Privacy Policy
Last updated: April 2025
Rise & Bloom (“we”, “us”, “our”) is committed to protecting your personal data. This policy explains what information we collect, why we collect it, how we use it, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).
Rise & Bloom is operated by Doman Digital. Our data controller contact is: legal@domandigital.co.uk
1. What data we collect
We collect the following personal data:
- Email address — when you subscribe to our newsletter via the form on this website.
- Order information — when you purchase the Rise & Bloom journal, your order is processed entirely by Lulu Direct. We receive only confirmation that an order was placed. We do not handle or store payment card details.
- Usage data — if we use analytics tools in future, we will update this policy and collect consent separately. Currently, no analytics cookies are set without your explicit consent.
2. Why we collect it and our legal basis
Newsletter emails
Legal basis: Consent (Article 6(1)(a) UK GDPR). You gave explicit consent by ticking the checkbox on our sign-up form. You can withdraw consent at any time by clicking the unsubscribe link in any email we send, or by contacting us directly.
Purchase fulfilment
Your purchase data is processed by Lulu Direct under their own privacy policy. We receive only a record that an order was placed; your payment and delivery details remain with Lulu.
Legal and compliance obligations
Legal basis: Legal obligation (Article 6(1)(c) UK GDPR). We may retain certain records to comply with UK consumer and tax law.
3. Who we share your data with
- Brevo (Sendinblue) — our email marketing platform. Your email address is stored on their servers to enable us to send newsletters. Brevo processes data in the EU under standard contractual clauses. View their privacy policy at brevo.com.
- Lulu Direct — our print-on-demand and fulfilment partner. They process your order, payment, and delivery information independently. View their privacy policy at lulu.com.
- Vercel — our website hosting provider. They may process limited technical data (IP address, request logs) as part of serving the website.
We do not sell your data. We do not share your data with any third party for marketing purposes without your explicit consent.
4. How long we keep your data
- Newsletter subscribers — we retain your email address until you unsubscribe or ask us to remove it.
- Order records — retained for 7 years in line with HMRC requirements, held by Lulu Direct.
5. Your rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate data.
- Erasure — ask us to delete your data where there is no lawful reason to continue processing it.
- Restriction — ask us to restrict processing in certain circumstances.
- Portability — request your data in a structured, machine-readable format.
- Objection — object to processing where our legal basis is legitimate interest.
- Withdraw consent — at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at legal@domandigital.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
6. Cookies
We use cookies only with your consent, except where they are strictly necessary for the website to function. For full details, see our Cookie Policy.
7. Changes to this policy
We may update this policy from time to time. When we do, we will update the “last updated” date at the top. If changes are significant, we will notify newsletter subscribers by email.