Florist Carshalton Privacy Policy

Introduction

This Privacy Policy applies to all customers placing orders with Florist Carshalton, whether you are based in Carshalton or the surrounding districts. We are committed to handling your personal data with respect, transparency, and in accordance with the requirements of the UK General Data Protection Regulation (UK GDPR) and other applicable privacy laws. This document details what information we collect, the purposes and legal bases for processing it, our retention practices, use of data processors, and your rights as a data subject.

Who We Are

Florist Carshalton is a provider of floral products and related services for customers in Carshalton and surrounding areas. Where this policy refers to “we”, “us”, or “our”, it means Florist Carshalton as the data controller responsible for your personal data.

What Data We Collect

When you use our services or place an order, we may collect the following categories of personal data:

• Identity Data: such as your full name and, if provided, details of the recipient.
• Contact Data: including telephone number(s), billing and delivery addresses.
• Order Data: details of your orders, delivery instructions, and purchase history.
• Payment Data: limited payment details necessary to complete your transaction. Your full payment card information is processed securely via our payment processor and is not stored by us.
• Correspondence Data: information contained in any communication with us, whether by phone, text, or online form.
• Technical Data: IP address, browser type, and device identifier, collected as part of standard website operations to facilitate your visit and ensure security, if you use our online platform.

Lawful Basis for Processing Your Data

Our processing of your personal data is based on the following lawful bases under UK GDPR:

• Performance of a Contract: Most of the data we collect is required to fulfil our contract with you when you place an order.
• Legal Obligation: We may process your data to comply with legal requirements, such as record-keeping for tax or regulatory purposes.
• Legitimate Interests: We may process certain data to improve our services, prevent fraud, or respond to your enquiries, where these interests are not overridden by your rights and interests.
• Consent: In specific circumstances, such as for direct marketing by email/text when not covered by soft opt-in rules, we will only process your data with your explicit consent, which can be withdrawn at any time.

How We Use Your Data

We use your personal data for these primary purposes:

• To process and deliver your floral orders, including communicating with you about your purchase and arranging delivery.
• To handle payment and, where necessary, refunds or adjustments.
• To respond to your queries, requests, or complaints.
• To comply with our legal and regulatory obligations.
• For internal business administration, including keeping accurate records of orders and communications.
• To improve our products, services, and customer experience.
• To send you marketing communications about our products or offers, but only if you have provided consent or the law otherwise allows us to do so.

Retention of Your Data

We will keep your personal data only as long as necessary for the purposes set out in this policy. Generally, we retain order and transaction data for up to 6 years for accounting and legal compliance. Where retention is based on consent (for example, marketing communications), your information will be stored until you withdraw consent or request deletion, subject to legal or regulatory requirements. We review our data retention periods regularly to ensure your information is not kept longer than needed.

Use of Processors

We may engage certain third-party service providers (data processors) to perform technical or administrative functions on our behalf, such as:

• Payment processing companies
• Delivery partners or couriers for fulfilling your order
• IT and website support services
• Accountancy or legal service providers, where required

All processors are contractually bound to process your data only in accordance with our instructions, keep it secure, and never use it for their own purposes. We do not sell or share your data with unaffiliated third parties for their own marketing purposes.

How We Protect Your Data

We have appropriate security measures in place to protect your personal data from unauthorized access, loss, misuse, or alteration. Measures include secure storage, encryption for payment transactions, and controlled access to your information by authorized personnel only. We regularly review systems and practices to ensure ongoing data security.

Your Rights Under GDPR

As a data subject, you have the following rights, subject to certain conditions:

• Right of Access: To request access to the personal data we hold about you.
• Right to Rectification: To have incorrect or incomplete data corrected.
• Right to Erasure: To request the deletion of your data, where there is no lawful reason for us to continue processing it.
• Right to Restrict Processing: To request that we restrict the processing of your data under certain circumstances.
• Right to Data Portability: To obtain a copy of your data in a structured, commonly used format.
• Right to Object: To object to processing that is based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where consent is the basis of processing, you can withdraw your consent at any time.
• Right to Complain: If you are concerned about how your data has been handled, you have the right to lodge a complaint with the relevant data protection authority.

Policy Updates

This Privacy Policy may be updated from time to time to reflect changes in our practices, legal obligations, or for operational reasons. When we make significant changes, we will update the revision date at the start of this notice and, where appropriate, inform you via our normal communication channels.

Contacting Us About Your Data

If you have any questions or requests regarding this Privacy Policy or about your personal data, please contact us using the contact methods provided on our main website or in your order confirmation documents.