Privacy Policy for Customers of Flowers New Eltham

Introduction

This Privacy Policy explains how Flowers New Eltham ("we", "our", "us") collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (GDPR). This policy applies to all customers placing orders with Flowers New Eltham from New Eltham and the surrounding districts. By using our services, you acknowledge and accept the practices described in this policy.

What Data We Collect

To fulfill your order and provide customer service, we may collect the following categories of personal data:

• Identity Data: such as your full name.
• Contact Data: including your address, postcode, and delivery address (if different), as well as any contact details you provide for order confirmation and updates.
• Order Data: such as information regarding the products and services you purchase, recipient’s name and delivery address, and any personalised messages requested for flower cards.
• Payment Information: such as your payment card or account details processed via secure third-party payment processors. We do not store complete payment details.
• Correspondence: including any communication you have with us, for customer support or issue resolution.
• Technical Data: your IP address, browser type and version, time zone settings, and information about how you access and use our website.

Lawful Bases for Processing Your Data

We process your personal data under the following lawful bases as set out in the GDPR:

• Contractual necessity: To process and fulfill your order, deliver products, and communicate regarding your purchases and account.
• Legal obligation: To comply with financial, accounting, or regulatory requirements.
• Legitimate interests: To manage our business, improve our services, prevent fraud, and communicate with you regarding relevant updates, provided these interests are not overridden by your own rights and interests.
• Consent: Where required, we may request your explicit consent for certain uses of your data, such as for marketing communications. You can withdraw your consent at any time.

How We Use Your Data

Your personal data is used for the following purposes:

• To process, deliver, and confirm your orders.
• To manage customer service queries and resolve complaints.
• To fulfill legal and regulatory obligations.
• To improve our website, services, and customer experience.
• To send you updates or relevant offers, where you have consented to receive them.

Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected, to comply with legal or regulatory requirements, resolve disputes, enforce our agreements, or as otherwise described in this policy.

Typically, most order-related personal data is retained for up to seven years, in line with accounting and tax regulations. Data that is no longer required is securely deleted or anonymised.

Data Processors and Third Parties

We use certain trusted external service providers ("processors") to operate aspects of our business and deliver services to you. These processors may include:

• Payment processing companies (for card/online payments).
• Delivery and courier partners.
• IT hosting, maintenance, and web analytics providers.

Where we engage third-party processors, we ensure they adhere to appropriate data security standards and comply with GDPR requirements. We only share information necessary for them to provide their service and do not allow them to use your data for unrelated purposes. We do not sell or rent your personal data to third parties.

Security of Your Personal Data

We implement suitable technical and organizational measures to safeguard your data against accidental loss, theft, unauthorized access, alteration, or disclosure. These measures include data encryption, secure payment systems, access controls, and regular review of our practices.

Your Rights as a Data Subject

Under GDPR, you have specific rights regarding your personal data. These include:

• Right of access: To request a copy of the data we hold about you.
• Right to rectification: To request corrections to inaccurate or incomplete data.
• Right to erasure: To request deletion of your data where there is no lawful basis for retention.
• Right to restriction: To request we limit processing of your data in certain circumstances.
• Right to data portability: To receive your data for transfer to another controller, where technically feasible.
• Right to object: To object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where we process data based solely on your consent, you may withdraw it at any time.

If you wish to exercise any of these rights, please contact us via our usual communication channels. We may require verification of your identity to process your request.

Children’s Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect or process data relating to children without parental consent.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. When we make significant changes, we will indicate this on our website and update the policy revision date. We encourage you to review this policy regularly to stay informed about how we protect your data.

Contact and Further Information

If you have any questions about this Privacy Policy or how Flowers New Eltham handles your personal data, you can reach us through the contact methods provided on our website or your order confirmation documents. We are committed to addressing your queries and ensuring your rights are protected.