Flowers Carshalton Privacy Policy

Introduction

This Privacy Policy explains how Flowers Carshalton collects, uses, and protects your personal information in accordance with the UK General Data Protection Regulation (UK GDPR). We are committed to ensuring that your privacy is protected and that your data is handled transparently. This policy applies to all customers placing Flowers Carshalton orders from Carshalton and its surrounding districts.

What Data We Collect

When placing an order with Flowers Carshalton, we may collect the following categories of personal data:

• Identity Data: Name, title.
• Contact Data: Postal address, delivery address, telephone number.
• Order Details: Details of your flower order, recipient name and address, delivery instructions, card messages.
• Payment Data: Details of transactions (note: payment information such as card numbers are securely processed by trusted third parties and not stored by us).
• Technical Data: IP addresses, browser type and version, device type, usage data, and cookies (if visiting our website).
• Correspondence Data: Information provided when you contact us or submit inquiries.

Lawful Basis for Processing Your Data

Under the GDPR, we are required to have legal grounds for processing your personal data. Flowers Carshalton processes your data using the following lawful bases:

• Contractual Necessity: Processing certain data is essential to fulfill your order (e.g., delivering your flowers, processing payment, managing your requests).
• Legitimate Interests: Some data is processed to improve our services, prevent fraud, respond to queries, or ensure website security, provided these do not override your rights.
• Legal Obligation: We may be required to process or retain data to comply with applicable law and regulatory requirements.
• Consent: Where applicable, and particularly regarding marketing communications, we will process your data only with your informed consent, which you can withdraw at any time.

How We Use Your Data

Your information is used to:

• Process and deliver your flower orders.
• Manage your customer account and any related queries.
• Comply with legal and regulatory requirements.
• Improve our products and services.
• Send marketing material, if you have opted in to receive such communications.
• Prevent fraud and secure our business operations.

Sharing Your Information with Third Parties

We may share your personal data with trusted third-party service providers (“processors”) who assist in operating our business. They act only on our instructions and are bound by contract to keep your data confidential and secure. These may include:

• Payment processors to securely manage transactions.
• Delivery partners for the purpose of fulfilling your orders.
• Technology service providers who support our website and IT infrastructure.
• Professional advisers (such as accountants or legal advisors) as required.
• Law enforcement or other authorities, if required by law.

Your data is never sold or shared for any unrelated third-party marketing purposes.

International Transfers

Sometimes our processors may be located outside the UK or European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are implemented to ensure your personal data remains adequately protected, such as using approved Standard Contractual Clauses or ensuring the recipient country offers an adequate level of data protection.

Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including for legal, accounting, or reporting requirements. Generally, customer and order data is held for a maximum of six years after your last transaction to comply with tax and contract regulations. If you withdraw consent for marketing, your data will be removed from marketing lists within one month of your request.

Data Security

We are committed to protecting your personal data. Appropriate security measures are implemented to prevent unauthorised access, disclosure, alteration, or destruction of your information. These include access controls, secure data storage, and regular reviews of our security practices.

Your Rights Under GDPR

The UK GDPR provides you with certain rights regarding your personal data. These are:

• Right to Access: Request a copy of your personal data held by us.
• Right to Rectification: Request correction of incomplete or inaccurate data.
• Right to Erasure: Request deletion of your data where there is no legal justification for its ongoing retention.
• Right to Restrict Processing: Request us to restrict processing in certain circumstances.
• Right to Object: Object to processing when we rely on legitimate interests or direct marketing.
• Right to Data Portability: Obtain your data in a common format to reuse elsewhere, where applicable.
• Right to Withdraw Consent: You have the right to withdraw your consent for any processing based on consent at any time.
• Right to Complain: Lodge a complaint with the Information Commissioner's Office if you believe your data rights have been breached.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to ensure continued compliance with legal requirements or to reflect changes to our processing practices. Updated versions will be available to all customers.

Contact and Further Information

If you have any questions about this Privacy Policy or how your personal data is handled, please contact us. We are committed to responding promptly and addressing any concerns you may have regarding your privacy.