presence does not itself determine whether an associated analytics or advertising use requires consent.

Store preferences and features provided by us

  • gridMode: persistent local storage remembers your selected product-grid display.
  • theme:recently-viewed-products: persistent local storage keeps up to 20 product identifiers to show recently viewed products.
  • tffc-welcome:*: session storage maintains the welcome-offer state during your visit. Eligibility state is refreshed after 30 minutes of inactivity; an applied-offer flag can remain for the tab session.
  • tffc-product-reviews-v1: session storage caches product rating totals and review counts obtained for our REVIEWS.io display. Cached figures are reused for up to 15 minutes before refreshing; the record can remain for the tab session.
  • scroll_to_contact_form: a session-storage flag returns you to the contact form after submission and is removed when used.

Analytics and advertising measurement

  • Shopify analytics: _shopify_s (30 minutes), _shopify_y, _shopify_analytics and shop_analytics (one year), and _landing_page and _orig_referrer (two weeks) help measure visits, referrals and shopping activity. Session storage _shs_state and ri-* supports session and performance measurement.
  • Shopify advertising: _shopify_marketing (one year) supports marketing features, including the Shopify services described above.
  • Google Analytics: _ga and _ga_* identify browsers and sessions for visit and purchase measurement. The scan reported approximately one year; Google documents a default lifetime of up to two years, subject to browser limits.
  • Google Ads: _gcl_* cookies (three months) and related persistent local-storage records support advertising attribution and conversion measurement. Third-party IDE supports ad delivery and measurement (Google documents 13 months in the UK, EEA and Switzerland, and 24 months elsewhere); test_cookie (15 minutes) checks browser cookie support. Google’s ads/ga-audiences and pagead/1p-user-list/* pixel requests support advertising audiences and remarketing. A pixel request is not itself a cookie with an expiry date.
  • Meta: _fbp (three months) helps recognise a browser for advertising attribution and audiences. Persistent local storage lastExternalReferrer and lastExternalReferrerTime records referral information used by the Meta integration.
  • Microsoft Advertising: _uetsid (one day) and _uetvid (approximately one year in the scan) support session and visitor recognition for conversion measurement and advertising. The third-party MUID cookie supports Microsoft’s recognition and advertising services (up to 13 months). Persistent local records _uetsid, _uetvid, _uetsid_exp and _uetvid_exp hold identifiers and their expiry information. The Microsoft _cltk session-storage record supports usage measurement.
  • Littledata: persistent local storage _ld_id, _ldi, _ld_custom_clientIDs, _ld_facebook_clientIDs and _ld_googleAnalytics4_clientIDs connects browser, cart and purchase activity with the relevant measurement or advertising service. ld_ca caches cart-related information and ld_registering coordinates registration of the tracking integration. These local records do not have a browser-enforced expiry. ld_ipv4 and, where used, ld_ipv6 cache an IP address with a 24-hour application expiry checked on subsequent use; ld_fetching_ip is a coordination flag while the address is being retrieved.
  • Shop service diagnostics: bugsnag-anonymous-id is persistent third-party storage on shop.app used for error diagnostics and performance monitoring of that embedded service.

Klaviyo forms and marketing recognition

In addition to the __kla_id cookie and anonymous-activity backfill explained above, Klaviyo uses persistent local records including __kl_key, klaviyoOnsite and kl-post-identification-sync to recognise browsers, coordinate profile identification and control onsite forms. $last_referrer records referral information. Session storage klaviyoPagesVisitCountV2 counts page visits for form display. _kla_test and _kla_session_test test local and session storage respectively. These records can support marketing personalisation and measurement as well as form operation; a technical storage test does not make the related marketing use essential.

The scan also found a persistent first-party $referrer record, persistent __storage_test__* records and a session _ldmk record whose individual provider was not identified by the scanner. The first two names indicate referral and storage-availability functions respectively; the precise purpose of _ldmk and the individual providers of these records remain unconfirmed. We have not established a fixed deletion period for the persistent records. They are included here transparently rather than assigned an unverified provider or expiry.

Shopify administration records

The scan also reported Shopify merchant-administration names on the store and account domains: _merchant_essential and _shopify_essential_ (one year), __Host-_merchant_essential (session), _secure_admin_session_id and _secure_admin_session_id_csrf (12 weeks), and _merchant_analytics (one year). Shopify describes these as supporting its merchant administration or related analytics. We distinguish them from ordinary shopping features; their appearance in a scan is not a claim that every customer receives or uses an administrator session.

For further provider details, see Shopify’s cookie information, Google’s cookie information, Microsoft’s UET information and the provider privacy links above. Contact us if you need help understanding a technology or exercising your privacy choices. We review this inventory when our services change; scanning one region or journey cannot establish every cookie that may be used by a conditional payment, account or advertising feature.

Email and text messages

We use Klaviyo for marketing email and text messages, including SMS and RCS where available. Marketing consent is optional, message frequency varies and your provider’s usual charges may apply. You can unsubscribe using the link or instructions in a message, reply STOP where replies are supported, or contact us. Essential, non-promotional order, payment, delivery and service messages are separate from marketing preferences.

