bunchy

Bunchy for florists

Data processing addendum

When you use Bunchy, we look after your customers' personal details for you. UK data protection law (UK GDPR) says we need a written agreement about that. This is it, and it forms part of our terms of service.

Last updated 10 November 2026

This is a translation, for your convenience. The English version is the one that applies, so if the two ever differ, the English wins. Read it in English.

On this page
  1. Who does what
  2. What we handle
  3. Our promises
  4. Sub-processors
  5. Outside the UK
  6. Your part

01Who does what

You, the florist, are the controller of your customers' personal details: you decide why and how they're used. Bunchy is the processor: we handle them only to run your shop for you, following your instructions, which are these terms and what you do in the portal.

02What we handle

Names, email addresses, phone numbers and postal addresses of your customers and the people they send flowers to; card messages; order, payment and invoice details; delivery photos; emails sent from your shop; and messages shoppers type to your shop assistant. We don't need, and you shouldn't put in, special category details such as health information, other than what a customer chooses to write (for example in a sympathy card message).

We handle them for as long as you use Bunchy, and for the time set out in our privacy policy afterwards.

03Our promises

  • We only use the details to provide Bunchy to you, never for our own purposes, and we never sell them.
  • Everyone at Bunchy who can see them is bound to keep them confidential.
  • We keep them secure, with encryption in transit and at rest, scrambled passwords, role-based access, two-step sign-in and encrypted daily backups kept for 90 days.
  • We help you answer requests from your customers to see, correct, download or delete their details. Most of this you can do yourself in the portal.
  • We tell you without undue delay, and within 48 hours of finding out, if there's a breach affecting your customers' details.
  • We help you with data protection impact assessments and with questions from the Information Commissioner's Office, where it's reasonable.
  • When you close your shop, you can download everything first. When you choose "Delete this shop permanently" or ask us to delete your account, we delete your customers' details within 30 days of the request (and from our backups within a further 90 days). We keep only your invoices and credit notes, without your customers' names or contact details, for 7 years from issue, because UK tax law requires those records to be kept; that is the law requiring storage that Article 28(3)(g) of the UK GDPR allows.
  • We'll give you the information you reasonably need to check we're keeping these promises.

04Sub-processors

You agree that we may use these services to help run Bunchy, each bound by data protection terms at least as strict as these:

  • Cloudflare (hosting, database, file storage, and Workers AI as a fallback for AI help)
  • Amazon Web Services (encrypted backups and security records in London; Claude AI on Amazon Bedrock in the UK or the EU, which doesn't keep prompts or pass them to Anthropic)
  • Stripe (card payments)
  • Our email delivery provider (sending emails from your shop)

We'll tell you at least 30 days before adding or replacing a sub-processor. If you have a good reason to object, tell us, and if we can't resolve it you can cancel without charge.

05Outside the UK

Where a sub-processor handles details outside the UK, the transfer is covered by UK adequacy regulations or the UK International Data Transfer Addendum.

06Your part

You make sure you have a lawful reason to collect your customers' details, that your shop's privacy policy tells them how they're used (Bunchy writes one for you to check), and that you only ask us to do what the law allows.