Upper Norwood Florist Privacy Policy

Introduction

Upper Norwood Florist values your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard information from our customers in Upper Norwood and neighboring districts, in accordance with the UK General Data Protection Regulation (GDPR) and applicable data protection legislation. If you place an order with Upper Norwood Florist, this policy outlines your rights and our responsibilities in handling your personal information.

Scope of this Policy

This Privacy Policy applies to all individuals who place orders with Upper Norwood Florist for delivery or collection within Upper Norwood and the surrounding areas. By placing an order with us, you acknowledge and accept the terms described in this policy.

What Data We Collect

When you place an order, interact with our services, or communicate with us, we may collect the following types of personal data:

• Identity Data: Your name and, if required, the name of the recipient.
• Contact Data: Your address, delivery address, phone number, and, where necessary, other contact details.
• Order Details: Information about the orders you place, including product selections and delivery instructions.
• Payment Information: Transaction details (we do not store full card details).
• Communications: Any correspondence between you and Upper Norwood Florist concerning your order or our services.
• Technical Data: When you interact with our website, limited technical data such as IP address, browser type, operating system, and browsing actions may be collected for service improvement and security.

Lawful Basis for Data Processing

We collect and use your personal data only where we have a lawful basis to do so. The primary lawful bases under the GDPR for Upper Norwood Florist are:

• Contractual Necessity: Processing your data is essential for fulfilling your order, handling payments, and delivering floral products as agreed.
• Legal Obligation: We may be required to retain and process certain information for tax, accounting, or regulatory purposes.
• Legitimate Interests: We may process your personal data for legitimate business interests, such as improving our services, preventing fraud, and maintaining security, provided these interests are not overridden by your fundamental rights.
• Consent: In circumstances where none of the above bases apply, we will seek your explicit consent before processing your data. You may withdraw your consent at any time.

How We Use Your Personal Data

Upper Norwood Florist uses your personal data to:

• Process and fulfill your orders, including payment processing, order confirmation, and delivery arrangements.
• Communicate with you about your orders, deliveries, or customer service requests.
• Comply with legal and regulatory obligations.
• Enhance and personalize our customer service and offerings.
• Prevent and detect fraud or misuse of our services.

How Long We Keep Your Data

Your personal information is retained only for as long as necessary to satisfy the purpose for which it was collected, including any legal, accounting, or reporting requirements. We typically retain order and transaction data for up to 7 years to comply with tax and financial regulations. Where your data is no longer required, it will be securely deleted or anonymized.

Data Sharing and Processors

We respect your privacy and will never sell your personal data. However, for specific purposes, your data may be shared with trusted third-party service providers who act as data processors. These may include:

• Payment Processors: Secure third-party payment gateways that handle payment transactions on our behalf.
• Delivery Services: Couriers or delivery partners who ensure your flowers reach their destination.
• IT Providers: Businesses that maintain our website or manage data storage, strictly for operational purposes.

Any third parties processing your data are required to do so securely, only on our instructions, and in compliance with the GDPR. We do not authorize them to use your data for any other purpose.

Your Rights under the GDPR

As a customer of Upper Norwood Florist, you have the following rights regarding your personal information:

• Right of Access: Request details about the personal data we hold and how we process it.
• Right to Rectification: Ask us to correct any inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, provided no legal basis exists for us to continue processing it.
• Right to Restriction: Request that we limit processing your personal data in certain circumstances.
• Right to Data Portability: Request a copy of your data in a structured, commonly used, and machine-readable format.
• Right to Object: Object to the processing of your data when we rely on legitimate interests as our lawful basis.
• Right to Withdraw Consent: Where we've asked for your consent to process data, you may withdraw that consent at any time.

Security of Your Personal Data

We implement appropriate technical and organisational measures to safeguard your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include secure storage, access controls, and data minimisation practices.

International Data Transfers

Your personal data is stored and processed within the UK or EEA whenever possible. If we need to transfer your data outside these regions, we will ensure that appropriate safeguards, such as standard contractual clauses, are in place to keep your data safe and GDPR-compliant.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in legislation or our business practices. The latest version will always be available at your point of order or upon request. We encourage you to review this policy periodically.

Questions and Exercising Your Rights

If you have questions about this Privacy Policy or wish to exercise any of your GDPR rights in relation to your personal data, please contact us using the contact methods provided when you place your order or through our standard customer service channels. We are committed to responding to all data access and information requests promptly, in accordance with legal requirements.