Flowers Gipsy Hill Privacy Policy

Introduction

At Flowers Gipsy Hill, we are deeply committed to protecting your privacy. This Privacy Policy outlines how we collect, use, store, and process your data whenever you place an order with us from Gipsy Hill or the surrounding districts. We abide by the UK General Data Protection Regulation (GDPR) and related data protection laws to ensure the safety and lawful use of your information.

Scope of This Policy

This policy applies to all customers who place flowers orders through Flowers Gipsy Hill, whether online, by telephone, or in person, when the order is to be delivered within Gipsy Hill or any neighbouring district. If you have any questions about how we use your information, please refer to this policy for an explanation of your rights and our responsibilities.

What Personal Data We Collect

We collect a range of personal data in the course of providing our services. The type of data collected depends on how you interact with us and may include:

• Identity and Contact Details: Such as your name, address, phone number, and delivery address details.
• Order Information: Details about the products you order, messages for flower cards, and any delivery instructions.
• Payment Details: Data related to transactions (please note that card details are processed securely by our payment processor and are not stored by us).
• Communication Data: Any correspondence you have with us by email, phone, or in person.
• Website Usage Data: Information collected via cookies or similar technologies, including IP address, browser type, and usage statistics, when you use our online services.

The Lawful Basis for Processing

Under the GDPR, we must have a valid reason to use your personal data. Flowers Gipsy Hill relies on the following legal bases:

• Contractual Obligation: When you place an order with us, processing your personal data is necessary to fulfil our contract with you, such as receiving, delivering, and tracking your order.
• Legitimate Interests: We may process your data for the legitimate interests of managing and improving our business, understanding customer preferences, or handling customer service issues, provided these interests do not override your rights.
• Legal Requirement: If the law requires us to process your data, for example for tax or accounting purposes.
• Consent: In certain situations, such as sending you direct marketing communications (where you are not an existing customer), we will ask for your explicit consent.

How We Use Your Information

Your personal data is used for the following purposes:

• Processing and fulfilling your flower orders.
• Communicating with you regarding your order status, queries, or special requests.
• Improving our products and services based on your feedback and preferences.
• Complying with legal and regulatory obligations.
• Sending you marketing communications, if you have provided your permission or are an existing customer (with a clear opt-out option available).

How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Typically, we will keep your order and contact details for up to six years after your last transaction, as required for accounting purposes. After this period, your personal information is securely deleted or anonymised.

Who Processes Your Data

Flowers Gipsy Hill may share your data with selected third-party service providers who act as data processors on our behalf. This may include:

• Payment Providers: To securely process your transaction and prevent fraud.
• Delivery Services: For order delivery and tracking, where necessary.
• IT and System Providers: To enable us to provide our website, process orders, and manage communications.

All third parties are required to respect the privacy and security of your data and act only on our instructions. They are contractually bound not to use your personal data for their own direct marketing or other unrelated purposes. We do not sell or rent your personal data to any other organisations.

Your Rights Under GDPR

As a data subject covered by the GDPR, you have the following rights relating to your personal information:

• Right of Access: Obtain a copy of the personal data we hold about you.
• Right to Rectification: Correct any inaccurate or incomplete information.
• Right to Erasure: Request deletion of your personal data in certain circumstances.
• Right to Restrict Processing: Ask us to limit the way we use your data.
• Right to Data Portability: Request a transfer of your data to another service provider, where technically feasible.
• Right to Object: Object to the processing of your data where we process it based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: If we rely on your consent, you can withdraw it at any time.

To exercise any of these rights, please contact us using the details provided on our website or at our physical shop. Your request will be handled according to GDPR requirements, and we will respond as soon as possible, typically within one month.

Security Measures

We have implemented appropriate technical and organisational measures to safeguard your personal data against loss, abuse, unauthorised access, or disclosure. This includes secure storage, access controls, staff training, and regular review of our data protection practices.

Changes to This Policy

We may update this privacy policy occasionally to reflect changes in our practices, legal requirements, or customer feedback. Any significant updates will be communicated to you when relevant, and the latest version will always be available on our website and in-store.

Contact and Complaints

If you have concerns about how your personal data has been handled or wish to make a complaint, please get in touch with us directly. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are not satisfied with our response.