Privacy policy

Version 1 | 22 October 2026

This policy explains how Grey Blossom Ltd uses personal information when you browse www.greyblossom.com, buy from our Shopify shop, sign up for shop communications or contact us about an order.

Memory Grove is our separate online memorial platform. Its accounts, memorial content, contributions and visitor information are covered by the Memory Grove Privacy Policy. Section 5 below explains how information moves from a shop purchase into that service. Buying through the shop is covered by this policy even where the purchase includes Memory Grove.

1 Who we are and how to contact us

Grey Blossom Ltd is the data controller for the personal information we use to run the shop and manage customer relationships. We are registered in Scotland under company number SC602883. Our registered office is 75 East Main Street, Broxburn, Scotland, EH52 5EE.

For privacy questions or requests, email help@greyblossom.com or write to Grey Blossom Ltd, 47 Albert Road, Dundee, Scotland DD5 1AY.

2 Information we collect and where it comes from

Depending on how you use the shop, we collect:

• Contact and delivery details: your name, email address, telephone number, billing address and delivery address, including a recipient's details where you ask us to send a gift.
• Order and payment information: products purchased, order numbers, payments and transaction confirmations, delivery information, returns and refunds. Shopify and payment providers process the payment information needed for your chosen payment method.
• Shop account information: details used to identify and manage your shop account, preferences and settings. A shop account is separate from a Memory Grove Guardian account.
• Personalisation and other content you provide: names, dates, wording, images or other material submitted for a personalised product, reviews and messages to us.
• Device and browsing information: browser, device, network and IP information, identifiers and information about how you interact with the shop, such as pages viewed and products added to your basket. Cookies and similar technologies may collect this information.
• Communication preferences: subscriptions, consent choices, requests and correspondence.

Information comes from you, from the person placing an order for a recipient, automatically from use of the shop, and from Shopify, payment, delivery and other providers involved in our services. We may receive relevant information from a partner referring or helping with an order.

We need the information necessary to accept payment, fulfil and deliver your order, contact you about it and comply with our legal obligations. If you do not provide it, we may be unable to complete the purchase. Optional marketing choices are separate from placing an order.

3 Why we use information and our legal bases

Purpose	Legal basis
Take and fulfil orders, process payment, personalise products, arrange delivery, handle contractual returns and provide purchased services	Performing our contract with you, or taking steps you request before entering it
Deliver a gift and communicate about an order with someone other than the purchaser	Our legitimate interest in fulfilling the purchaser's order and providing customer support
Respond to enquiries, manage shop accounts, seek feedback, investigate problems and improve the shop	Our legitimate interests in operating a useful shop and providing good customer service; contract where necessary for a purchased service
Protect accounts, prevent fraud, investigate misuse and establish or defend legal claims	Our legitimate interests in protecting customers, our business and our legal rights; legal obligation where applicable
Keep tax, accounting and other legally required records and respond to lawful requests	Legal obligation
Send marketing and personalise advertising or use optional tracking	Consent where required; otherwise our legitimate interests in promoting relevant products where the law permits this

Where we rely on legitimate interests, we consider the impact on your rights and reasonable expectations. You can object to processing based on legitimate interests. You can object to direct marketing at any time. Where we rely on consent, you can withdraw it without affecting earlier lawful processing.

4 Shop marketing cookies and advertising

We may send marketing communications, recommend products, measure use of the shop and advertise to people who have interacted with it, where permitted by law. We obtain consent where it is required for electronic marketing, cookies or similar technologies. Essential technologies may be used to provide functions such as the basket, checkout and security.

You can unsubscribe from marketing emails using the link in an email or by contacting us. This does not stop necessary order, delivery or account messages. You can manage cookie choices through the shop's privacy controls where available and through your browser settings. Blocking essential cookies may affect shop functions.

The shop and Memory Grove have different tracking arrangements. Memory Grove currently has no analytics or advertising tracking tools. Becoming a Guardian or contributing to a memorial does not itself subscribe you to shop marketing. Memorial content will not be used in marketing without separate, explicit permission.

5 When a purchase includes Memory Grove

To provide the memorial you have purchased, we use the purchaser's name, email address, order number and product purchased to create the entitlement and arrange the setup invitation. Memory Grove does not receive billing addresses or payment details from Shopify for this purpose. The purchaser sets their Guardian password when activating Memory Grove; it is not taken from their Shopify account.

The invitation currently goes to the purchaser. Transferring Guardianship is a future feature and is not currently available.

