Flowers Chislehurst Customer Data Privacy Policy

Who This Privacy Policy Applies To

This Privacy Policy explains how Flowers Chislehurst collects, uses, and safeguards your personal data when you place an order with us. Our policy applies to all customers ordering flowers and related services from Flowers Chislehurst in Chislehurst and surrounding districts. By using our services, you acknowledge that your data will be processed as described in this policy and in accordance with the UK General Data Protection Regulation (GDPR).

What Data We Collect

We collect several types of information in order to fulfill your order and provide an excellent customer experience. The categories of data we collect include:

• Contact Information: Name, address, telephone number, and delivery address (if different).
• Order Information: Details of flowers or products ordered, order notes, delivery instructions, preferred delivery date and time.
• Payment Information: Payment method details (note: we do not store full card numbers or bank details; these are processed securely by our payment partners).
• Communication Data: Any correspondence you have with us relating to your order or our services.
• Technical Data: Device information, browser type, IP address, and cookies when you visit our website.

Lawful Basis for Processing Data

Under the GDPR, we are required to identify a lawful basis for processing your personal data. Our main lawful bases are:

• Contract: To process, fulfill, and deliver your order, including payment processing and after-sales service, we must use your personal data.
• Legal Obligation: We may need to process personal data to comply with legal or regulatory requirements, including record-keeping for tax or accounting purposes.
• Legitimate Interests: In some cases, we may process your data to improve our services, address customer queries, prevent fraud, or market similar services to previous customers. We always ensure your rights and interests are considered in such cases.
• Consent: Where required for marketing unrelated products or newsletters, we seek your explicit consent. You can withdraw your consent at any time.

How We Use Your Data

Your personal data are used strictly for the following purposes:

• Processing and delivering your orders.
• Taking payment and managing refunds where necessary.
• Communicating order updates or delivery information.
• Improving our website, products, and services through user feedback.
• Complying with our legal obligations and protecting our business from fraud or misuse.
• Providing customer service and resolving queries or complaints.

How Long We Retain Your Data

We only keep your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying legal, accounting, or reporting requirements. Generally, order information is retained for up to 7 years to comply with HMRC and tax requirements. Basic contact data may be kept for a similar period unless you request its erasure (see Your Rights below), unless we are otherwise legally obliged to retain it.

Data Processors and Sharing

To operate our business and deliver your products efficiently, we share your data only with trusted data processors and third parties who process data on our behalf. These include:

• Payment Processors: Secure third-party payment providers handle your card or bank payment details. Flowers Chislehurst does not store your full payment information.
• IT and Web Hosting Providers: Our website, order system, and email communications are hosted by reputable technology companies to ensure security and uptime.
• Delivery Partners: When necessary, delivery courier services receive your delivery address and contact details to complete your shipment.
• Professional Advisers: Accountants, auditors, or legal advisers may access data when required for regulatory, tax, or audit purposes.

All data processors act in compliance with our contractual instructions and the GDPR. We do not sell, rent, or trade your personal information.

Security of Your Data

We implement robust physical, technical, and organisational safeguards to protect your information from accidental loss, unauthorised access, or disclosure. This includes secure servers, regular data security reviews, and restricted access to those staff or partners who need it for business purposes only. Where possible, we anonymise or pseudonymise data and regularly evaluate our practices against the latest regulatory requirements.

Your Data Protection Rights

Under the GDPR, you have rights regarding your personal data. These include:

• Right to Access: Request a copy of your personal data held by us.
• Right to Rectification: Ask for corrections to inaccurate or outdated data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal information where it is no longer legally or contractually required.
• Right to Restriction: Ask us to limit or stop processing your data under certain circumstances.
• Right to Data Portability: Request a copy of your data in a structured, commonly used format.
• Right to Object: Object to certain types of processing, such as marketing or profiling, at any time.
• Right to Withdraw Consent: Where consent forms the basis of processing, you can withdraw it at any time.

If you wish to exercise any of your rights, please contact us using the details published on our website or via the shop. We may require verification of your identity before fulfilling requests and aim to respond within one month.

Children's Privacy

Our services are not intended for individuals under 16. We do not knowingly collect or keep information from children. If you believe we have gathered data from anyone under 16, please notify us so we can promptly delete it.

Changes to This Policy

We may update this Privacy Policy at any time to remain compliant with laws and best practice. Updates will be published clearly on our website and apply as soon as they are posted. Please review this policy regularly to stay informed of how we protect your personal information.

Contact and Complaints

If you have queries about this Privacy Policy or would like to make a complaint, please contact us through the channels published on our website or in store. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you feel your rights have not been respected.

This Privacy Policy was last updated in June 2024 and applies to all data processed by Flowers Chislehurst for customers within Chislehurst and its neighbouring districts.