Privacy Policy: Flower Delivery Sidcup Customers

Privacy Policy Overview

This Privacy Policy outlines how Flower Delivery Sidcup collects, uses, shares, and safeguards the personal information of all customers ordering flower delivery services within Sidcup and the surrounding districts. We are committed to complying with the UK General Data Protection Regulation (GDPR) and ensuring your privacy rights are protected.

Scope of This Policy

This policy applies to all customers who place orders for flower deliveries with Flower Delivery Sidcup, whether via our website, phone, or in person, within Sidcup and neighboring areas. By using our services, you consent to the data practices described here.

Personal Data We Collect

When you place an order with Flower Delivery Sidcup, we collect and process the following categories of personal data as necessary for the purposes described in this policy:

• Identity Data: Name, surname.
• Contact Details: Delivery address, billing address, contact phone number and, where provided, email address.
• Transaction Data: Order history, payment transactions (excluding card details), delivery instructions.
• Recipient Information: Name and address of the person receiving the flowers.
• Communications: Any correspondence, feedback, or complaints you send us.

We do not collect or process special categories of personal data (such as health or biometric data) except where required by law or with your explicit consent.

How and Why We Use Your Data (Lawful Basis)

Under GDPR, we must have at least one lawful basis for processing your personal data. We process your personal information under the following legal grounds:

• Contract: Processing your data is necessary to enter into or perform our contract with you. This includes accepting orders, delivering flowers, and processing payments.
• Legal Obligation: We may process your data to comply with legal and regulatory requirements, for example to maintain transaction records.
• Legitimate Interests: In certain circumstances, we rely on our legitimate interests to improve services, respond to your queries, or to prevent fraud, provided these interests do not override your rights and freedoms.
• Consent: If we send you marketing communications, we do so only with your explicit consent. You can withdraw this consent at any time.

How We Store and Protect Your Data

We implement appropriate technical and organisational safeguards to protect your personal data from unauthorised access, loss, or misuse. These measures include secure databases, access controls, and regular staff training.

Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected:

• Customer Records: We typically keep records for seven years after your last order to comply with accounting, tax, and regulatory requirements.
• Marketing Consent: If you have consented to receive marketing emails or information, we will retain your contact information for that purpose until you unsubscribe or request deletion.
• Complaints and Correspondence: Communications relating to feedback or complaints may be retained for up to three years.

Whenever data is no longer required, it is securely deleted or anonymised.

Third Party Processors

Your data may be shared with trusted third-party service providers who act as data processors on our behalf. These may include:

• Payment providers for secure transaction processing
• Delivery partners responsible for fulfilling your orders
• IT and cloud hosting providers supporting our systems
• Professional advisers (such as accountants or auditors)

All processors are contracted to process your personal data only as instructed by us, keep it secure, and not use it for their own purposes. We do not sell your personal data to third parties.

Your Data Protection Rights

Under the GDPR and UK data protection law, you have a number of rights regarding the personal data we hold about you:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Ask us to delete your data in certain circumstances, for example if it is no longer needed for its original purpose.
• Right to Restrict Processing: Ask us to limit how we process your personal data.
• Right to Object: Object to processing based on our legitimate interests or to direct marketing.
• Right to Data Portability: Request a digital copy of your data so you can move it elsewhere.
• Right to Withdraw Consent: Where we rely on your consent, you may withdraw it at any time.

To exercise your rights, please contact us using the details provided on our website or in store.

International Transfers

We do not routinely transfer your data outside the UK or European Economic Area (EEA). If this ever becomes necessary (for example, if a supplier is based overseas), we ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

Children’s Privacy

Our services are not intended for use by children under the age of 16. We do not knowingly collect or store personal data of children. If you believe we have done so inadvertently, please contact us so we can take appropriate action.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The most current version will always be available on our website. We recommend reviewing this policy periodically.

Contact Details and Complaints

If you have questions, concerns, or wish to exercise your data protection rights, please contact us via the means provided on our website or at our Sidcup premises. If you are dissatisfied with how we manage your data, you also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).