Memory Grove's platform and uploaded files are hosted by Cloudways on a UK server. Zapier and Klaviyo handle the information needed for its invitations and other service emails. Memorial photos, stories and contributions are not sent to them for that purpose. These Memory Grove emails are for running the service, rather than marketing.

The Memory Grove Privacy Policy explains Guardian details, memorial content, public visibility, service providers, retention and privacy rights in more detail. Its Terms of Service cover use of that platform. Guardians and anyone submitting a contribution or comment must be 18 or older.

6 Who we share information with

We share relevant information with:

• Shopify and providers supporting payments, hosting, shop accounts and checkout.
• Delivery, production and fulfilment providers where needed to prepare, personalise and deliver your purchase.
• Providers supporting customer service, email, reviews, analytics, advertising and other shop functions, subject to applicable privacy choices and legal requirements.
• The Memory Grove providers described in section 5 when your purchase includes that service.
• Advisers, authorities and other parties where needed to meet a legal obligation, investigate misuse, establish or defend legal claims, or handle a business transfer lawfully.

Where you ask us to share information with someone else, we use the details needed for that request. Authorised members of our team can access information where needed for their work. Sharing for shop advertising does not authorise use of private memorial content for that purpose.

7 Shopify's role

Shopify hosts our shop and processes information about transactions and use of the shop to provide and improve its services. The shop uses Shopify enhanced features that may incorporate information about interactions with our shop, other merchants and Shopify, including to support personalised advertising and business improvement, subject to applicable choices and legal requirements.

For some of these enhanced features, Shopify is responsible for processing information and handling rights requests about that use. Read the Shopify Consumer Privacy Policy or visit the Shopify Privacy Portal for details and applicable choices.

This Shopify hosting description applies to the shop. Memory Grove is hosted separately as explained above.

8 International processing

Shopify and other providers may process information outside the UK or the country where you live. Where a restricted transfer requires safeguards, we use an applicable adequacy decision or approved contractual safeguards, such as the relevant UK transfer agreement or addendum, and any additional measures required by law. EEA transfers use the applicable EEA arrangements where required.

Contact help@greyblossom.com for information about the arrangements relevant to your data and how to obtain a copy of applicable safeguards.

9 How long we keep information and how we protect it

We keep shop information for as long as needed for the relevant purpose. Factors include fulfilling an order, dealing with returns or queries, maintaining an account, honouring marketing choices, meeting tax and accounting obligations, preventing fraud and resolving legal claims. We review what remains necessary rather than treating every record as permanent.

We may retain a limited record of an unsubscribe or objection so that we can respect it. Deleting a shop account does not automatically delete a Memory Grove memorial, and deleting a memorial does not automatically remove shop records we still need for an order or legal obligation. The Memory Grove policy explains retention within that platform.

We use appropriate measures to protect personal information and limit access to those who need it. No online service can guarantee absolute security. Contact us if you think your information or account has been compromised.

10 Children and information about other people

The shop is not directed at children. This does not mean that a memorial product can never contain information about a child. For example, an adult may submit a child's name, photograph or dates for an appropriate personalised item. Provide only information you are entitled to share and obtain the permissions needed, including from a parent or legal guardian where appropriate.

Memory Grove's 18-or-older requirement for Guardians and contributors does not prohibit memorials about children. Its privacy policy requires explicit parent or legal guardian approval before creating a memorial about a child.

Contact us if a child has provided information inappropriately or if someone has supplied private information about you without permission. We will review the request and any rights involved.

11 Your rights and complaints

Depending on the circumstances and applicable law, you can request access to your information, correction, deletion, restriction of processing or a portable copy. You can withdraw consent where we rely on it and object to legitimate-interest processing. Direct-marketing objections will be respected.

Contact help@greyblossom.com or write to our Albert Road contact address. We may need proportionate identity checks, or evidence that someone is authorised to act for you. We normally respond within one month, subject to lawful extensions. We will explain any lawful reason why we cannot fulfil a request in full and will not penalise you for exercising your rights.

You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or another competent data protection authority where applicable. We welcome the opportunity to address concerns first.

12 Links and updates

Independent third-party sites have their own privacy practices. Linking to them does not mean that their practices are covered by this policy. This does not remove our responsibility for our own processing or providers acting on our behalf.

We will update this policy when our practices change and give notice of significant changes where required. Reading or accepting shop terms is not consent to optional marketing, tracking or other processing that requires consent.