What we collect and why

Pookaran is the data controller for the information described here. Contact details are on the contact page.

Four groups, and nothing beyond them:

• About you: your name and email address. Your email is used only to reach you about your order if we cannot reach you on WhatsApp.
• About the recipient: their name, delivery address and — only if you choose to give it — a phone number.
• Your message card: the text you want written out by hand. It is passed to the florist and to nobody else.
• The order itself: what you bought, the delivery city and date, and the amount charged.

You do not pay on this website. After you place an order we confirm it with you on WhatsApp and send a secure payment link from our payment provider. Your card details are entered on the provider’s own payment page and never pass through Pookaran’s website or servers.

We receive confirmation that the payment succeeded and the amount paid, so we can match it to your order reference — never your full card number.

A fair objection, and the reason this section exists. We hold the recipient’s details on the lawful basis of performing the contract you entered into: we cannot deliver flowers to someone without knowing where they are.

Their details are used for that delivery and nothing else. A recipient is never added to a marketing list, and a phone number you supply is used only if the florist cannot complete the delivery. A recipient can ask us to erase their details once the delivery is complete, and we will.

• The florist fulfilling your order receives the recipient’s name, address, phone number if given, and your message card. They need all four to deliver. They do not receive your card details or your address.
• Our payment provider processes the transaction and holds the card data we never see.
• WhatsApp (Meta) carries the conversation where we confirm your order and send your payment link.

We do not sell personal data, and we do not share it with advertising networks. Because florists are local to the recipient, sending flowers to a country outside the UK or EEA necessarily transfers the delivery details to that country — that transfer is what the order is.

Essential cookies only, plus analytics if you agree to it.

A currency cookie remembers which currency you want prices shown in. It is set from your country on your first visit, holds only a three-letter currency code, and changes whenever you pick a different currency at the top of the page.

The basket cookie stores which arrangements you have chosen, their sizes, the destination city, the delivery date and your message card. It stores no prices — those are recalculated on our server every time, so a tampered cookie cannot change what anything costs — and it cannot be read by JavaScript in your browser. It expires after 14 days.

Once you place an order, a profile cookie remembers your own name, email and the references of orders placed from this browser, so checkout is prefilled next time and your orders are listed on your profile page. It holds nothing about the recipient, cannot be read by JavaScript, expires after a year, and can be deleted from the profile page at any time.

Analytics cookies are loaded only after you accept them, and the site works identically if you decline. There is no advertising or cross-site tracking on this site at all.

Your account is your email address, proven by a one-time code we email you — there is no password. It stores your name, the orders placed with that email, and any delivery addresses you chose to save at checkout (the recipient’s name, address and, if you gave one, phone number). Saved addresses are only there so you can pick them next time.

Signing in sets a cookie that keeps this browser signed in for 30 days; it cannot be read by JavaScript. You can remove a saved address, sign out, or delete your account and every saved address from the account page at any time. Deleting the account does not delete orders already placed — those are records of a sale that we are required to keep (see below).

Order records are kept for six years, because tax law in most of the countries we operate in requires it. Message-card text is deleted 90 days after delivery — it is often personal, and there is no reason to hold it once the flowers have arrived. The basket cookie expires after 14 days.

You can ask for a copy of the data we hold about you, ask us to correct it, ask us to delete it, object to how we are using it, or ask for it in a portable format. Where we rely on your consent — analytics — you can withdraw it at any time without giving a reason.

Write to us and we will respond within one month. If you are not satisfied with how we handle it, you can complain to the data-protection authority in your country; in the UK that is the Information Commissioner’s Office.