Flowers Kingston Privacy Policy Overview

Introduction

This Privacy Policy outlines how Flowers Kingston collects, uses, stores, and protects your personal data as a customer placing orders from Kingston and the surrounding districts. We are committed to maintaining your privacy and ensuring your data is handled in compliance with the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Scope of This Policy

This Privacy Policy applies to all customers who place orders with Flowers Kingston, either online, by phone, or in person, for delivery or collection within Kingston and its surrounding districts. By placing an order, you acknowledge and accept the practices described herein.

What Personal Data We Collect

To process orders effectively and provide a high level of service, Flowers Kingston collects the following types of personal data:

• Contact Information: Name, delivery address, email address, and phone number.
• Order Information: Details of your order, recipient details for deliveries, messages for cards, and delivery instructions.
• Payment Information: Payment confirmation data (note: we do not store full payment card numbers or security codes, but payment processors may handle this information securely on our behalf).
• Correspondence: Details of interactions with our customer service, including queries, complaints, and feedback.
• Technical Data: IP address, browser type, device information, and usage data when you interact with our website.

Lawful Basis for Processing Your Data

We process your data under one or more of the following lawful bases as outlined in the GDPR:

• Contract: Processing is necessary for us to fulfil your order and provide agreed upon services.
• Legal Obligation: Retaining certain transaction records for tax and accounting compliance.
• Legitimate Interests: Improving our services and ensuring efficient delivery, whilst not overriding your fundamental rights.
• Consent: For marketing communications, where required, we will only do so with your explicit consent.

How We Use Your Data

Your personal data is used strictly for the following purposes:

• Processing and fulfilling your flower orders.
• Arranging deliveries to specified recipients and addresses.
• Communicating with you regarding your order and responding to your queries.
• Improving and personalising our products and services.
• Carrying out fraud prevention and security checks.
• Complying with legal obligations and resolve any disputes.
• Sending you marketing information, with your consent.

Data Processors and Third Parties

To facilitate our services, we may need to share your information with various trusted third-party processors, but only to the extent necessary for their role. Examples of processors include:

• Payment Processors: Securely handling your payment information.
• Delivery Partners: Assisting with the direct delivery of flowers to you or your nominated recipient.
• IT Service Providers: Hosting our website, providing security, and managing our internal systems.
• Professional Advisors: Accountants, legal advisors, or auditors acting as data processors or joint controllers where appropriate.

All data processors are contractually bound to process your data only as instructed by us, keep it confidential, and comply fully with GDPR requirements.

Data Retention

We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting obligations. Typically, we keep order records and contact information for up to seven years, in line with tax and legal requirements. Where your information is no longer needed, it will be securely deleted or anonymised.

User Rights Under GDPR

Under the UK GDPR, you have several rights in relation to your personal data:

• Right of Access: You can request details of the personal data we hold about you.
• Right to Rectification: You have the right to have inaccurate or incomplete data corrected.
• Right to Erasure: You may request deletion of your personal data, subject to certain legal exceptions.
• Right to Restrict Processing: In some circumstances, you may ask us to restrict how we use your personal data.
• Right to Data Portability: Request your personal data in a machine-readable format or for us to provide it directly to another organisation.
• Right to Object: You may object to the processing of your data based on legitimate interests or direct marketing.
• Right to Withdraw Consent: If processing is based on your consent, you can withdraw it at any time.

To exercise any of these rights, please contact us using the methods outlined on our website or through written request.

Data Security

We take the security of your data seriously, implementing physical, technical, and organisational safeguards to protect it from unauthorised access, loss, or alteration. All access to personal data is strictly limited to those employees and partners who need it to process orders or provide services.

International Data Transfers

Your data is primarily processed and stored within the United Kingdom or the European Economic Area. Where your data may be transferred outside these regions, such as for certain cloud-based services, we ensure adequate protection is in place, such as standard contractual clauses.

Changes to This Policy

This Privacy Policy may be updated to reflect changes in legal or regulatory requirements or our business operations. We encourage you to review this notice regularly to stay informed of how we protect your information.

Contact and Complaints

If you have questions about this policy or wish to raise a concern, you can reach out via the contact methods provided on our website or in writing to our business premises. You also have the right to lodge a complaint with the UK Information Commissioner's Office if you believe your data protection rights have been violated.