Florist Orpington Privacy Policy

Introduction

This Privacy Policy explains how Florist Orpington ('we', 'us', 'our') collects, uses, retains, and protects your personal data in compliance with the General Data Protection Regulation (GDPR). This policy covers all customers placing orders with Florist Orpington from Orpington and surrounding districts. Your privacy is of utmost importance to us, and we are committed to managing your personal data transparently and responsibly.

What Data We Collect

When you place an order with Florist Orpington, we collect the following personal data where relevant:

• Contact Information: Name, delivery address, billing address, and telephone number
• Order Details: Products ordered, delivery instructions, messages for recipients
• Payment Information: Limited payment details (e.g., transaction ID and payment method). Please note that full card details are not stored by us but processed securely by our payment processors
• Communication Records: Your correspondence with us, feedback, and queries
• Technical Data: IP address, browser type, device information, and usage data when you interact with our website

We do not collect or process any special category data (such as health information or data revealing racial or ethnic origin) as part of our standard services.

Lawful Basis for Processing

Under the GDPR, we process your personal data using the following lawful bases:

• Performance of a Contract: Processing your order and fulfilling our obligations related to your purchase
• Legal Obligation: Complying with legal requirements, such as keeping records for tax purposes
• Legitimate Interests: Improving our services, handling customer queries, and ensuring the security of our website and systems
• Consent: In cases where you opt-in to receive marketing communications or newsletters, we process your data based on your explicit consent. You may withdraw this consent at any time.

How We Use Your Data

We use your data for the following purposes:

• To process, confirm, and deliver your order
• To communicate with you regarding your order status and any related queries
• To manage payments and issue invoices or receipts
• To enhance our website, services, and customer experience
• To comply with legal obligations and handle disputes or complaints
• To send marketing offers when you have given consent

Retention of Your Data

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Order Information: Retained for up to seven years to satisfy accounting and taxation obligations
• Marketing Data: Retained until you withdraw consent or unsubscribe from communications
• Technical Data: Retained for a period necessary for analytics and security, typically no longer than two years

After these periods, your data will be securely deleted or anonymised.

Processors and Data Sharing

We may share your data with selected third-party service providers ('processors') who support us in delivering our services. These may include:

• Payment processing partners
• Website hosting and IT support providers
• Couriers or delivery services involved in fulfilling your order
• Professional advisors (such as accountants) where legally necessary

All processors are contractually bound to adhere to data protection standards and may only process your personal data based on our instructions. We do not sell or rent your personal data to any third parties for marketing or unrelated purposes.

Your Rights Under GDPR

You have a range of rights under data protection law regarding your personal data. These include the right to:

• Access: Request a copy of your personal data that we hold
• Rectification: Request correction of your personal data if it is inaccurate or incomplete
• Erasure: Request deletion of your personal data under certain circumstances (‘the right to be forgotten’)
• Restriction: Request a halt to the processing of your data under specific conditions while an issue is resolved
• Objection: Object to the processing of your data for direct marketing or on grounds relating to your particular situation
• Portability: Request the transfer of your data to another provider in a machine-readable format
• Withdraw Consent: Withdraw consent at any time where we process your data based on consent (this does not affect data lawfully processed before withdrawal)

To exercise your rights, please get in touch with us through the contact details provided on our website. We will respond to all requests in accordance with GDPR, and within one month.

International Data Transfers

We seek to store and process your data within the UK and the European Economic Area (EEA). If we need to transfer your data outside of these areas for specific services, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

Security of Your Data

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse. These include secure servers, firewalls, encryption technologies, and staff training. Despite our best efforts, no system is completely secure; therefore, we cannot guarantee absolute security of your data but remain committed to maintaining the highest reasonable standards.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal obligations. The updated policy will be published on our website. We recommend revisiting this page periodically to stay informed of how we protect your data.

Contact and Complaints

If you have questions or concerns about this Privacy Policy or how we handle your personal data, please use the contact options provided on our website. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) or your local supervisory authority if you believe your data has not been processed in line with the law.