Flowers Harpenden Privacy Policy

Introduction

This Privacy Policy explains how Flowers Harpenden ('we', 'us', or 'our') collects, uses, discloses, and protects the personal data of customers who place orders with us in Harpenden and the surrounding districts. We are committed to upholding your privacy rights in compliance with the UK General Data Protection Regulation (UK GDPR) and related data protection legislation.

Who This Policy Applies To

This policy applies to all individuals who order flowers directly from Flowers Harpenden within Harpenden and surrounding districts, whether online, by phone, or in person. By placing an order, you acknowledge that you have read and understood this Privacy Policy.

What Personal Data We Collect

When you place an order or interact with Flowers Harpenden, we may collect and process the following types of data:

• Identification details: Your first and last name.
• Contact information: Your delivery address, billing address, and telephone number.
• Recipient details: Name, delivery address, and contact number of the recipient (if different).
• Order information: Details about your purchase, including product selection, messages to include with your flowers, delivery instructions, and special requirements.
• Payment information: Limited payment card details or transaction confirmation when making orders, processed securely via our payment partners.
• Correspondence: Details of your communications with us, including enquiries and complaints.
• Technical data: IP address, and device or browser details when ordering on our website (where applicable).

Our Lawful Bases for Processing Data

We process your personal data only where we have a lawful basis under the UK GDPR. These include:

• Contractual necessity: To process, fulfil, and deliver your orders.
• Legal obligations: Complying with legal and regulatory requirements, such as tax and accounting rules.
• Legitimate interests: Enhancing our services, processing general enquiries, and improving the ordering experience. We balance these interests against your rights and interests.
• Consent: Where we send marketing materials, we seek your prior consent, which you can withdraw at any time.

How We Use Your Data

We use your personal data to:

• Process your orders and arrange deliveries;
• Manage payments and transactions;
• Communicate with you about your orders or queries;
• Respond to your requests or complaints;
• Maintain records for tax and accounting purposes;
• Improve our products, services, and customer experience (using non-identifiable analysis where possible);
• Subject to your preferences, inform you about offers or new products.

Who We Share Your Data With (Processors and Third Parties)

Where necessary, your data may be shared securely with trusted third parties to facilitate our services. These may include:

• Payment processors: To handle payment and card transactions securely.
• Delivery partners or couriers: To ensure flowers reach the correct destination.
• IT and software providers: To maintain our website and order system.
• Professional advisers: Such as accountants or legal advisers for compliance and business management.

All third-party service providers act strictly in accordance with our instructions and data protection requirements. We do not sell or rent your personal data to third parties for their independent marketing.

International Data Transfers

Your personal data is generally stored within the United Kingdom or the European Economic Area (EEA). Where we engage third-party processors outside these regions, appropriate safeguards (such as Standard Contractual Clauses) are in place to protect your data, as required by law.

How Long We Retain Your Data

We retain your personal data only for as long as necessary for the purposes for which it was collected, complying with our legal, accounting, and reporting obligations. Retention periods may vary depending on the type of data and the nature of our relationship with you. Generally, order and transaction data is kept for up to six years to comply with tax and contractual obligations, after which it is securely deleted or anonymised. If you request deletion of your data, some information may be retained where legally necessary.

Your Rights Under GDPR

Under the UK GDPR, you have the following rights regarding your personal data held by Flowers Harpenden:

• Right of access: Obtain a copy of your personal data and related information.
• Right to rectification: Request inaccuracies in your data to be corrected.
• Right to erasure: Ask for your data to be deleted where no longer necessary (subject to legal requirements).
• Right to restrict processing: Request limits on how we use your data.
• Right to data portability: Receive your data in a structured, commonly used format or have it transferred to another supplier.
• Right to object: Object to data processing based on our legitimate interests, or to direct marketing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw this at any time.

To exercise any of these rights, please contact us at our business address or via our website contact form. We will respond to your request in line with legal timeframes. For certain requests, we may need to verify your identity before acting.

How We Protect Your Data

We take appropriate technical and organisational measures to safeguard your personal data, including secure data storage, regular system monitoring, staff training, and restricted access to sensitive information. Where we use third-party processors, these organisations must also commit to adequate data protection standards.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our operations or legal requirements. If significant updates occur, we will provide clear notice at the point of order or by other appropriate means. Please check this policy regularly to stay informed about our data handling practices.

Contact and Complaints

If you have any questions or concerns about this Privacy Policy or our use of your personal data, please contact us by written enquiry to our business address. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.

Policy Effective Date

This Privacy Policy is effective as of June 2024 and applies to all orders placed with Flowers Harpenden from Harpenden and surrounding districts.