Florist North Woolwich Privacy Policy

Introduction

This Privacy Policy sets out how Florist North Woolwich ("we", "us", "our") processes and protects personal data belonging to customers who place orders with us from North Woolwich and surrounding districts. We are committed to ensuring that your privacy is protected in accordance with the General Data Protection Regulation (GDPR) and other applicable UK data protection laws.

Scope of This Policy

This Privacy Policy applies to all customers who make use of our products and services, including individuals ordering goods, recipients of our floral arrangements, and users interacting with our website or ordering channels within North Woolwich and neighbouring areas.

What Data We Collect

We collect the following categories of personal data as necessary to process your order and provide our services:

• Identity Data: Your full name and, where relevant, the name of a recipient.
• Contact Data: Delivery address, telephone number, and occasionally your email address if required for order confirmations and communication.
• Order and Transaction Data: Details about the products and services you purchase, any delivery or personal messages, order dates, and payment method (note: we do not store payment card details; these are processed securely by our payment provider).
• Communication Data: Records of your correspondence with us, including queries, feedback, or complaints.
• Technical Data: Limited technical information, such as IP address, browser type, and device information, may be collected if you use our online services, for security and analytics purposes.

Lawful Basis for Processing

Under GDPR, we are required to have a lawful basis for processing your personal data. We collect and process your information only where:

• Contractual Necessity: To fulfil our contract with you and deliver your floral order, we require certain personal information (e.g., to deliver to the correct address, or to communicate regarding your order).
• Legal Obligation: We may process your data to comply with legal requirements, such as accounting, tax, or in response to lawful requests by public authorities.
• Legitimate Interests: We may process your information for our legitimate business interests, such as improving our services, ensuring fraud prevention, or responding to your enquiries, provided your rights and freedoms are not overridden.
• Consent: We seek your explicit consent if we intend to use your data for purposes unrelated to your transaction, such as marketing. You are free to withdraw consent at any time.

Data Retention

We retain personal data only as long as necessary to fulfill the purposes we collected it for, including for the purpose of satisfying any legal, accounting, or reporting requirements. Our typical retention periods are as follows:

• Order and Transaction Data: Up to 6 years to comply with legal and financial record-keeping obligations.
• Contact and Communication Data: Retained for up to 2 years after your last contact unless required longer for legal reasons.
• Technical Data: Retained for up to 1 year for analytics and security monitoring.

At the end of the retention period, your data will be anonymised or securely deleted.

Data Processors and Third Parties

We may share your personal data with trusted third parties ("processors") solely for the purposes of fulfilling your orders and supporting our business operations, including but not limited to:

• Payment service providers to process payments securely
• Delivery and courier services to deliver your floral arrangement
• IT service providers who help maintain and host our systems
• Professional advisors such as accountants and legal counsel for compliance

All processors are contractually obliged to process your data securely and only in accordance with our instructions. We do not sell or rent your personal data to third parties. If required by law, we may share data with government authorities.

International Transfers

Your personal data is stored within the United Kingdom or the European Economic Area (EEA) whenever possible. If we need to transfer your data outside the UK or EEA, we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent mechanisms to ensure your data is protected to GDPR standards.

How We Keep Your Data Secure

We have implemented appropriate technical and organisational security measures to protect your data against accidental loss, alteration, unauthorised access, or disclosure. This includes access controls, encryption where possible, regular staff training, and secure physical and digital storage systems.

Your Rights Under GDPR

As a data subject under GDPR, you have specific rights regarding your personal data:

• Right of Access: You can request a copy of your personal data we hold.
• Right to Rectification: You can request corrections to any incomplete or inaccurate data.
• Right to Erasure ('Right to be Forgotten'): You may ask us to delete your personal data in certain circumstances.
• Right to Restrict Processing: You can ask us to restrict how we use your data.
• Right to Data Portability: You have the right to request your data in a machine-readable format to transmit to another provider.
• Right to Object: You can object to certain processing, including direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time.
• Right to Lodge a Complaint: You can raise concerns with the UK Information Commissioner’s Office (ICO) if you believe your rights have been infringed.

To exercise any of these rights, please contact us via our official channels. We will respond to your request in accordance with GDPR timeframes.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or other factors. The latest version will always be published on our website. We encourage you to review this policy periodically to remain informed about how we protect your privacy.

Contacting Us

If you have questions about this Privacy Policy, how we handle your personal data, or wish to exercise your rights, please contact us via our official communication channels. We are committed to responding promptly and transparently to any enquiries regarding your personal data.