Flowers St Mary Cray Privacy Policy

About this Privacy Policy

This Privacy Policy describes how Flowers St Mary Cray ('we', 'us', 'our') collects, uses, stores, and safeguards your personal data as part of our flower ordering and delivery service in St Mary Cray and surrounding districts. This policy applies to all customers placing orders with Flowers St Mary Cray, regardless of how orders are placed (including our website, telephone, or in-person orders). We are committed to maintaining the trust and confidence of our customers by ensuring that your personal information is handled responsibly and in compliance with the UK General Data Protection Regulation (GDPR).

What Data We Collect

When you place an order with Flowers St Mary Cray, we may collect and process the following categories of personal data:

• Identity Data: Your name and, where required, proof of identity (for certain transactions).
• Contact Data: Delivery address, billing address, phone number, and in some cases, alternative contact details.
• Order Details: Information about the products you order, recipient details (name and address), delivery instructions, and messages/card notes you include with your order.
• Payment Data: Limited payment information (such as payment method, payment status, and transaction references). Note: We do not store your full card details, as all payment processing is handled securely by our third-party payment processors.
• Communication Data: Correspondence between you and Flowers St Mary Cray, including order confirmations, delivery notifications, complaints, and inquiries.
• Technical Data: If you use our website, we may collect your IP address, browser type, device information, and cookie data for functional and analytical purposes.

Lawful Basis for Processing

We only process your personal data where permitted by law. The principal lawful bases under the GDPR that apply to our activities are:

• Contractual necessity: Processing your personal data is necessary to fulfil our obligations to you—such as taking, confirming, processing, and delivering your order.
• Legitimate interests: We may process certain data for our legitimate business interests, such as improving our services, handling customer queries, or fraud prevention, provided these interests are not overridden by your rights and freedoms.
• Legal obligation: We may process or retain data when required to comply with laws and regulations (for example, for tax or accounting purposes).
• Consent: In specific cases, such as for direct marketing or sending you promotional materials, we will request your explicit consent and you may withdraw this at any time.

How We Use Your Data

Your personal data may be used for the following purposes:

• Processing and fulfilling flower orders and deliveries.
• Communicating order status, responding to queries, and providing customer support.
• Managing payments and refunds.
• Maintaining records for business, accounting, and legal purposes.
• Improving our services and understanding customer needs (using aggregated, non-identifiable data for analysis).
• Contacting you with service-related information or, with your consent, occasional promotions and offers.

Data Retention

Flowers St Mary Cray retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting obligations. The retention periods are determined based on the following criteria:

• Customer and order data are typically retained for up to 6 years to meet accounting and tax requirements.
• Communication and correspondence data may be retained for up to 3 years after the resolution of the query or transaction.
• Data collected for marketing purposes is retained until you withdraw your consent or unsubscribe.
• Technical data and website logs are stored for a limited period, usually 12 months, for security and analytical purposes.

After the applicable retention period, data will be securely deleted or anonymised.

Data Processors and Third Parties

To provide our services, we may share your personal data with trusted third-party service providers who process data on our behalf ('processors'). These include:

• Payment processing providers to securely handle financial transactions.
• IT service providers supporting our website, order management systems, and communications.
• Delivery partners, including couriers, to ensure your flowers are delivered to their destination.

All third-party processors are contractually required to protect your data and act in accordance with the GDPR. We do not sell or rent your personal data to any other organisations.

Where required by law, we may disclose your data to regulatory authorities, law enforcement agencies, or professional advisors.

International Data Transfers

We aim to store and process your data within the United Kingdom and the European Economic Area (EEA). Where it is necessary to transfer personal data outside of these regions—such as where our processors operate internationally—we ensure that appropriate safeguards (such as standard contractual clauses or adequacy decisions) are in place to protect your information.

Your Rights

Under the GDPR, you have a range of rights concerning your personal data, including the right to:

• Access the personal data we hold about you.
• Request rectification of inaccurate or incomplete data.
• Request erasure of your data, subject to certain legal obligations.
• Restrict or object to the processing of your data in certain circumstances.
• Withdraw consent where processing is based on your consent (e.g., marketing communications).
• Request the transfer of your data to another service provider (data portability), where applicable.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your data is not being handled in accordance with the law.

If you wish to exercise any of these rights, please contact us using the details provided on our website or via your usual contact method.

Security of Your Data

Flowers St Mary Cray takes the security of your personal data seriously. We implement appropriate organisational and technical measures to protect data against unauthorised access, loss, misuse, or alteration. This includes secure payment processing, restricted access to systems and data, regular staff training, and data encryption where applicable.

Policy Updates

We may occasionally update this Privacy Policy to reflect changes to our practices, legal requirements, or for other operational reasons. We encourage you to review this Policy periodically for any changes. The date of the latest update will always be shown at the end of the policy.

This Privacy Policy was last updated on 21 June 2024.