Privacy Policy

Blooms Point Gifts and Flower Shop is the trading name of Blooms Point Flower Arrangement Services, of Barangay Lucsuhin, Silang, Cavite, Philippines. We are the Personal Information Controller for the personal data described here, which means we decide what is collected and why, and we are answerable for it.

This policy covers this website, the orders placed on it, the deliveries that follow, and the support conversations around them. It is written to meet our obligations under the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules, and the issuances of the National Privacy Commission.

Because most orders here are gifts, this policy has to deal with two different people: the customer who places the order, and the recipient whose name, address and telephone number the customer gives us. Section 5 is about the second of those, and it is worth reading even if you are only ever the sender.

Only what an order needs, plus one thing you can opt into.

When you place an order

• About you: your name, email address and telephone number, and a billing address if you give one.
• About the recipient: their name, delivery address and telephone number.
• About the delivery: the date and window you chose, the branch the order is routed to, and any delivery notes you write — a gate colour, a guard’s desk, an instruction to call first.
• The card message: the words you asked us to write, and the names it is to and from.
• The order itself: what you bought, what it cost, the payment method you chose, and the reference number of a payment you make to us.

If you create an account

• your email address and a securely hashed form of your password — never the password itself;
• your saved delivery addresses, if you save any;
• your order history;
• your wishlist, if you use one.

If you contact us, or subscribe

• the content of your emails, calls and messages to support, and our replies — including any photographs you send with a claim;
• your email address for our newsletter, but only if you ticked the box asking for it. It is never pre-ticked.

Automatically, when you use the site

• technical information our servers record in ordinary logs — IP address, browser and device type, the pages requested and when, and errors encountered. This is how a fault gets diagnosed and how abuse gets blocked.
• the contents of the strictly necessary cookies described in section 7.

Section 12 of the Data Privacy Act requires every use of personal data to rest on a lawful basis. Ours are set out below, because the basis decides what you can ask us to stop.

• To perform our contract with you. Building the arrangement, writing the card, routing the order to a branch, delivering it, taking payment, letting you track it, and answering you when something goes wrong. Without this data we cannot fulfil the order.
• To comply with a legal obligation. Keeping records of sales for tax and accounting purposes, and responding to a lawful request from an authority.
• For our legitimate interests, where they are not overridden by your rights: keeping the site secure and available, preventing fraud and abuse, diagnosing faults, handling complaints and claims, and understanding in aggregate which products sell so we know what to make.
• With your consent, which you can withdraw at any time: our newsletter. Withdrawing it is one click in any email we send, or one message to inquiries@bloomspointph.com, and it never affects an order.

We do not sell your personal data. We do not share it with advertisers, we do not build a profile of you across other websites, and we do not make decisions about you by automated means that produce legal effects for you.

Your card message is read by the florist who writes it out, because a human being writes it by hand. It is stored with the order so that we can rewrite the card if a delivery has to be attempted a second time.

It is used for nothing else — not marketing, not analysis, not examples, not training material, and never quoted anywhere. If you would like a card message deleted from an order record after delivery, ask us and we will remove it unless we need the order record itself for the reasons in section 9.

When you send flowers to someone else, you give us their name, address and telephone number. Here is exactly what happens to them.

• They are used to make and complete that delivery, and for nothing else.
• They are given to the rider or courier delivering the order, together with your delivery notes. The courier is not told the price of the order.
• The recipient is never added to a mailing list and is never contacted about anything except their delivery.
• Where the delivery is a surprise, the rider will not say who it is from before the card is opened.
• They are kept with the order record, so that a delivery can be re-attempted and so that a later question about the order can be answered.

What we ask of you. Please only give us a recipient’s details where you are entitled to share them for this delivery — because you know the person, or they have asked you to send something, or you are otherwise authorised. We cannot verify that, and we do not pretend to; we rely on you.

We share personal data only with the parties below, only for the purposes described, and only with what each of them actually needs.

• Riders and couriers. The recipient’s name, delivery address and telephone number, and the delivery notes. Metro Manila deliveries are made by our own riders; provincial orders go by a courier company.
• Our email delivery provider, which sends order confirmations, account emails and our newsletter on our behalf.
• Our hosting, database and file-storage providers, which run this site and store the order records for us under contract. They process data on our instructions and for no purpose of their own.
• Our search provider. When you search the shop, your browser sends the search terms to a hosted search service that holds our product catalogue. It receives what you typed and your device’s network information — not your account, not your basket and not your order.
• A map tile provider. The checkout can show a map to help you confirm a delivery location. When it does, your browser requests map images from OpenFreeMap, which means that service sees your device’s network information and the area you are looking at. It is not told who you are or what you ordered.
• Professional advisers and authorities, where we are required to disclose something by law, or need advice on a claim or a dispute.
• A buyer of the business, if it is ever sold or transferred — in which case your data moves with your order records and this policy continues to apply until you are told otherwise.

