Privacy policy
Last updated: 5 September 2026
1. Who we are
This policy explains how we collect and use personal data when you visit petalpod.co.uk, talk to us, or buy a PetalPod flower vending machine.
PetalPod is a trading name of BLOSTMM LTD, registered in England and Wales, company number 16641773. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. VAT number GB 523503915.
BLOSTMM LTD is the controller of your personal data. We are registered with the Information Commissioner's Office (ICO), registration number ZC187257.
We sell PetalPod machines to businesses in the UK. Most of the people whose data we hold are florists, their staff, or people enquiring on behalf of a business.
To contact us about your data, email support@petalpod.co.uk or write to the registered office above.
We handle your data under UK data protection law, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.
2. What we collect and where it comes from
| What | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, business name, job title, email, phone, business address | Enquiry and "Design your Pod" forms, email, phone, Facebook Messenger, Instagram messages, trade shows, our AI chat |
| Enquiry and sales details | What you asked, the machine and branding you chose, logos or artwork you upload, quotes, proposals, calls booked, notes of our conversations | You, our CRM records, our proposal and booking tools |
| Order and payment details | Deposit and balance payments, invoices, delivery address, whether you are buying as a business | You, our order form, our payment provider. We do not see or store full card numbers. |
| Chat conversations | What you type into the website chat, and your email address if you ask to be put in touch with a person | You, via the chat |
| Website usage | Pages viewed, clicks, device and browser, approximate location from IP address, session recordings of how the site is used | Cookies and similar technology (see section 5) |
| Machine owner account | Login, machine, stock, pricing and sales data | The PetalPod Portal, once you own a machine |
| Social media | Your public profile name and what you send us | Facebook, Instagram, TikTok, when you message, comment or tag us |
We only use photos or content posted by florists with permission, a tag, a Collab post or an upload to us. We do not scrape data or buy contact lists.
We do not ask for special category data (such as health or religion). Please do not send it to us.
3. How we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry, sending information and prices, arranging calls | Steps before entering a contract at your request; legitimate interests in responding to business enquiries |
| Preparing proposals, taking orders and deposits, arranging delivery or collection, warranty and support | Performance of a contract |
| Invoicing, accounts, VAT and import records | Legal obligation |
| Sending marketing about PetalPod machines and related services | Legitimate interests, and the rules on electronic marketing (see below) |
| Running and improving the website and chat, and keeping them secure | Legitimate interests |
| Analytics and session recording cookies | Consent, given through our cookie banner |
| Handling complaints, disputes and legal claims | Legitimate interests; legal obligation where it applies |
Marketing. If you enquired about a PetalPod, we may send you marketing about our machines and related products. Every message tells you who it is from and lets you opt out. You can opt out at any time by using the link in any email, replying "unsubscribe", or contacting us. If you are a sole trader or partnership and did not enquire, we will only market to you with your consent.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Our website chat
The chat on our website, "Sam (AI)", is an automated AI assistant, not a person. It answers questions about PetalPod machines. If you ask, or if it cannot help, it passes your question to our team by email so a person can reply.
We keep a record of chat conversations so we can follow up, check the answers given and improve the service. Please do not enter sensitive information or payment details in the chat.
The chat is powered by Anthropic, which processes your messages on our behalf. Under Anthropic's commercial terms, chat content is not used to train its models. Chat records are stored in our Google Workspace and kept for 12 months.
5. Cookies and analytics
We use cookies and similar technology on petalpod.co.uk. When you first visit, our cookie banner lets you accept or refuse non-essential cookies. You can change your choice at any time through the cookie settings on our website.
| Type | Used for | Provider |
|---|---|---|
| Strictly necessary | Making the site, order form, checkout and chat work, remembering your cookie choice | Vercel (website hosting), Stripe, our website chat |
| Analytics | Counting visits and seeing which pages are used | Google Analytics |
| Session recording | Recording how visitors move and click on the site so we can fix problems. Text typed into forms is masked. | Fullstory |
| Chat and CRM tracking | Linking website visits to an enquiry | HubSpot |
Analytics, session recording and tracking cookies are only set if you accept them.
If you have questions about the cookies we use, contact us at support@petalpod.co.uk.
6. Who we share it with
We do not sell your personal data. We share it only with service providers who process it for us under contract, and with others where the law requires.
- Service providers who run our systems for us, such as our CRM, email, website hosting, website chat, the AI design tool that creates your machine mockup, analytics, payments, accounts and the PetalPod Portal
- Our partners, including manufacturers, delivery partners and consultants, so we can build, brand and deliver your machine and provide our services reliably
- Finance providers, only if you ask us to refer you
- Professional advisers, HMRC, the police or the courts, where we need advice or the law requires it
Each of them receives only the data it needs for that purpose. If you would like the names of the organisations we share your data with, contact us at support@petalpod.co.uk.
If BLOSTMM LTD or its business is sold or restructured, your data may pass to the new owner under this policy.
7. International transfers
Some of our providers store or access data outside the UK, for example in the European Economic Area or the United States. Where data leaves the UK, we rely on UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Agreement or Addendum, so your data stays protected to UK standards.
Some of our partners, including our manufacturer, are based outside the UK, in countries the UK has not assessed as adequate. Where we send them personal data, such as your brand designs and business details, we put appropriate safeguards in place, as UK data protection law requires, so your data stays protected.
8. How long we keep it
We keep personal data only as long as we need it. We keep it for the periods below.
| Data | Kept for |
|---|---|
| Enquiries that do not lead to a sale | 3 years from last contact |
| Customer, order and invoice records | 6 years after the end of the financial year they relate to, for tax and accounting law |
| Warranty and support records | 6 years after the warranty ends |
| Chat records | 12 months |
| Session recordings and analytics | The standard retention period set by Fullstory and Google Analytics |
| Marketing opt-outs | Kept as long as needed so we never contact you again |
9. Your rights
You have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct data that is wrong or incomplete
- ask us to delete your data
- ask us to restrict how we use your data
- object to us using your data based on legitimate interests, and object to marketing at any time
- ask us to move data you gave us to another organisation
- withdraw consent at any time, where we rely on consent
To use any of these rights, contact us using the details in section 1. We will reply within one month. There is usually no charge.
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You can also complain to a regulator:
- UK: Information Commissioner's Office, ico.org.uk, 0303 123 1113
10. Security, children, changes and contact
Security. We use access controls, secure providers and limited staff access to protect your data. No system is completely secure, so please contact us straight away if you think your data has been put at risk.
Children. Our website and products are for businesses. We do not knowingly collect data from anyone under 18.
Machine buyers. If you buy a bouquet from a PetalPod machine, the florist who owns that machine is responsible for that sale. Card payments at machines are processed by Nayax. Where machine sales data appears in the PetalPod Portal, we process it on the machine owner's behalf, as their processor.
Changes. We may update this policy. The latest version will always be on this page with the date it was last updated.
Contact. BLOSTMM LTD, trading as PetalPod, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Email support@petalpod.co.uk. Phone +44 7383 662113.