We may use interactions such as browsing, cart activity, purchases and message engagement to make marketing more relevant, subject to applicable consent and privacy choices. We do not share text-message opt-in consent with third parties for their own independent marketing; we may share it with providers that help deliver and administer our messaging service.

Keeping a record of marketing opt-outs

When you unsubscribe or object to direct marketing, we stop using your information for that marketing. We may keep the minimum contact details and a record of your preference on a suppression (do-not-contact) list so that we can respect your choice and avoid adding you back to marketing by mistake. We do not use that suppression record to send marketing. Separately, we may still need to retain order, accounting or other records for the lawful purposes explained in this policy.

Reviews and customer content

We may invite you to review a purchase through REVIEWS.io, subject to applicable communication preferences and legal requirements. Reviews you choose to publish may appear on our website or the review platform with the display information you provide. See the REVIEWS.io privacy policy for its own processing. We seek separate permission before using your customer photographs in advertising or social campaigns.

Profiling and fraud checks

We may use shopping interests, browsing activity, purchases and message engagement to group customers and personalise content or marketing, subject to applicable consent and privacy choices. You can object to direct marketing, including related profiling, at any time.

We use fraud-risk information to help protect customers and our business, but a person reviews the information and decides whether we reject or cancel an order for suspected fraud. We do not make that rejection or cancellation decision solely by automated means. If you think a decision is wrong, contact us so that a person can review it and consider your explanation. Payment and financing providers may make their own authorisation or credit decisions under their separate privacy notices.

International transfers and security

Our providers may store or access information outside the UK, including in the EEA, United States and other countries. Where required, transfers rely on an applicable adequacy decision or appropriate safeguards, such as approved contractual terms and the UK International Data Transfer Agreement or UK Addendum, with additional measures where necessary. Contact us for information about the safeguards relevant to your information and how to obtain a copy.

For example, Shopify describes its international-transfer arrangements in its Data Processing Addendum, Appendix C. Klaviyo describes its arrangements, including the UK Extension to the Data Privacy Framework where applicable and contractual safeguards, in its Data Processing Agreement. The safeguards used depend on the provider, destination and processing involved; contact us for details relevant to your information.

We use appropriate organisational and technical measures to protect personal information and limit access to people and providers who need it. No internet transmission or storage system can be guaranteed completely secure.

How long we keep your information

We keep personal information only for as long as it is needed for the purpose for which it was collected, including meeting legal obligations and handling complaints or legal claims.

Core order and accounting records are normally kept for six years from the end of the last company financial year they relate to. We may need to keep relevant records longer where the law requires it, an investigation is ongoing or they are needed for a specific unresolved dispute or legal claim. This does not mean that every item of customer information must be kept for six years.

For account information, customer-service correspondence and other personal information, the period depends on the purpose, whether the matter is still active, any applicable legal requirements and whether continued retention is necessary and proportionate. Our retention rule is to securely delete or anonymise information when it is no longer needed. A cookie expiring on your device does not necessarily delete information already collected by the relevant service; that information is subject to its applicable retention period.

You can ask us to erase your personal information. We will assess the request and explain if we need to keep particular records for a lawful reason. Unsubscribing from marketing is separate from deleting order or accounting records, and we may keep a minimal do-not-contact record as explained above.

Your rights and complaints

Depending on the law that applies and the circumstances, you may have rights to access or receive a copy of your information, correct it, erase it, restrict its use, receive portable data, object to processing, withdraw consent and challenge certain automated decisions. You can object to direct marketing at any time. Withdrawing consent does not affect the lawfulness of earlier processing.

Contact us using the details above. We may ask for proportionate information to verify your identity or authority. We normally respond to UK data-rights requests within one month, subject to lawful extensions or other permitted adjustments which we will explain. Applicable US state rights may also include opting out of certain advertising or sharing and appealing a refused request; contact us to exercise or appeal a request. We will not unlawfully discriminate against you for exercising your rights.

How we handle a privacy complaint

If you are concerned about how we have used your personal information, email [email protected], call 01242 352 059 or write to our address above. Please describe your concern and how we can contact you. You do not need to use legal language or a special form.

We will acknowledge your data-protection complaint within 30 days of receiving it. We will investigate without undue delay, make appropriate enquiries, keep you informed of progress and tell you the outcome and any action we will take without undue delay. If your complaint also includes a request to exercise a data-protection right, we will handle that request under its applicable deadline separately. You can complain to the ICO at any time; our process does not remove that right.

You can complain to the UK Information Commissioner’s Office, or your relevant local supervisory authority. You do not have to complain to us first, although we welcome the chance to resolve your concern.

Children, external links and changes

Our store is intended for adult customers and is not directed at children. If you believe a child has provided personal information inappropriately, please contact us. External websites and services have their own privacy notices. We update this policy when our practices or requirements change, show the revision date above and provide further notice where required.