Privacy Policy for Bounds Green Florist Customers

Introduction

This Privacy Policy outlines how Bounds Green Florist (“we”, “us”, or “our”) collects, handles, stores, and protects your personal data. This policy applies to all customers who place orders with Bounds Green Florist, located in Bounds Green and serving customers in the surrounding districts. We are committed to complying with the General Data Protection Regulation (GDPR) and safeguarding your rights by ensuring your information is managed transparently and lawfully.

Personal Data We Collect

We collect various types of personal data from customers to provide and improve our floral products and services. The categories of data we collect include:

• Identification Information: Name, title, and (if applicable) company name
• Contact Details: Delivery address, billing address, telephone number(s), and contact preferences
• Order Information: Details of your order, delivery instructions and recipient information
• Payment Information: Payment card details or transaction references (handled securely via payment processors)
• Communication Records: Correspondence with you, feedback, and customer service enquiries
• Technical Data: IP address, browser type, operating system, and cookies (when you use our website)

Lawful Basis for Processing Personal Data

Our collection and processing of your personal data are based on one or more of the lawful grounds set out in Article 6 of the GDPR:

• Contractual Necessity: Most of your information is processed because it is necessary for the performance of a contract – fulfilling your floral order and delivering requested services.
• Legal Obligation: In certain cases, we are required to process data in compliance with our legal and accounting obligations.
• Legitimate Interests: We process limited data to maintain, improve, and secure our services, and for business analytics, as long as it does not override your rights.
• Consent: Where required, for example, for certain marketing communications, we explicitly seek your consent. You may withdraw your consent at any time.

How We Use Personal Data

Your personal data is used to:

• Process and deliver your orders
• Contact you about your orders or account
• Respond to enquiries or resolve issues
• Improve our products, services, and user experience
• Comply with legal, regulatory, and accounting obligations
• Send you information about our products or promotions, if you have given consent

Data Processors and Third Parties

We use carefully selected third-party service providers (data processors) to help us operate our business and fulfil your orders. These include:

• Payment Processing Services: Securely process card payments and prevent fraud
• IT and Cloud Hosting Services: Support with order management, website hosting, and data storage
• Delivery Partners or Couriers: Ensure timely delivery of floral arrangements to recipients
• Professional Advisors: Accountants, legal counsel, and auditors

All data processors are contractually required to comply with GDPR and process your data only for our specified purposes, following appropriate security measures.

Data Retention Periods

We retain your personal data only for as long as necessary for the purposes stated in this policy, in accordance with applicable laws and regulations:

• Order Information: Kept for up to seven years to comply with tax, legal, and accounting obligations
• Marketing Preferences: Retained until you withdraw consent or unsubscribe
• Customer Service Records: Held for a maximum of two years following the final contact or enquiry
• Technical Data: Stored for up to 26 months for analytic and security purposes

When data is no longer required, it is securely archived, anonymised, or deleted from our systems.

How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data from loss, misuse, unauthorised access, disclosure, alteration, or destruction. This includes secure servers, encryption, access controls, and regular staff training. Access to your data is restricted to those with a legitimate business need.

Your Rights Under GDPR

As a data subject, you have the following rights under GDPR:

• Right of Access: Obtain a copy of your personal data held by us
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Ask for your data to be deleted under certain circumstances
• Right to Restrict Processing: Restrict processing of your data under specified conditions
• Right to Data Portability: Receive your personal data in a structured, commonly used format and have it transferred to another controller where feasible
• Right to Object: Object to processing where we rely on legitimate interests, including direct marketing
• Right to Withdraw Consent: Where processing relies on your consent, you have the right to withdraw it at any time

To exercise any of these rights, please contact us using the details available on our website.

International Transfers

Your personal data is primarily processed within the United Kingdom and the European Economic Area (EEA). If it is necessary to transfer your data to a third country, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or reliance on adequacy decisions in accordance with GDPR requirements.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the ‘last revised’ date at the bottom of this page. We encourage you to review this policy regularly.

Contact and Complaints

If you have any questions about this Privacy Policy or how we handle your personal data, please use the contact information provided on our website. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO), the supervisory authority for data protection issues.

Last revised: June 2024