Our Commitment to Your Privacy at Flowers St Paul's Cray

Introduction

This Privacy Policy explains how Flowers St Paul's Cray collects, uses, stores, and protects your personal data in compliance with the General Data Protection Regulation (GDPR). It applies to all customers placing orders with Flowers St Paul's Cray in St Paul's Cray and the surrounding districts. Please read this policy carefully to understand your rights and how we manage your information.

What Data We Collect

When you use our services or place an order with Flowers St Paul's Cray, we may collect and process the following categories of personal information:

• Identity Data: Such as your name and, if applicable, the recipient's name.
• Contact Data: Address, delivery location, and contact phone number (if provided).
• Order Details: Information about the products you purchase, delivery date, and any special instructions provided at checkout.
• Payment Data: Limited payment information as required to process payments. Please note that full card details are never stored by us; they are processed securely by our payment provider.
• Correspondence: Any information you provide when communicating with us (e.g., through order notes, feedback, or queries).
• Technical Data: IP address, browser type, device information, and usage data. This may be collected via cookies and similar technologies to improve our service and for website analytics.

Lawful Basis for Processing Your Data

We process your personal data under the following legal grounds as set out by GDPR:

• Contractual Necessity: To fulfil our contractual obligations to deliver flowers and related services you have requested.
• Legitimate Interests: To provide customer support, improve our services, prevent fraud, and handle administrative tasks related to your order.
• Legal Obligations: To comply with UK laws, such as record-keeping and accounting standards.
• Consent: Where required, such as for certain types of marketing communication. We will always allow you to withdraw your consent at any time.

How We Use Your Information

Your personal data is used to:

• Process and deliver your orders efficiently.
• Communicate order confirmations, updates, or respond to your customer service queries.
• Personalise and improve your customer experience.
• Maintain our records in line with legal and tax obligations.
• Monitor website usage and improve our site performance, only through anonymised and aggregated data where possible.

Data Retention

Your personal data will only be retained for as long as necessary for the purposes for which it was collected, including for the purpose of satisfying any legal, accounting, or reporting requirements. Typically, we retain customer order and contact information for up to seven years to comply with business and tax laws, after which your identifiable information will be securely deleted or anonymised for analytical purposes.

Data Processors and Third Parties

We sometimes engage trusted third-party service providers (‘data processors’) to help us operate our business. These may include payment processing providers, website hosting platforms, IT support, and delivery partners. We ensure all processors handle your personal data in accordance with our strict instructions, take appropriate security measures, and do not use your data for purposes other than those specified by us.

We do not sell or rent your personal data to any third parties. Your information is not transferred outside the United Kingdom unless adequate data protection safeguards are in place as required by law.

Your Rights Under GDPR

Under GDPR, you have a number of important rights regarding your personal data:

• Right of Access: You can request details about the personal information we hold about you.
• Right to Rectification: You may ask us to correct or update inaccurate or incomplete information.
• Right of Erasure: You can request the deletion of your personal data where there is no lawful basis for its continued processing.
• Right to Restrict Processing: You may request restrictions on how we process your data.
• Right to Data Portability: You can ask for your personal data in a structured format for transfer to another service provider.
• Right to Object: You can object to the processing of your data where processing is based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: If we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing based on consent before withdrawal.

To exercise any of these rights, please contact us using the details provided on our website. We may need to verify your identity and may charge a reasonable administrative fee if your request is manifestly unfounded or excessive.

Data Security

We recognise the importance of securing your personal data. We implement suitable technological and organisational measures to ensure your data is protected against unauthorised access, loss, or misuse. Access to your data is limited to employees, agents, and processors who need it to fulfil their duties and are bound by confidentiality obligations.

Children’s Privacy

Flowers St Paul's Cray does not knowingly collect personal data from children under the age of 16. If we become aware that such data has been collected without appropriate consent, it will be deleted as soon as possible.

Policy Updates

We may periodically update this Privacy Policy to reflect changes to our practices or for legal and regulatory reasons. We encourage you to review this policy each time you use our services. Where material changes occur, you may be notified accordingly.

Contact and Further Information

If you have any questions about this Privacy Policy or would like to exercise your rights, please contact us using the contact details provided on our website or when placing your order.

This Privacy Policy was last updated in June 2024.