Crofton Park Florist Customer Privacy Policy

Introduction

This Privacy Policy sets out how Crofton Park Florist collects, processes, stores, and protects your personal data in compliance with the General Data Protection Regulation (GDPR). It applies to all customers who place orders with Crofton Park Florist, whether you are located in Crofton Park itself or in the surrounding districts. Protecting your privacy is a top priority, and we are committed to being transparent about how we handle your data.

What Personal Data We Collect

Crofton Park Florist collects various types of personal data to process your flower orders and provide high-quality customer service. The types of personal information we may collect include:

• Identity Data: Name, surname, and title.
• Contact Data: Delivery address, billing address, phone number (if provided), and postal code.
• Order Details: Products ordered, messages to be included with flowers, preferences, and special instructions.
• Payment Information: Card type and payment authorization details (note: full card numbers are processed securely by payment processors, not stored by us).
• Correspondence: Communication via phone, or written notes accompanying your order.
• Website Usage Data: When you interact with our website, we collect technical data (such as IP address, browser type, and cookies) to ensure a smooth online experience and to improve our services.

Lawful Basis for Collecting and Processing Data

We collect and use your personal data under certain lawful bases set out by the GDPR:

• Contractual Necessity: Most of the data we request is essential for fulfilling your order and entering into a contract to provide you with our products and services.
• Legitimate Interests: We may use your contact details and previous order history to customize your experience, communicate about similar products, and improve our business operations. We will always ensure our interests do not override your rights.
• Legal Obligations: Certain data may be kept or disclosed as required by law (for example, VAT records for HMRC compliance).
• Consent: Where we require consent to process your data (such as for marketing updates), we will ask you first and you may withdraw consent at any time.

Data Retention

We retain your personal data only as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The criteria used to determine retention periods include:

• The duration of our ongoing relationship with you as a customer.
• Legal requirements (such as record-keeping for taxation purposes, typically for 6 years).
• The resolution of any disputes and enforcement of agreements.

After the retention period, your data will be securely deleted or anonymized so that it cannot be linked to you.

Data Sharing with Processors and Third Parties

To provide our services and operate efficiently, Crofton Park Florist may share some of your information with trusted third-party data processors. These include:

• Payment Processors: Secure online payment services who process your payment information on our behalf and in compliance with data protection laws.
• Delivery Partners: Couriers or delivery companies who require basic delivery details to fulfil your order.
• IT Service Providers: Website hosting platforms and email service providers to ensure our services run securely and smoothly.
• Legal Authorities: Where required by law or for the protection of the business.

All third-party processors are required to respect the security of your data and to treat it in accordance with GDPR. They are not permitted to use your data for their own purposes and may only process it pursuant to our instructions and in accordance with this policy.

User Rights under GDPR

Your rights under GDPR are important to us. As a data subject, you have the following rights with respect to your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct or complete any inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): You may ask us to delete your data, subject to legal and contractual obligations.
• Right to Restrict Processing: You have the right to restrict the processing of your information in certain circumstances.
• Right to Data Portability: You may request to receive your data, or have it transferred to another controller, where technically feasible.
• Right to Object: You have the right to object to our processing of your data for direct marketing or where processing is based on legitimate interests.
• Right to Withdraw Consent: Where we rely on your consent, you may withdraw it at any time.

If you wish to exercise any of your rights, please contact us using the details provided on our website or by visiting our shop in person.

How We Protect Your Personal Data

Your data’s security is paramount. We implement a variety of technical and organizational measures to prevent unauthorized access, loss, disclosure, alteration, or destruction of your personal data. This includes using secure servers, encrypted data transmission, restricted access to sensitive information, and staff training on data protection responsibilities.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any significant changes will be communicated to you by appropriate means. Please review this policy regularly to ensure you understand how your data is being managed.

Contact and Further Information

If you have any questions, concerns, or wish to exercise your rights regarding your personal data, you may contact us using the details provided on our website or by visiting our Crofton Park shop. If you are dissatisfied with our response, you may contact the UK Information Commissioner’s Office (ICO) for further assistance.

This policy was last updated on 22 June 2024.