Flower Delivery Sydenham Hill – GDPR Privacy Policy

Our Commitment to Your Privacy

At Flower Delivery Sydenham Hill, we respect the privacy of our customers and are committed to handling your personal data with care and transparency. This Privacy Policy explains how we collect, store, process, and share your information in compliance with the General Data Protection Regulation (GDPR) and relevant UK data protection laws. This policy is applicable to all customers placing flower delivery orders with us from Sydenham Hill and the surrounding districts.

What Data We Collect

To provide seamless flower delivery services, we collect various types of personal data when you place orders or interact with us. The types of data we collect may include:

• Contact Details: Full name, delivery address, billing address, and contact numbers.
• Order Information: Details of the products purchased, order history, and delivery instructions.
• Payment Information: Payment card details and transaction data. Please note, we do not store your full payment card numbers; they are processed securely by our payment providers.
• Account Credentials (optional): If you create an account, your email address and chosen password.
• Correspondence: Any messages or communications you send to us regarding your order or our services.

Lawful Basis for Processing

We process your personal data based on one or more lawful grounds as required by the GDPR:

• Contractual Necessity: We need your data to fulfil and deliver your flower orders and provide customer support.
• Legal Obligation: Certain data may be processed to comply with legal or regulatory requirements (e.g., tax regulations).
• Legitimate Interests: We may process your data to enhance our products and services, conduct analytics, prevent fraud, or communicate with you about orders and updates.
• Consent: In certain cases, such as marketing communications, we will only use your data if you have provided your explicit consent. You may withdraw your consent at any time.

Data Retention Policy

We retain your personal data only as long as is necessary to fulfil the purposes for which it was collected, including providing our services, complying with legal and accounting requirements, and resolving disputes. The precise retention period depends on several factors:

• Order information is generally retained for up to seven years to comply with accounting and tax obligations.
• User accounts and related information are retained for as long as your account is active. If you deactivate your account, we will delete your personal data unless we are required to retain it for legal reasons.
• Correspondence and support information are typically kept for up to three years after resolution.
• Data used for marketing purposes is stored until you withdraw your consent or unsubscribe.

When data is no longer needed, it is deleted or anonymised securely.

Data Processors and Sharing

We may share your personal data with trusted third-party service providers who assist us in delivering our services. These data processors act on our instructions and in compliance with GDPR:

• Payment Services Providers: To securely process your payments.
• Delivery Couriers: To deliver your orders to the correct address.
• IT and Hosting Providers: To manage our website, databases, and communications.
• Accountancy and Legal Advisors: To comply with financial and regulatory obligations.

We require all our data processors to take appropriate technical and organisational measures to protect your information. We do not sell or rent your data to third parties for commercial purposes. If personal data is transferred outside the UK or EEA, adequate safeguards will be put in place to ensure your rights are protected.

Your Rights Under GDPR

The GDPR grants you a range of rights regarding your personal data that we process:

• Right of Access: You may request a copy of your personal data held by us.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete data.
• Right to Erasure: In certain circumstances, you can request that we delete your data ('right to be forgotten').
• Right to Restriction: You can request we temporarily suspend processing of your data.
• Right to Data Portability: Where applicable, you can request transfer of your data to another service provider.
• Right to Object: You can object to certain types of processing, such as direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise your rights, please contact us using the support methods available on our website. We will respond to your request in accordance with applicable law and within the regulatory timeframe.

Data Security Measures

We implement robust technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, or disclosure. These measures include secure server infrastructure, encryption of sensitive information, access controls, and regular cybersecurity reviews. We also train our staff on data protection obligations and continually review our policies and procedures to ensure your data remains safe.

Updates to This Privacy Policy

We may update this policy periodically to reflect changes to our practices or for legal reasons. We encourage you to review this policy each time you use our services. The date of the most recent update will be indicated at the start of the policy.

Contact and Complaints

If you have any questions about this Privacy Policy, would like to exercise your data protection rights, or wish to raise a complaint about how your data has been handled, please use the contact options provided on our website. If you are not satisfied with our response, you may also contact the UK Information Commissioner’s Office (ICO) for further guidance or to lodge a complaint.