Flowers Denmark Hill Privacy & Data Policy

Introduction

This Privacy Policy outlines how Flowers Denmark Hill collects, uses, stores, and safeguards your personal data. The policy applies to all individuals placing orders with Flowers Denmark Hill in Denmark Hill and surrounding districts. We are committed to respecting your privacy and ensuring your personal data is handled in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

What Data We Collect

When you place an order or interact with Flowers Denmark Hill, we may collect the following types of personal data:

• Contact Information: Name, delivery address, billing address, and telephone number (where provided by the customer).
• Order Information: Details of your order(s), products purchased, and order history.
• Payment Information: Payment confirmation from our payment processor, though we do not directly store card details.
• Communication Data: Correspondence between you and Flowers Denmark Hill, such as queries or feedback on orders.
• Technical Data: Device IP address, browser type and version, time zone setting, and cookies (when you interact with our website).

Lawful Basis for Processing Personal Data

Under GDPR, we must have a valid lawful basis to process your personal information. The lawful bases we rely on include:

• Contractual Necessity: Processing your data is necessary to fulfill and deliver your flower orders, provide customer service, and update you on your order status.
• Legal Obligation: We may be required to retain certain records for tax, accounting, or other legal requirements.
• Legitimate Interests: To improve our services, prevent fraud, and keep our business secure. We carefully consider your rights and interests before relying on this basis.
• Consent: Where required, we may ask for your explicit consent to use your personal data, such as when sending marketing communications. You may withdraw your consent at any time.

How We Use Your Data

Your personal data may be used for the following purposes:

• Processing and delivering your flower orders
• Sending order confirmations and notifications
• Responding to enquiries, requests, or feedback
• Handling payments and combating fraud
• Complying with legal and regulatory requirements
• Improving our customer service and enhancing your experience

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes it was collected for, including for satisfying legal, accounting, or reporting requirements. Typically, order-related data is kept for up to six years in accordance with legal retention obligations. We regularly review our data retention periods to ensure personal information is not held for longer than needed. If you request deletion of your data, we will securely erase it in accordance with our obligations, unless we are required to retain it for legal or regulatory reasons.

Processors and Data Sharing

To provide our services effectively, we may share your personal data with carefully selected third-party data processors. These include:

• Payment Processors: To securely process payments for your orders
• Delivery Providers: To ensure flowers are delivered to the correct addresses
• IT and System Administrators: Who help maintain and manage our website and ordering systems
• Professional Advisers: Such as accountants and legal advisors where necessary

All processors are contractually required to safeguard your personal data and cannot use it for their own purposes. Flowers Denmark Hill does not sell or rent your data to any third parties. If required by law, we may disclose your data to regulatory authorities or law enforcement.

Your Data Protection Rights

As a customer, you have several rights under the GDPR. These include:

• The Right to Access: You can request a copy of the personal information we hold about you.
• The Right to Rectification: You can ask us to correct or update incomplete or inaccurate data.
• The Right to Erasure: You can request deletion of your data in certain circumstances (also known as the 'right to be forgotten').
• The Right to Restriction: You can ask us to suspend the processing of your personal data.
• The Right to Object: You can object to processing where we rely on legitimate interest or direct marketing.
• The Right to Data Portability: You can request your data be transferred to another service provider, where applicable.
• The Right to Withdraw Consent: Where we rely on your consent, you may withdraw this at any time without affecting the lawfulness of processing before your withdrawal.

We aim to respond to your requests as quickly as possible and, in all cases, within one month. To exercise your rights, please contact us using the contact details provided on our website or in store.

Security of Your Personal Data

We implement appropriate technical and organisational measures to protect your personal information from accidental loss, destruction, misuse, damage, or unauthorised access. This includes restricted access to personal data, secure storage, and regular staff training. However, no method of transmission over the internet is completely secure; we encourage you to keep your own devices protected.

Changes to This Privacy Policy

We keep this policy under regular review and may update it at any time to reflect changes in our practices, service providers, or legal obligations. Any changes will take effect as soon as they are published on our website, so we encourage you to review the policy periodically.

Contact and Complaints

If you have any questions or concerns about how we use your personal data, please get in touch via the contact options listed on our website or in store. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), or your relevant supervisory authority, if you believe your data protection rights have been breached.