Privacy Policy for Flowers Sidcup Customers

Our Commitment to Your Privacy

At Flowers Sidcup, we understand the importance of privacy and safeguarding your personal information. This Privacy Policy outlines how we collect, use, disclose, and protect your personal data when you place orders with us, either online or in person, within Sidcup and the surrounding districts. We only process your data in compliance with applicable data protection legislation, including the UK General Data Protection Regulation (GDPR).

Who This Policy Applies To

This Privacy Policy applies to all customers placing orders with Flowers Sidcup from Sidcup and the surrounding districts. By making a purchase or engaging our services, you acknowledge and agree to the data practices outlined herein.

What Data We Collect

We collect personal data necessary for processing your orders, providing our services, and improving your experience. The types of data collected may include:

• Identification Data: Your name (first and last name), and where relevant, the name of the recipient of the flowers.
• Contact Information: Delivery address, billing address, telephone number, and delivery instructions.
• Communication Data: Correspondence via forms, notes attached to orders, and any queries you make to our customer service.
• Transaction Data: Details of orders placed, purchase amounts, payment status, and delivery dates.
• Payment Data: Payment method (such as card type—no card numbers are processed directly by Flowers Sidcup) as our payment processors handle card data.
• Technical Data: Some device and browsing information (such as IP address, browser type) may be collected through our website for security and improvements.

Lawful Basis for Collecting and Processing Data

Flowers Sidcup processes your personal data only when there is a lawful basis under the GDPR. These lawful bases include:

• Contractual Necessity: We require your data to fulfill our contract with you for providing floral products and delivery services.
• Legal Obligation: Compliance with applicable laws, such as record-keeping and accounting requirements.
• Legitimate Interests: For improvement of our services, fraud prevention, or to respond to your inquiries (provided these are not overridden by your rights).
• Consent: Where required, we may ask for your consent (for example, if you wish to receive marketing communication). Consent can be withdrawn at any time.

Data Retention

We only retain personal information for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. Specifically:

• Order and transaction details are generally retained for six years to comply with accountancy regulations and taxation law.
• Data used for marketing will be retained until you withdraw your consent or unsubscribe.
• Enquiries and communication data are kept for up to two years following the resolution of your enquiry.
• After these periods, your personal data will be securely deleted or anonymised so it can no longer be associated with you.

Processors and Sharing Your Personal Information

To provide our services efficiently, we engage carefully selected third-party providers (processors) who support the processes involved in taking, processing, and delivering your orders. These may include:

• Payment Processors: Secure payment providers who process your payment details on our behalf; Flowers Sidcup does not store your card numbers or CVV security codes.
• Delivery Partners: Local couriers or delivery drivers who require access to recipient name, address, and contact information to deliver your flowers.
• IT Service Providers: Companies that support our website, online ordering system, or communication tools.

All processors are contractually obligated to maintain the confidentiality and security of your data and may only process your data in accordance with our instructions and applicable law. We do not sell, rent, or trade your personal data to third parties for marketing purposes.

Your GDPR Rights

Under the GDPR, you have rights relating to your personal data that we hold. You may:

• Request access to your personal information (commonly known as a “subject access request”).
• Request correction of any incomplete or inaccurate data held about you.
• Request erasure (right to be forgotten) of your data, where there is no good reason for us to continue to process it.
• Object to the processing of your personal data, including for direct marketing purposes.
• Request restriction of processing of your personal information.
• Request transfer of your personal data to another party (data portability).
• Withdraw your consent at any time, if data processing is based on your consent.

If you wish to exercise any of these rights, please contact us via our official communication channels. We may be required to confirm your identity before fulfilling any requests, for security and legal compliance.

How We Protect Your Data

Flowers Sidcup implements measures appropriate to the risk to ensure the security and integrity of your personal data. These measures include physical, electronic, and managerial safeguards designed to protect against unauthorised access, loss, or misuse of personal data.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal obligations. Updates will be published on our website, and where appropriate, notified to you by other means. You are encouraged to review this page regularly.

Contact and Complaints

If you have any questions about this Privacy Policy or how your data is handled, please contact us through our official correspondence methods. You also have the right to make a complaint to the UK Information Commissioner’s Office (ICO) if you are dissatisfied with our handling of your data.

This policy was last updated in June 2024.