Privacy Policy – Petal & Still

Effective Date: 1 May 2025
Last Updated: 1 May 2025

At Petal & Still, protecting your peace of mind goes hand in hand with protecting your personal data. Whether you’re browsing, placing an order, or simply spending a quiet moment on our site, we believe transparency is part of the trust we build together. This Privacy Policy explains how we collect, use, and safeguard your information in accordance with UK GDPR, EU GDPR, California CCPA/CPRA, and other applicable laws.

1. Who We Are

Petal & Still is a creative studio based in Hong Kong, offering nature-inspired DIY art kits to customers in the United Kingdom, the European Union, the United States, and other regions.

Website: https://petalandstill.com
Email: info@petalandstill.com
📬 Our business address is available upon legitimate request.

We are responsible for how your personal information is used when you visit or shop on our website.

2. What We Collect

We may collect the following types of personal data:

a. Information You Provide

Name
Email address
Shipping and billing address
Order and payment details
Messages or questions you send us

b. Information We Collect Automatically

IP address, browser and device type
Pages visited, session duration, and on-site interactions
Cookies and analytics identifiers
Referral sources (e.g., social media or search engines)

These categories are also recognized under U.S. privacy laws like the CCPA.

3. Why We Collect Your Data

We collect your data in order to:

Process and deliver your orders
Respond to your messages and requests
Send order confirmations and updates
Improve website performance and customer experience
Send optional marketing emails (with your consent)

Our legal bases under the GDPR include contract, consent, legal obligation, and legitimate interest.

4. How Your Data Is Shared

We only share your data with a small number of trusted third-party services that help us operate our shop:

Payments: Stripe and PayPal process your transactions securely. We do not store your full payment details.
Email: We use Brevo (formerly Sendinblue) to send order updates and, if you consent, occasional newsletters.
Analytics: We use Google Analytics and Rank Math SEO to understand traffic patterns and improve site functionality. We do not use this data for remarketing, behavioral profiling, or personalized advertising.
Security: We use tools that may temporarily log technical data like IP addresses to prevent unauthorized access. This data is not used to identify or track you.

We do not sell or share your personal data for advertising purposes.

5. Cookies & Tracking

We use cookies and similar technologies to:

Ensure core site features like cart and checkout work properly
Analyze traffic and visitor behaviour
Offer a more personalized experience (with your consent)

Where required by law, we ask for your consent before placing non-essential cookies.

You can control cookies via:

Our site’s cookie banner
Your browser settings

We store cookie preferences for 6 months.
We do not respond to “Do Not Track” signals due to the lack of a consistent standard.

➡️ For more details, see our Cookie Policy.

6. Data Retention

We keep your personal data only as long as necessary:

To fulfil orders and provide customer support
To comply with legal and tax requirements (typically up to 6 years)
Until you unsubscribe or request deletion (for marketing data)

You may request deletion of your data at any time, subject to legal obligations.

7. Your Privacy Rights

Depending on your location, you may have the right to:

Access the personal data we hold about you
Request correction or deletion of your data
Object to or restrict how we process your data
Receive a copy of your data (data portability)
Withdraw consent at any time, including for cookies or marketing emails

U.S. residents may also:

Know what personal data we collect and why
Request access, correction, or deletion
Opt out of sale/sharing (not applicable)
Be free from discrimination when exercising these rights

📩 To exercise any of these rights, contact us at info@petalandstill.com.
We may verify your identity and will respond within 30–45 days.

8. Where Your Data Is Stored

Depending on the services used, your data may be processed or stored in the UK, the EU, Hong Kong, or the United States. We apply appropriate safeguards for all transfers, including encryption, access control, and contractual protections in accordance with GDPR and other applicable laws.

Access to your personal data is limited to team members or partners who need it to fulfil your request or order, and all systems are secured with access controls.

9. Children’s Privacy

Our website and products are not intended for anyone under the age of 16.
We do not knowingly collect data from children.
If we learn that a child has submitted personal information, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy when needed.
If we do, we’ll update the “Last Updated” date at the top of this page.
We encourage you to review this policy periodically.