Skip to main content
Rise & Bloom

Privacy Policy

Last updated: August 2026

Rise & Bloom (“we”, “us”, “our”) is committed to protecting your personal data. This policy explains what information we collect, why we collect it, how we use it, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

Rise & Bloom is an independently owned and operated business. Our data controller contact is: legal@riseandbloom.uk

1. What data we collect

We collect the following personal data:

  • Email address: when you subscribe to our newsletter via the form on this website.
  • Order information: when you purchase the Rise & Bloom journal, payment is processed by Stripe and fulfilment (printing and shipping) by Lulu Direct. We do not handle or store your payment card details.
  • Enquiry details: when you use the contact form, we collect your name, your email address and the message you write, so we can reply to you. Your name and email address are saved as a contact in Loops, and the full text of your message is stored there too, attached to that contact. Loops is the same platform we use for the newsletter, so it is worth being clear that writing to us puts your message on it. Being on it as an enquirer does not subscribe you to anything.
  • Usage data: if you accept analytics using the consent banner, PostHog records which pages are visited and whether the waitlist and newsletter forms are working. It is never loaded on the Browsing Safely page, and it is never loaded at all unless you accept. See our Cookie Policy for detail.
  • Technical data for spam protection: when you submit the contact form, your IP address is sent to Cloudflare Turnstile to check the submission is not automated. It is used for that check only.

2. Why we collect it and our legal basis

Newsletter emails

Legal basis: Consent (Article 6(1)(a) UK GDPR). You gave explicit consent by ticking the checkbox on our sign-up form. You can withdraw consent at any time by clicking the unsubscribe link in any email we send, or by contacting us directly.

Purchase fulfilment

Your payment details are processed by Stripe under their own privacy policy; we never see or store your card details. Your name and delivery address are shared with Lulu Direct, who print and ship your order, under their own privacy policy.

Replying to your enquiry

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR). If you write to us, we need your name, email address and message to answer you. We hold all three in Loops, which is where our email is managed. Sending your email a newsletter is separate, and only happens if you tick the box.

Analytics

Legal basis: Consent (Article 6(1)(a) UK GDPR). Analytics runs only after you accept it using the consent banner, and you can withdraw at any time by clearing your browser storage and choosing again.

Keeping the contact form free of spam

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR). Checking that a submission comes from a person rather than a bot keeps the form usable and protects the inbox behind it.

Legal and compliance obligations

Legal basis: Legal obligation (Article 6(1)(c) UK GDPR). We may retain certain records to comply with UK consumer and tax law.

3. Who we share your data with

  • Loops: the platform that runs our email. It holds newsletter subscribers' email addresses, and it also holds contact-form enquiries: your name, your email address and the message you wrote. Loops is a US-based provider certified under the UK Extension to the EU-U.S. Data Privacy Framework, and uses Standard Contractual Clauses for any other international transfers. View their privacy policy at loops.so.
  • Stripe: our payment processor. Your payment details are handled entirely by Stripe; we never see or store your card details. View their privacy policy at stripe.com.
  • Lulu Direct: our print-on-demand and fulfilment partner. They receive your name and delivery address to print and ship your order, but not your payment details. View their privacy policy at lulu.com.
  • Vercel: our website hosting provider. They may process limited technical data (IP address, request logs) as part of serving the website.
  • PostHog: our website analytics provider, on their EU-hosted service, and only if you accept analytics using the consent banner. We do not use session recording, do not record what you click or type, and do not track you across other websites. View their privacy policy at posthog.com.
  • Cloudflare: provides the Turnstile check that protects our contact form from automated submissions. Cloudflare receives your IP address and a token from your browser for that check. View their privacy policy at cloudflare.com.

We do not sell your data. We do not share your data with any third party for marketing purposes without your explicit consent.

4. How long we keep your data

  • Newsletter subscribers: we retain your email address until you unsubscribe or ask us to remove it.
  • Order records: retained for 7 years in line with HMRC requirements. Payment records are held by Stripe; fulfilment records are held by Lulu Direct.
  • Contact-form enquiries: kept for 24 months from your last contact with us, then deleted from Loops along with the message text. If your enquiry turns into an order, the order record above applies to the order, not to the message. Ask us sooner and we will delete it sooner.

5. Your rights

Under UK GDPR, you have the right to:

  • Access: request a copy of the personal data we hold about you.
  • Correction: ask us to correct inaccurate data.
  • Erasure: ask us to delete your data where there is no lawful reason to continue processing it.
  • Restriction: ask us to restrict processing in certain circumstances.
  • Portability: request your data in a structured, machine-readable format.
  • Objection: object to processing where our legal basis is legitimate interest.
  • Withdraw consent: at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at legal@riseandbloom.uk. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

6. Cookies

We use cookies only with your consent, except where they are strictly necessary for the website to function. For full details, see our Cookie Policy.

7. Changes to this policy

We may update this policy from time to time. When we do, we will update the “last updated” date at the top. If changes are significant, we will notify newsletter subscribers by email.

← Return home