Customer Privacy and Data Protection Policy

Scope and Policy Statement

This Privacy Policy applies to all customers who place orders with Flowers Highams Park, whether online, over the phone, or in person, across Highams Park and its neighbouring districts. We are committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR) and ensuring transparency regarding how we collect, use, store, and share your information.

Data We Collect

To provide our services and complete your order, we collect the following categories of data:

• Identity Data: Name, delivery recipient’s name
• Contact Data: Address, postcode, phone number
• Order Details: Items ordered, delivery instructions, card messages, order history
• Payment Data: Payment status, transaction references (note: we do not store full payment card details)
• Communication Data: Correspondence related to queries, complaints, updates, or feedback

We do not intentionally collect or process sensitive personal information (special category data) as defined by GDPR, unless you provide this information in communications or order instructions. In such cases, we treat it with enhanced care.

Lawful Basis for Processing

Flowers Highams Park relies on the following lawful bases to process your personal data as permitted by GDPR:

• Contractual Necessity: We process your data to fulfil our contract with you when you place an order (Article 6(1)(b)).
• Legitimate Interests: To improve our services, prevent fraud, address customer complaints, and maintain records, provided our interests do not override your fundamental rights (Article 6(1)(f)).
• Legal Obligation: Certain details may be processed to comply with laws regarding accounting, tax, or law enforcement requests (Article 6(1)(c)).
• Consent: We may occasionally request consent for marketing or feedback. Where consent is relied upon, you may withdraw it at any time.

Purpose of Data Collection and Use

Your information is processed strictly for the following reasons:

• Fulfilling and delivering your order, including communicating with you regarding the process
• Processing payments securely
• Sending service updates, such as delivery notifications or order confirmations
• Processing queries, requests, and complaints
• Maintaining business and financial records according to applicable laws
• Enhancing our services and understanding customer trends (in anonymised or aggregated form, where possible)

Data Retention

We store personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Generally, order and customer data is retained for up to seven years to satisfy tax and business record obligations. Communication data related to queries or complaints may be retained for up to three years after resolution. At the end of the relevant retention period, data is securely deleted or anonymised.

Processors and Third-Party Access

We may engage select third-party service providers ("processors") to assist in fulfilling your order and supporting business operations. Examples include:

• Payment processing providers (to facilitate secure payments)
• Courier or delivery partners (to ensure your order reaches you or your recipient)
• IT and software maintenance providers (to securely host and manage our ordering system)
• Accountants for statutory record-keeping

Where third-party processors are used, they are contractually obliged to handle your data only as instructed, comply with the GDPR, and implement appropriate data security measures.

We do not sell, rent, or trade your personal data. Transfers outside the UK/EEA, if required for technical solutions, are only permitted where adequate protection measures are in place.

Your Data Rights Under GDPR

As a customer, you have the following rights concerning your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data, subject to any legal retention requirements.
• Restriction: Ask for processing to be limited under certain circumstances.
• Data Portability: Request transfer of your data to another controller where technically feasible.
• Object: Object to processing based on legitimate interests or direct marketing.
• Withdraw Consent: Where consent is the basis for processing, you may withdraw it at any time.

To exercise any of these rights, you may contact us using the details provided on our website or ordering platform. For security, we may need to verify your identity before processing your request. We aim to respond within one month, as required by law.

Data Security

We implement appropriate organisational and technical measures to safeguard your personal data against accidental loss, confusion, unauthorised access, alteration, or disclosure. These include restricted access controls, secure storage, and ongoing staff training.

Updates to this Policy

We may update this Policy from time to time to reflect changes in the law or our business practices. The latest version is always available before you place an order, and material changes will be clearly indicated. Your continued use of our services signifies your acceptance of any updates.

Contact and Complaints

If you have questions, concerns, or wish to exercise your rights regarding your personal data, please contact us via the contact details on our website or in-store. If you remain dissatisfied, you may lodge a complaint with the UK Information Commissioner's Office (ICO), which oversees data protection compliance.

Last Updated: June 2024