Where a payment provider is added to this site in future, it will appear on this list before it is used, and we will say what it receives.

We set only the cookies the shop cannot work without. There are no advertising cookies on this site, no tracking pixels, and no analytics service recording what you do here — so there is no consent banner, because there is nothing to consent to.

• Your basket. Remembers which basket is yours between pages, so it still has your flowers in it at checkout.
• Signing in. Keeps you signed in to your account, and carries the short-lived session used when you verify your email address or reset a password.
• Finding your order. Lets your own confirmation page find your order again without an account.
• Your preferences. The store region, the branch you chose, and whether you asked for the light or dark appearance.

You can delete or block cookies in your browser. If you block the ones above, the basket, sign-in and order-tracking parts of the site will stop working — they are the mechanism, not a nice-to-have.

This site runs on cloud infrastructure, and some of the providers named by role in section 6 operate their systems outside the Philippines. That means your personal data may be stored or processed abroad.

Where that happens we remain accountable for it under the Data Privacy Act. We use established providers, engage them under contracts that restrict them to processing on our instructions, and require appropriate security measures of them. If you would like to know more about this, write to inquiries@bloomspointph.com and ask.

The principle we work to is the one the Data Privacy Act sets out: personal data is kept only for as long as necessary for the purpose it was collected for, or for the establishment or defence of a legal claim.

• Order records — kept for as long as tax, accounting and consumer law require, because an order is also a receipt and the evidence of a claim. That is longer than the order itself is interesting to either of us.
• Account details — until you ask us to close the account. Closing it removes the account; it does not delete order records we still have to keep.
• Newsletter subscription — until you unsubscribe, plus a minimal record that you did so, which is how we make sure you are not added again.
• Support correspondence and complaint records — kept while they are useful for context and while a claim could still arise from them, then deleted.
• Server logs — kept for a short operational period for security and fault diagnosis, then discarded.

We take reasonable and appropriate organisational, physical and technical measures to protect personal data against loss, unauthorised access, disclosure and alteration, as section 20 of the Data Privacy Act requires. In practice that includes serving the whole site over an encrypted connection, storing passwords only in hashed form, keeping administrative systems behind individual staff accounts with access limited to what a role needs, and keeping the systems we run patched.

We describe our safeguards in general terms deliberately. A detailed public account of how a system is defended is useful mainly to somebody attacking it.

Under the Data Privacy Act of 2012 you have the following rights over your personal data. They belong to recipients of gifts as much as to customers.

• To be informed that your data is being processed, and of the details in this policy.
• To access what we hold about you, where it came from, and who we have disclosed it to.
• To rectify anything inaccurate or incomplete.
• To object to processing, including to direct marketing — which for us means the newsletter, and which you can stop at any time.
• To erasure or blocking of data that is incomplete, outdated, false, unlawfully obtained, or no longer necessary for the purpose it was collected for.
• To damages for harm caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your personal data.
• To data portability, where your data is processed by electronic means and in a structured, commonly used format.
• To lodge a complaint with the National Privacy Commission.

Your rights over a deceased or incapacitated data subject’s information may be exercised by their lawful heirs or assigns, as the Act provides.

Write to inquiries@bloomspointph.com with “Privacy request” in the subject line, and tell us what you would like us to do. Support is answered every day, 7:00 AM–10:00 PM, and a request in writing is what we can act on properly.

Please include enough for us to find you and be sure it is you: the email address or phone number on the order or account, and an order number if your request is about a particular order. We may ask one or two further questions to confirm your identity before we release or delete anything — that check protects you, and we keep it as light as we responsibly can.

We will acknowledge your request and act on it without undue delay. If we cannot do what you have asked — for example, we cannot delete an order record we are required to keep — we will tell you which record it is and why, rather than simply declining.

This site is intended for adults, and we do not knowingly collect personal data from children. Flowers are sometimes delivered to a child as a recipient, in which case we hold only what the delivery needs — a name, an address and a contact number, which is usually a parent’s.

If you believe a child has given us personal data through this site, tell us at inquiries@bloomspointph.com and we will delete what we are not required to keep.

We update this policy when what we do changes. The effective date and the last update are shown at the top of this page. Where a change materially affects how we use data you have already given us, we will tell you rather than rely on you noticing.

If you are unhappy with how we have handled your personal data, please tell us first — our Dispute Resolution Policy explains how we handle a complaint and how long it takes. You also have the right to complain to the National Privacy Commission, whose site is privacy.gov.ph. Complaining to us first does not reduce that right, and we will not treat you differently for exercising it.