GDPR Privacy Policy for Flowers Thames Ditton Customers

Introduction

This Privacy Policy describes how Flowers Thames Ditton ('we', 'us', or 'our') collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable UK data protection laws. This policy applies to all customers who place orders with Flowers Thames Ditton for delivery in Thames Ditton and the surrounding districts. By using our services, you acknowledge the handling of your personal data as set out in this policy.

What Data We Collect

We collect various types of personal data from customers to process flower orders and provide a seamless service experience. The types of data we collect may include:

• Identity Data: Full name, title, and (if applicable) company name.
• Contact Data: Delivery address, billing address, postcode, town/city, and contact numbers (if provided).
• Order Information: Details about your order, recipient information, card messages, delivery instructions, and special requests.
• Payment Data: Payment methods and transaction details (handled by our payment processor; we do not store card numbers).
• Communication Data: Correspondence, order queries, and any feedback you provide.
• Technical Data: IP address, browser type, device information, and cookies (for visitors to our website, if applicable).

Lawful Basis for Processing Your Data

We process your personal data only when we have a valid legal reason under GDPR. The main lawful bases include:

• Contractual Necessity: Processing is necessary to fulfil your order and deliver flowers as requested.
• Legal Obligations: We may retain records to comply with accounting, tax, or regulatory requirements.
• Legitimate Interests: For customer service, business analysis, fraud prevention, and improving service delivery (provided your rights and interests do not override these interests).
• Consent: When you opt-in to receive marketing communications, we rely on your explicit consent. You can withdraw this consent at any time.

How We Use Your Data

Your data is used for the following purposes:

• Processing and delivering your flower orders.
• Communicating with you about your orders or resolving customer queries.
• Managing payments, refunds, and preventing fraudulent transactions.
• Improving our products, service, and customer experience.
• Complying with our legal and regulatory obligations.
• With your consent, informing you about offers or services via direct marketing.

Data Retention

We retain your personal data only as long as necessary to fulfil the purposes for which it was collected, including for satisfying any legal, accounting, or reporting requirements. Typically, we keep order and transaction data for up to six years to comply with tax and contractual obligations. Communication records and account details may be retained for a shorter duration unless a longer period is required by law or to resolve disputes. Once data is no longer needed, it will be securely deleted or anonymised.

Data Processors and Sharing

We may share your personal data with trusted third parties (processors) to facilitate service delivery, manage payments, and for administrative purposes. These include:

• Payment service providers (to process secure transactions).
• Delivery partners or couriers (to fulfil your order).
• IT and system support partners (for infrastructure maintenance and data storage).
• Professional advisors (accountants, auditors, or legal advisors where required).

All third-party processors are contractually required to protect your data, use it only for specified purposes, and comply with GDPR standards. We do not sell or rent your personal information to any third parties for marketing purposes. Your data will not be transferred outside the UK or European Economic Area unless adequate safeguards and protections exist.

Your Rights Under GDPR

You have important rights under the GDPR regarding your personal data. These include the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct any inaccurate or incomplete information.
• Erasure: Request deletion of your personal data, unless we are required to retain it for legal reasons.
• Restriction: Ask us to suspend processing your data in certain circumstances.
• Objection: Object to processing your data where it is based on our legitimate interests.
• Data Portability: Obtain and reuse your data for your own purposes across different services.
• Withdraw Consent: Withdraw consent for marketing communications at any time.

If you wish to exercise any of your rights or have concerns about how your data is handled, please contact us. We will respond to your request without undue delay, typically within one month.

Information Security

We are committed to safeguarding your personal data. Our technical and organisational measures include:

• Secure storage systems and access controls.
• Procedures to deal with any suspected personal data breach.
• Employee confidentiality obligations and regular staff training.
• Regular security reviews and updates to our systems.

If you have reason to believe that your personal data is at risk, please notify us immediately.

Applicability

This policy applies to all customers placing orders with Flowers Thames Ditton for delivery in Thames Ditton and neighbouring areas, regardless of how orders are placed (online, by phone, or in person). By placing an order, you consent to the processing of your personal data in line with this policy. Our policy may be updated from time to time to reflect legal, regulatory, or operational changes. The current version will always be available upon request.

Contact and Complaints

If you have questions regarding this privacy policy or our data practices, or if you wish to make a complaint, you are encouraged to contact us. If you are not satisfied with our response, you may also contact the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.