Flowers Eltham Privacy Policy

Introduction

We at Flowers Eltham value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and look after your information when you place orders with Flowers Eltham. This policy applies to customers placing orders with us in Eltham and the surrounding districts and outlines your rights in relation to your personal data as required by the UK General Data Protection Regulation (GDPR).

What Data We Collect

To provide our floral services, we may collect the following categories of personal data:

• Contact details: Name, delivery address, billing address, and telephone number
• Order information: Details of your purchases and preferences (such as selected bouquets, messages for the recipient)
• Payment information: Payment card data is processed securely by our payment service provider. We do not store your full card details.
• Recipient details: Name, delivery address, and messages for intended recipients, when provided by you.
• Communication data: Records of communications with us, such as order confirmations and customer service enquiries.
• Technical data: IP address and browser type (collected via cookies when you use our website; see our Cookies Policy for details if applicable).

Lawful Basis for Processing

Under GDPR, we must have a lawful basis to process your data. We process your personal information on the following grounds:

• Contractual necessity: To fulfil your order and provide our floral services to you.
• Legal obligations: To comply with applicable laws, such as record-keeping and accounting requirements.
• Legitimate interests: For purposes such as improving our service, managing our relationship with customers, and handling queries or complaints.
• Consent: Where you have opted in to receive marketing communications from us, we rely on your consent, which you can withdraw at any time.

Purposes of Data Use

Your personal data is used for the following purposes:

• Processing and fulfilling your orders, including delivering flowers and communicating with you regarding your order.
• Managing customer relationships and responding to your queries or feedback.
• Complying with legal and regulatory obligations such as tax and accounting requirements.
• Sending marketing communications if you have agreed to receive them. You may opt-out of these communications at any time.
• Improving our website and customer service through usage analysis (where applicable).

Data Sharing and Processors

We restrict access to your personal data to employees and trusted service providers who require it to process your orders. We may share your information with the following third-party processors:

• Payment processors: Securely process payment transactions. We do not store your complete payment details.
• Delivery partners: To ensure your flowers are delivered efficiently and accurately.
• IT and technical service providers: Who support our website and customer management systems.

All third-party service providers are required to process your data on our instructions and in line with this policy and the GDPR. They must keep your data secure and may not use it for their own purposes.

We do not sell or rent your personal data to any third party.

International Transfers

As a local florist, your data is generally processed within the UK. In the unlikely event your personal data is transferred and processed outside the UK or the European Economic Area, it will only be done where adequate safeguards under GDPR are in place.

Data Retention

We retain your personal data only as long as necessary for the purposes it was collected, including fulfilling your order, resolving issues, complying with legal obligations, and maintaining our records. Typically, we keep order and transaction data for up to seven years for tax and accounting reasons. Non-essential data, such as marketing consent, is kept only while you remain subscribed to our communications or until you withdraw your consent.

When data is no longer needed, we securely delete or anonymise it.

Your Rights

Under the GDPR, you have several important rights in relation to your personal data:

• Access: You have the right to request a copy of the personal data we hold about you.
• Rectification: You can request corrections to your personal information if it is incomplete or inaccurate.
• Erasure: Under certain circumstances, you can request the deletion of your data (‘right to be forgotten’).
• Restriction: You can ask us to limit the way we use your data.
• Objection: You have the right to object to our processing of your data in certain situations, such as for direct marketing.
• Portability: Where applicable, you can request that your data be provided to you in a machine-readable format for transfer to another provider.
• Withdraw consent: If we process your data based on consent, you may withdraw that consent at any time.

If you wish to exercise any of these rights, you can contact us using the details provided on our website. We will respond to your request within one month, subject to applicable legal exceptions.

Data Security

We follow industry best practices to keep your personal information secure and protected from loss, misuse or unauthorised access. This includes the use of technical and organisational measures such as secure systems, access controls, and staff training.

Cookies

We may use cookies to improve your browsing experience, provide essential website functions, and analyse site usage. You can manage cookie preferences through your browser settings. Please see our separate Cookies Policy for full details if applicable.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the date at the top of this policy. We encourage you to review this policy periodically to stay informed about how we are protecting your information.

Contact and Complaints

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us using the contact details found on our website. If you feel your data rights have not been handled appropriately, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

This Privacy Policy was last updated on 30 June 2024.