Our Commitment to Your Privacy at Florists Crystal Palace

Introduction

This Privacy Policy explains how Florists Crystal Palace ('we', 'us', 'our') collects, processes, and protects your personal data when you place an order with us. The policy applies to all customers placing orders from Florists Crystal Palace and the surrounding districts. We are committed to complying with the General Data Protection Regulation (GDPR) and ensuring your privacy is safeguarded.

What Data We Collect

To provide you with our floral services, we may collect and process the following categories of personal data:

• Identity Information: Name, surname, and occasionally company name for corporate clients.
• Contact Details: Delivery address, billing address, and occasionally phone number for delivery purposes.
• Order Details: Items purchased, delivery instructions, messages for cards, and delivery date/time preferences.
• Payment Information: Transaction details for payment processing (note: Payment card data is only processed securely by our external payment service provider—see 'Processors').
• Correspondence: Records of communication if you contact us with an enquiry or to give feedback.
• Technical Data: Your IP address, browser type, and device type (collected via cookies and similar tools when using our website).

Lawful Basis for Processing

We only process your personal data where permitted by GDPR. Our main lawful bases are:

• Contract: Data processing is necessary to fulfil the contract with you (e.g., to deliver your order).
• Legal Obligation: Certain information must be retained to comply with UK tax or accounting laws.
• Legitimate Interests: To pursue our business interests, such as improving our services, enhancing customer experience, or managing our customer relationships. We always balance our interests with your rights and freedoms.
• Consent: For marketing communications, where explicit consent is provided, you have the right to withdraw consent at any time.

How We Use Your Data

Your personal data is used for the following purposes:

• Processing and delivering your orders, including sending order confirmation and updates.
• Fulfilling customer service requests and responding to your queries.
• Managing billing, invoicing, and payments.
• Complying with legal obligations (such as record keeping).
• Improving our products and services based on customer feedback and usage trends.
• Where you have agreed, communicating promotional offers or news.

Retention of Your Data

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, in line with legal, accounting, and reporting requirements. Typically, order and payment records are kept for up to seven years to comply with financial and tax laws. Other data, such as customer correspondence, is kept for up to two years unless a longer retention period is required or permitted by law. Once retention periods expire, your data is securely deleted or anonymised.

Processors and Data Sharing

Florists Crystal Palace takes care in selecting trusted third parties ('processors') who may process your data on our behalf, including:

• Payment service providers: To handle secure payment transactions.
• IT service providers: Offering technical support, hosting, and website management.
• Delivery partners: Assisting in delivering your floral orders.
• Professional advisors: Such as accountants and legal advisors, where necessary.

All processors are required to take appropriate security measures to protect your information and may only use it as instructed by us. We do not sell or rent your personal data to third parties. Personal data may be shared with government authorities if required by law.

User Rights

Under the GDPR, you have the following rights regarding your personal data:

• The Right to Access: You may request a copy of the data we hold about you.
• The Right to Rectification: You may request corrections to any inaccurate or incomplete data.
• The Right to Erasure (The 'Right to be Forgotten'): You can request the deletion of your data under certain circumstances.
• The Right to Restrict Processing: You may ask us to limit processing of your data in certain cases.
• The Right to Data Portability: You can request that we transfer your data to you or another service provider in a structured, commonly used format.
• The Right to Object: You can object to certain types of data processing, such as direct marketing.
• The Right to Withdraw Consent: Where we rely on consent, you can withdraw this at any time.

To exercise any of these rights, please contact us using the details provided on our website. We will respond to all legitimate requests within one month.

Data Security

We take the security of your personal data seriously. Appropriate organizational and technical measures are in place to prevent your data from being lost, used, accessed, altered, or disclosed unlawfully. Access to your data is limited to employees and processors who require it for business purposes. Procedures are in place to deal with suspected data breaches, and we will notify you and regulators where legally required.

International Data Transfers

We generally store and process your personal data within the United Kingdom or the European Economic Area (EEA). Where third-party processors operate outside these locations, we ensure your data is protected by appropriate safeguards, in accordance with GDPR requirements.

Policy Updates

We may update this privacy policy occasionally to reflect changes in how we handle your personal data or to comply with legal requirements. When we make significant changes, we will notify you by updating the policy on our website and indicating the revision date.

Contact and Complaints

If you have any queries about this privacy policy or how your data is processed at Florists Crystal Palace, please contact us via the contact information provided on our website. If you are dissatisfied with how we handle your personal data, you are entitled to lodge a complaint with the UK Information Commissioner’s Office (ICO).