Privacy & browser storage

Who is responsible?

We Love Balloons Ltd is responsible for the personal information collected through this website, including its Ladybug and Commercial sections Bendypole enquiries and the Pineapple staff app. Company number 10314442. Contact address: 240 High Street, Wibsey, Bradford, BD6 1QP. Email info@weloveballoons.co.uk or call 01274 693092 about your information.

Orders and enquiries

We use your name, contact details, order contents, personalisation, recipient or delivery details, dates and notes to answer enquiries, take payment and fulfil orders. The lawful basis is taking steps at your request before a contract and performing that contract. Required order fields are needed to arrange your order; you can browse without placing one. Give us another person’s details only where needed for the order and make them aware of this notice.

Payment references, amounts and status help us reconcile orders. Accounting records are retained to meet legal obligations. We also use necessary records to resolve queries, prevent fraud and handle disputes: our legitimate interests are protecting customers and running the business safely. Payment card numbers and security codes are entered with the payment provider, not stored in our website order database.

Birthday Club and email updates

Birthday Club uses your first name, email and member code to provide membership and the 5% eligible-product discount. If you ask us to remember birthdays, we store the person's name, optional relationship, month and day, plus whether you chose 21-day and/or 7-day reminders. We do not ask for their year of birth or age. We use those details only to provide the reminder service you requested.

Birthday reminders are part of the Birthday Club service and are separate from marketing. Newsletter preferences record the topics you select, your consent and when it was given. Marketing remains optional and relies on consent; Birthday Club membership does not require marketing consent.

You can ask us to stop reminders, remove birthday details or close your membership at any time. You can also withdraw marketing consent separately without affecting orders or earlier lawful processing.

Pineapple staff app

Authorised users can view customer and operational records to manage the business. Staff sign-in email and account identifiers are used to control access; some operational changes record the account responsible and when the change happened. Hosting and security services also process technical request information. Our lawful basis is our legitimate interest in protecting information, controlling access and operating the business. Contact us to exercise your rights over staff information too.

The installed app needs an internet connection and does not provide an offline customer database. Downloaded exports, printed order sheets and copies in connected services still contain personal information and need appropriate protection. Staff pages are excluded from the website’s own browser-sent measurement.

Who receives information?

Our authorised team uses order and enquiry details to help you. Cloudflare hosts and protects the site and stores website records. Square receives the information needed to take your card payment. Delivery staff or postal services receive the recipient and delivery details they need. Resend sends website enquiry and order emails when configured, and our email providers handle correspondence. Google Calendar receives operational order details when calendar synchronisation is enabled. Professional advisers or authorities may receive records where needed for accounting, a legal duty or a dispute.

Submitting an online Commercial enquiry stores the submitted details and queues an email to our team. Where an email link opens your email app, you still need to send that message. Saving a project on your device alone does not send an enquiry to us. Steve read-aloud uses OpenAI to generate audio from fixed card wording when available; this voice request does not include your checkout details.

Some providers process data internationally, including in the United States. Cloudflare’s published data-processing terms describe its international transfer safeguards, including the UK transfer arrangements. Square explains its own safeguards in its privacy notice. Contact us for information about the safeguards applicable to your data. See Cloudflare’s data-processing terms and Square buyer privacy information.

Make Your Own: Roast, Love and eCards

When you generate a personalised roast or loving message, the first name, relationship, occasion, habits or memories, qualities you like or love and off-limits notes you enter are sent to OpenAI to write three choices. Please avoid sensitive details. Choosing read-aloud sends the selected message to OpenAI to generate audio; a device voice may be used if that service is unavailable. The audio is stored temporarily on our Cloudflare storage for up to 7 days so that repeat plays of the same message do not need to be generated again, and is then deleted automatically. Our website does not save these form entries, generated messages or custom audio in its order database. OpenAI may retain API data under its own service policies.

An eCard link contains the message and recipient name in the part after the # symbol. Anyone with the full link can read it, and it may remain in browser history or wherever you share it. Sharing does not automatically send an email. Requesting a printed card opens a draft in your email app; sending that draft shares its contents with us as an enquiry.

How long information is kept

We keep order, invoice and payment records for the period needed to fulfil the order, meet applicable tax/accounting requirements and handle claims. Enquiries are kept while being dealt with and for any resulting booking or dispute. Club records are kept while membership is active, subject to withdrawal or a deletion request. Current Birthday Club reminder details are kept while that reminder service is active, subject to withdrawal or deletion requests. Legacy reminder records from the retired earlier implementation remain outside the new consent version and are not used by the new sender; those legacy records and backup copies still require retention review. Consent and suppression records may be kept to evidence your choices and avoid contacting you again. Staff access, operational history and security records are retained according to security needs and any investigation. Copies in email, calendars and backups must also be considered. The criteria are the purpose, legal retention duties and whether a matter remains unresolved; contact us about the retention of a particular record.

Keep It Up first-order game

If you play, we use your verified Club email to record your one attempt, its time, score, reward code, expiry and the order using it. We verify the submitted game inputs to calculate your score; the input sequence is not kept in the reward table. The reward record remains with your Club records to prevent repeat claims, subject to deletion requests and any records needed for an associated order. Game sign-in uses an essential, secure cookie lasting up to seven days. Signing in or playing does not change your marketing choices.

Browser storage and cookies

The site uses local storage on your device to remember your basket and personalisation, checkout draft, saved Commercial shortlist and project details. Checkout drafts can include contact and delivery details, so take care on shared devices. These remain until removed, replaced or you clear the site’s browser data. Payment recovery references are considered for up to 30 days and removed after a successful reconciliation; they help prevent paid items staying in your basket.

This storage supports shopping features you ask to use. Clearing site data removes saved drafts and baskets from that browser, not order records already sent to us. Cloudflare Access uses essential authentication/session storage for staff sign-in. Cloudflare and payment services can use security, session or payment cookies under their own notices. The Google Maps links open Google only when clicked; there is no embedded map on our Contact page.

Site measurement and your choice

We count page views and certain actions using the page path, referring website hostname and a broad device category. Website analytics stores combined daily counts, not a named visitor profile. Our purpose and legitimate interest is understanding which parts of the site are useful. Hosting/security services also process technical request information, such as IP addresses, to deliver and protect the site.

You can switch off browser-sent site measurement below. This does not stop essential order processing or security logs. A small local preference remembers your choice on this browser; browser Do Not Track is also respected. We do not use this measurement to make decisions with legal or similarly significant effects about you.

Your rights

You can ask to access or correct your information, and, where the law applies, erase it, restrict its use or receive a portable copy. You have the right to object to processing based on legitimate interests and to direct marketing. You can withdraw consent at any time. Email or call us using the details above; we may need proportionate information to verify the request.

To raise a data-protection complaint with us, email, call or write to the contact details above. Please explain your concern and what you would like us to do. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome. Data access requests are normally answered within one month, subject to the applicable legal rules.

You can complain to the Information Commissioner’s Office (ICO). You do not have to contact us first, though we would welcome the chance to resolve a concern.