GDPR Compliance

Last updated: September 2026

Petal-loft is committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR). This page outlines how we handle your personal data in accordance with GDPR requirements.

Data Controller

Petal-loft acts as the data controller for the personal information you provide through our website and services.

Contact Details:
Petal-loft
42 Richmond Street
Liverpool L1 1EE
United Kingdom
Email: [email protected]

Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee if your request is clearly unfounded or excessive.

Right to Rectification

You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.

Right to Erasure

You have the right to request that we erase your personal data, under certain conditions such as when the data is no longer necessary for the purposes it was collected.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data, under certain conditions.

Right to Object to Processing

You have the right to object to our processing of your personal data, under certain conditions.

Right to Data Portability

You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

Right to Withdraw Consent

Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month of receipt.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data appropriately.

Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Consent: You have given clear consent for us to process your personal data for a specific purpose
• Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• Legal obligation: Processing is necessary for us to comply with the law
• Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests

Data We Collect

We collect and process the following categories of personal data:

• Identity data: name, company name
• Contact data: email address, postal address
• Technical data: IP address, browser type, device information
• Usage data: information about how you use our website and services
• Service data: consultation requests and service preferences

How We Use Your Data

We use your personal data for the following purposes:

• To provide and deliver the services you request
• To communicate with you about our services
• To improve our website and service offerings
• To comply with legal and regulatory requirements

Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Consultation request data is typically retained for three years from your last interaction with us, after which it is securely deleted unless we are required to retain it for legal purposes.

Data Security

We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication
• Staff training on data protection

International Transfers

We primarily process and store data within the UK and European Economic Area. If we transfer your data outside these areas, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

Data Sharing

We do not sell your personal data. We may share your data with:

• Service providers who help us operate our business, subject to contractual confidentiality obligations
• Professional advisers including lawyers and accountants
• Regulatory authorities when required by law

Automated Decision Making

We do not use automated decision-making or profiling in relation to your personal data.

Changes to This Notice

We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date.

Contact and Complaints

For any questions about our GDPR compliance or to exercise your rights, please contact us at [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: www.ico.org.uk