Florists Chiswick Data Privacy Statement

Scope and Application

This Privacy Policy sets out how Florists Chiswick ("we", "us", or "our") collects, uses, and protects the personal information of customers placing orders within Chiswick and its surrounding districts. This policy applies to all individuals who interact with our services, whether browsing, making an enquiry, or placing an order for delivery or collection.

What Data We Collect

When you engage with Florists Chiswick, we may collect and process the following categories of personal data:

• Identification Data: Full name, delivery recipient's name, and title.
• Contact Details: Delivery address, billing address, postcode, and phone number.
• Order Information: Items ordered, order notes (including card message), preferred delivery date and time, and special instructions.
• Payment Details: Card payment data (processed securely by third-party payment processors; we do not store full payment card information).
• Communication Data: Enquiries, feedback, or complaints made through our contact forms or by phone.
• Technical Data: IP address, browser type/version, device identifiers, date/time of interaction, and usage logs related to order placement and website visits.

We generally do not collect or process special categories of personal data (such as health or biometric data) except if you voluntarily provide relevant information in special instructions—for example, allergies or recipient accessibility needs.

Lawful Basis for Processing

We process your personal data in accordance with the UK General Data Protection Regulation (GDPR) and relevant UK data protection law. The main lawful bases for processing your information are:

• Contractual necessity: Processing your data to fulfil orders, provide customer service, and manage payment, delivery, and related administration.
• Legitimate interests: Improving our services, handling enquiries, maintaining security, and preventing fraud, provided such interests are not overridden by your rights and freedoms.
• Legal obligations: Where we are required by law to process or retain certain information, such as for tax or regulatory reasons.
• Consent: In specific cases, for optional marketing communications or where you provide optional data. You may withdraw consent at any time.

How We Use Your Data

Your personal data is used to:

• Process and fulfil your orders, including communicating about order progress and delivering floral products.
• Contact you regarding your order, respond to your queries, or follow up on feedback.
• Handle payment processing and resolve payment-related queries or disputes via secure third-party payment gateways.
• Improve our website, products, and services based on usage analytics and feedback.
• Meet our legal and regulatory obligations, including record-keeping and accounting.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including fulfilling orders, managing our relationship with you, complying with legal, accounting, or reporting requirements, and resolving any potential disputes. Standard retention periods include:

• Order-related data: Kept for up to seven (7) years for tax and regulatory compliance after which it is securely deleted or anonymised.
• Enquiries and feedback: Retained for as long as required to process and resolve your communication, typically no longer than two (2) years.
• Marketing consent data: Retained until you withdraw consent or unsubscribe.
• Technical website data: Retained for no more than twelve (12) months unless required for security or legal purposes.

After expiration of retention periods, data is either securely deleted or anonymised for statistical purposes.

Processors and Data Sharing

We may share and process your data with select third-party processors that support our websites, payment solutions, and delivery operations. These include:

• Payment processors for secure transaction handling (e.g., card payment gateways).
• Delivery service providers who assist in delivering floral orders within Chiswick and nearby areas.
• Website hosting and IT support services to maintain our online platforms and systems.

We ensure all processors are GDPR-compliant and only process your data under our strict instructions. We do not sell or rent your personal data to third parties. Data is not routinely transferred outside the UK or EEA, but where such transfers are necessary (e.g., for technical support), we ensure appropriate safeguards, such as standard contractual clauses or an adequacy decision, are in place.

Security Measures

We implement appropriate organisational and technical measures to protect your data from unauthorised access, loss, destruction, or alteration. These include secure servers, encryption, restricted staff access, and regular data protection training. While we take every reasonable step to protect your data, we cannot guarantee absolute security for information transmitted over the internet.

Your Data Protection Rights

As a data subject under the GDPR, you have the following rights regarding your personal data:

• Access: Request access to personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data in certain circumstances ("right to be forgotten").
• Restriction: Request restriction of processing in specific circumstances.
• Objection: Object to processing based on legitimate interests or direct marketing.
• Data portability: Request a copy of your data in a commonly used digital format for transfer to another provider.
• Withdraw consent: Where processing is based on consent, you may withdraw consent at any time.

If you wish to exercise any of these rights, please contact us via the method provided on our website. We will respond to your request within the statutory timeframes and may require identity verification for security purposes.

Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or our data processing operations. The latest version will always be available on our website, with the date of the most recent revision shown at the end of the policy. We encourage all customers to review this policy periodically.

Contact and Complaints

If you have questions about this Privacy Policy or your personal data, or if you wish to lodge a complaint, please contact us via our website’s contact form or postal address. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your data protection rights have not been upheld.

Last updated: June 2024