Flowers Addington Privacy Information for Customers

Privacy Policy Overview

This Privacy Policy outlines the ways in which Flowers Addington collects, processes, retains, and protects your personal data in compliance with the General Data Protection Regulation (GDPR). It applies to all customers placing orders with Flowers Addington from Addington and the surrounding districts. We are committed to maintaining your privacy and ensuring your information is handled transparently and lawfully.

What Personal Data We Collect

When you place an order or interact with Flowers Addington, we may collect a range of information necessary to fulfil your order and deliver our services. This may include:

• Identity Data: Full name and, if relevant, any alternative names provided for specific delivery instructions.
• Contact Data: Address, delivery address (if different), and area details within Addington and surrounding districts.
• Order Data: Details about the flowers and products you order, card messages, and any additional requests or preferences you specify.
• Payment Data: Limited payment information necessary for transaction processing (such as transaction references). Full payment details are processed securely by our payment processors.
• Correspondence Data: Any communication or feedback provided to us regarding your order or our services.
• Technical Data: Limited information about your device and interaction with our website (such as browser type, device type, and basic log information), primarily for site security and optimization.

We do not intentionally collect or process sensitive personal data (special category data) unless explicitly provided and necessary for the fulfillment of your order.

Lawful Basis for Processing

Flowers Addington processes your personal data on the following lawful bases as outlined in GDPR:

• Contractual Necessity: Processing your data is required to fulfill our contract with you, such as delivering your order to the specified address and contacting you about your order.
• Legal Obligation: We may need to process your information to comply with laws and regulations regarding record-keeping, taxation, or legal compliance.
• Legitimate Interests: We process personal data to enhance our services, respond to your enquiries, manage our business, safeguard our website, and ensure efficient customer service, provided such interests are not overridden by your rights.
• Consent: Where required, we will ask for your explicit consent (for example, for use of personal information in testimonials or optional marketing communications) and you can withdraw consent at any time.

Use and Disclosure of Your Data

Your data is used strictly for the purposes outlined above. We handle your personal data confidentially and do not sell or rent it to third parties. However, for service fulfillment and business operations, selected third parties may have access to your data solely for the following purposes:

• Payment processing and fraud prevention
• Order delivery and logistics support
• IT systems management, website hosting, and security
• Accounting and regulatory compliance

All third-party processors are carefully selected and are contractually obligated to process your data only as instructed, keep it confidential, and ensure GDPR compliance.

Data Retention

Flowers Addington will retain your personal data only as long as is necessary for the purposes for which it was collected, including to meet legal, accounting, or reporting obligations. The standard retention periods are as follows:

• Order, identity, and contact data: Retained for up to seven years to comply with legal and tax regulations.
• Correspondence and enquiry data: Retained for up to three years following the last interaction, unless longer retention is required for dispute resolution.
• Technical and website data: Retained for up to one year from the date of collection for security and service improvement.

Once the retention period expires, your data is securely deleted or anonymised. Where possible, we aim to minimize the amount of data retained.

Our Data Processors

To deliver our goods and services efficiently, Flowers Addington relies on trusted data processors. Examples include payment processors, IT support services, web hosting providers, and delivery partners. Each processor is thoroughly vetted and operates under written agreements requiring strict data protection and security standards as mandated by GDPR.

Personal data is not transferred outside the UK or European Economic Area (EEA) unless adequate safeguards are in place, in line with GDPR requirements.

Your GDPR Rights

Under GDPR, you have multiple rights in relation to your personal data processed by Flowers Addington:

• Right of Access: Request details of the personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal and contractual requirements.
• Right to Restriction: Request restriction of processing in certain circumstances.
• Right to Data Portability: Request a structured, commonly used electronic copy of your data.
• Right to Object: Object to processing based on legitimate interests, especially regarding direct marketing.
• Right to Withdraw Consent: Withdraw your consent at any time where processing is based on consent.

To exercise any of these rights, please contact us using the method provided on our website or by post. We will respond to your request in accordance with GDPR, typically within one month.

How We Protect Your Personal Data

At Flowers Addington, data security is a top priority. We apply reasonable technical and organizational measures to safeguard your information from unauthorized access, loss, misuse, alteration, or disclosure. These measures include secure access controls, encryption where applicable, and regular staff training. Our procedures are reviewed regularly to address any new security threats.

Updates to This Policy

This Privacy Policy may be updated to reflect changes in our practices or legal requirements. The updated policy will always be available to view on our website, and significant changes will be communicated directly when appropriate. The policy is effective as of the date of last review listed at the end of this document.

Contact and Further Information

If you have questions about this Privacy Policy or how your data is handled, please refer to our website for contact details or address your written enquiry to our business premises. Should you wish to raise a concern about data protection, you also have the right to contact your local data protection authority.

Last reviewed: June 2024