Privacy Policy for Flower Delivery Thames Ditton Orders

Introduction

This Privacy Policy sets out how Flower Delivery Thames Ditton ("we", "our", or "us") collects, uses, stores, discloses, and protects your personal data when you place an order or otherwise interact with us in relation to flower deliveries. This policy applies to all customers placing orders for delivery to Thames Ditton and surrounding districts. Our commitment is to handle your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection legislation.

What Data We Collect

We only collect personal data that is necessary for us to fulfil your order and provide our services efficiently. The categories of data we may collect include:

• Identity Data: Name of the customer placing the order and, where applicable, the recipient's name.
• Contact Data: Delivery address, billing address, telephone number, and other contact details required for delivery and communication.
• Order Data: Details of your purchases, delivery preferences, special requests relating to the order, and order notes.
• Payment Data: Payment card or transaction details (note: full payment card data may be processed by secure third-party payment processors, not stored by us).
• Technical Data: Information about website usage, browser type, device information, IP address, and cookies (as described in our cookie policy).
• Communications Data: Records of your correspondence and communications with us.

Lawful Basis for Processing Your Data

We rely on several lawful bases under the GDPR for collecting and processing your personal data:

• Contractual Necessity: Processing your data is required to fulfil the flower delivery contract, including processing orders, communicating order updates, and handling deliveries.
• Legal Obligation: We may process certain data to comply with our legal requirements, such as record-keeping for tax or regulatory compliance.
• Legitimate Interests: For improving our products and services, handling customer queries, ensuring security, and sending necessary communications related to your order.
• Consent: We may collect certain data, such as marketing preferences, based on your explicit consent. Where consent is the lawful basis, you may withdraw it at any time.

How We Use Your Data

Your data is used strictly for the following purposes:

• Processing and delivering your flower orders, including communicating about your order status and addressing any special requests.
• Managing payment transactions securely via trusted third-party processors.
• Responding to your customer service enquiries and feedback.
• Complying with legal and regulatory requirements for our business operations.
• Monitoring, improving, and securing our website and services.
• Where you have opted in, sending occasional service-related or promotional communications.

Data Retention

We retain your personal data only for as long as is reasonably necessary for the purposes explained in this policy. This includes:

• Order and transaction data: Retained for a minimum of 6 years to comply with legal and accounting standards, unless a longer period is required by law.
• Customer service correspondence: Retained for up to 2 years after resolution, to support ongoing service quality and resolve any future queries.
• Marketing preferences: Retained until you withdraw your consent for marketing communications.

After these periods, your data will be either deleted or anonymised so it can no longer be associated with you.

Data Processors and Third Parties

To deliver our services, we use trusted third-party service providers (data processors) for certain functions. These may include:

• Payment processing providers for secure transactions.
• IT and hosting suppliers for website and systems maintenance.
• Delivery partners who handle or assist with logistical services.
• Accountancy and auditing services to comply with legal obligations.

We ensure all processors handle your data in compliance with GDPR and under strict contractual obligations to protect its security and confidentiality. We do not sell your personal data to any third parties.

International Data Transfers

Your personal data is processed and stored within the United Kingdom or European Economic Area (EEA) wherever possible. In the unlikely event your data is transferred outside the UK or EEA, we ensure adequate levels of protection through appropriate safeguards, as required under GDPR.

Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

• Right to Access: You can request a copy of your personal data that we hold.
• Right to Rectification: Request correction of incomplete or inaccurate data about you.
• Right to Erasure (Right to be Forgotten): Ask us to delete your data where there is no legal basis for retention.
• Right to Restriction: Request that we limit the way your data is processed in certain circumstances.
• Right to Object: Object to our processing of your data where we rely on legitimate interests or direct marketing.
• Right to Data Portability: Request a copy of your data in a commonly used, machine-readable format for transfer to another provider.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw this at any time.

All rights requests will be handled promptly and in accordance with the law. Proof of identity may be required before processing your request.

Data Security

We implement robust physical, electronic, and organisational safeguards to ensure that your personal data is protected from loss, misuse, unauthorised access, disclosure, alteration, or destruction. We review our security measures regularly and ensure all our staff and suppliers are appropriately trained in data protection and confidentiality.

Changes to This Policy

We may update our Privacy Policy from time to time to reflect changes in legal, regulatory, or operational standards. Any significant changes will be communicated to you, and the latest version will be available upon request and on our website.

Contact and Complaints

If you have any questions about this policy or wish to exercise any of your rights, please contact us using the details provided on our website. Should you remain dissatisfied, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local data protection authority.