Privacy Policy for Customers of Flowers Crofton Park

Introduction

This Privacy Policy describes how Flowers Crofton Park ("we", "our", "us") collects, processes, and protects personal data of customers who place orders with us in Crofton Park and the surrounding districts. We are committed to safeguarding your privacy in compliance with the UK General Data Protection Regulation (GDPR) and relevant data protection laws. Please read this notice carefully to understand your rights and our obligations regarding your personal data.

Scope of Policy

This policy covers all personal data of customers who place orders with Flowers Crofton Park, whether through our website, by telephone, or in person, for delivery or collection within Crofton Park and neighbouring districts.

What Data We Collect

We collect and process information necessary to fulfil your flower orders and provide related services. This may include:

• Identification Information: Your full name.
• Contact Details: Delivery and billing addresses, phone number (if provided), and in some cases, email address.
• Order Information: Details of the flowers or gifts ordered, recipient's name and address (if applicable), messages included with your order, special requests, and payment method (we do not store complete payment card details).
• Communication Records: Any correspondence between you and Flowers Crofton Park, such as enquiries, feedback, or complaints.
• Technical Data: Information collected automatically when using our website, such as IP address, device information, and browsing behaviour. This helps us to administer our site and improve user experience.

Lawful Basis for Processing

We process your personal data only when there is a lawful basis to do so. These are:

• Contract: Processing data is necessary for performing our contract with you when you place an order.
• Legal Obligation: We may process data to comply with legal or regulatory obligations (e.g., accounting and tax requirements).
• Legitimate Interests: We may process limited data where it is in our legitimate business interests for the operation of our service, provided your interests and fundamental rights do not override these interests. For example, to prevent fraud or improve our services.
• Consent: In certain cases, such as for marketing communications, we will only process your data if we have your explicit consent. You can withdraw this consent at any time.

How We Use Your Personal Data

Your personal data is used for the following purposes:

• Processing and fulfilling your orders, including delivering products and handling payment;
• Providing customer service and responding to any queries or complaints;
• Maintaining internal records for business operations;
• Improving our services and website;
• Complying with legal requirements and fraud prevention.

Sharing and Processors

We only share your data with trusted third parties (processors) when necessary to fulfil your order or maintain our business operations. Examples include:

• Payment Providers: For processing your payment securely (we do not retain complete payment card details).
• Delivery Partners: To deliver flowers or gifts on your behalf.
• IT and Hosting Providers: For website, order processing system and data storage support.

All our processors are required to comply with data protection law and are prohibited from using your personal data for their own purposes. We only permit them to process your data for specified purposes in accordance with our instructions.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Typically, order and transaction data is retained for up to six years in accordance with HMRC and accounting regulations. Correspondence and non-essential data are held for a shorter period where possible, unless longer retention is required by law or to resolve disputes.

Once data is no longer required, we will securely delete or anonymise it in accordance with applicable laws and our data retention policies.

Your Rights as a Data Subject

Under GDPR, you have rights regarding your personal data. These include:

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can ask us to correct inaccurate or incomplete data.
• Erasure: You may request deletion of your data, provided there is no legal reason for us to continue processing it.
• Restriction: You may ask us to restrict or suppress processing of your data in specific circumstances.
• Objection: You have the right to object to processing for direct marketing or where our processing is based on legitimate interests.
• Data Portability: Where applicable, you can request that we provide your data in a structured, commonly used, and machine-readable format.

To exercise your rights, please contact us using the details provided on our website or customer correspondence. We will respond to requests within the statutory timeframes. Please note some rights may be limited where we are required to retain information for legal purposes.

Data Security

We take appropriate measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. These include technical safeguards (secure servers, encryption, firewalls) and organisational procedures (access controls, staff training). All payment transactions are processed using secure, industry-standard methods.

International Transfers

Your personal data is processed and stored within the United Kingdom or the European Economic Area. If we ever need to transfer your information outside these regions, we will ensure an adequate level of protection is maintained, in line with data protection laws.

Changes to This Policy

We may update this Privacy Policy occasionally to reflect changes in legal requirements, our business practices, or technology. The date of the latest revision will always be shown at the end of the policy. We encourage you to review this privacy notice periodically.

Contact and Complaints

If you have questions about this policy, our data practices, or wish to exercise your rights, please contact us via the channels provided on our website. You are also entitled to raise a complaint with the UK Information Commissioner's Office if you believe your data protection rights have been breached.

Last Review: June 2024