Elm Park Florist Customer Privacy Notice

Introduction

At Elm Park Florist, we are committed to ensuring the privacy and protection of all personal information we collect from our customers. This Privacy Policy outlines how we process your personal data in compliance with the General Data Protection Regulation (GDPR) and applies to all customers placing orders with Elm Park Florist within Elm Park and the surrounding districts.

What Data We Collect

To fulfill your flower orders and provide customer service, Elm Park Florist collects the following categories of personal data:

• Identification Data: Name, delivery address, billing address, and contact information, such as a phone number (if provided) and postal code.
• Order Details: The products and services you purchase, delivery instructions, messages for recipients, and other order-related information.
• Payment Information: Payment details such as transaction amount and method (note: we do not retain your full card details; these are processed securely by our payment processor).
• Communications: Correspondence between you and Elm Park Florist regarding your order or customer service queries.
• Technical Data: Device and website usage information, including IP address, when you use our website to place an order or make an enquiry.

Lawful Basis for Processing Your Personal Data

We only process personal information when we have a legal basis to do so, as set out by the GDPR. Our lawful bases for processing your data include:

• Performance of a Contract: Collecting and processing data necessary to fulfil your order, arrange delivery, and provide associated services.
• Legal Obligations: Retaining certain data for financial and tax record-keeping purposes as required by law.
• Legitimate Interests: Using your data to improve our customer service, prevent fraud, or clarify order issues, provided these interests are not overridden by your data protection rights.
• Consent: We may ask for your explicit consent to send you marketing communications. You may withdraw this consent at any time.

How We Use Your Personal Data

Elm Park Florist uses your personal data for the following purposes:

• Processing and delivering your flower orders.
• Communicating order-related information, updates, or issues.
• Handling payment and processing refunds where applicable.
• Fulfilling our legal obligations concerning record-keeping.
• Improving our products, services, and website functionality.
• On occasion, sending you promotional offers if you have provided consent.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes we collected it for, including any legal, accounting, or reporting requirements. Specifically:

• Order and invoice information is usually retained for six years from the order date, to comply with legal and tax obligations.
• Customer communications and queries are typically retained for up to two years after your last contact, to manage any follow-up or related queries.
• Marketing preference data will be held until you unsubscribe or withdraw your consent.

Once data is no longer required, it is securely deleted or anonymised so it can no longer be associated with you.

Data Processors and Sharing Your Data

We will only share your personal data with third parties where necessary and in accordance with data protection laws. Categories of data processors with whom we may share data include:

• Payment Processors: To securely process your credit or debit card transactions.
• Delivery Partners: To deliver your flower orders to the requested address.
• Website and IT Service Providers: To host and maintain our online store and booking systems.
• Accountants and Professional Advisers: For compliance with accounting, auditing, and legal obligations.
• Law Enforcement: Where required by law or to enforce our terms and conditions, we may disclose information to law enforcement or regulatory bodies.

We do not sell or rent your personal information to any third party.

International Transfers

Elm Park Florist does not intentionally transfer your personal data outside the United Kingdom or European Economic Area. Should a data processor locate data or services outside the EEA, we will ensure appropriate safeguards consistent with the GDPR are in place.

Your Rights as a Customer

Under the GDPR, you have specific rights regarding your personal data:

• Right to Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may ask us to correct any inaccurate or incomplete data.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data.
• Right to Restriction: You may ask us to limit how we use your data in certain circumstances.
• Right to Data Portability: Where applicable, request to receive your personal data in a structured, commonly used format.
• Right to Object: You may object to data processing in specific cases (such as direct marketing).
• Right to Withdraw Consent: If consent is the basis for data processing, you can withdraw it at any time.

To exercise any of these rights, please contact us using the details provided on our website or at our physical location. When you make a request, we may require proof of identity for security reasons.

How We Keep Your Data Secure

Your privacy is important to us, and we take the security of your personal data seriously. We use appropriate administrative, technical, and physical safeguards to prevent accidental loss, theft, unauthorised use, or disclosure of your data. All digital data is stored on secure systems with regular security reviews.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to ensure continued compliance with legal requirements and best practices. Any material changes will be made available on our website and, where appropriate, notified to customers actively.

Contacting Us

If you have any queries regarding this Privacy Policy or the way we handle your data, please contact Elm Park Florist through the methods listed on our website or by visiting our store in Elm Park. You also have the right to make a complaint to the Information Commissioner's Office if you are unhappy with how your data is processed.