Florist Epsom Privacy Policy

Introduction

This Privacy Policy explains how Florist Epsom ('we', 'us', 'our') collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (GDPR). This policy applies to all customers placing orders with Florist Epsom in Epsom and surrounding districts. Please read this policy to understand how your information is handled, your legal rights, and how you can exercise those rights.

What Personal Data We Collect

Florist Epsom collects personal data when you interact with us, especially when you place an order for our products and services. The information we collect includes:

• Identity Data: Your name, and where applicable, the name of the recipient of the order.
• Contact Data: Address details for delivery, email address, and telephone number.
• Order Information: Details of the flowers and services requested, delivery instructions, card messages, and any special requests.
• Payment Details: Payment confirmation or transaction identification (we do not store full card numbers or security codes).
• Communication Data: Records of your communications with us, including any customer service requests or feedback.

Lawful Basis for Processing Your Data

Under the GDPR, we are required to have a lawful basis for processing your personal data. Florist Epsom processes your data for the following reasons:

• Contractual Necessity: To fulfill your order, process payments, deliver your flowers and communicate any updates or issues.
• Legitimate Interests: To improve our products, customer service, and the overall shopping experience. We may use feedback and data insights for service enhancement.
• Legal Obligations: To comply with tax, financial, and regulatory requirements.
• Consent: Where we request and receive your explicit permission (for example, for marketing communications not essential to your order).

How We Use Your Data

Your personal data is only used for the purposes specified above. Specifically, this includes processing your orders, arranging delivery, managing payments, and addressing your enquiries or complaints. We may analyze order and communication patterns to improve our business operations, but do not engage in profiling or automated decision-making regarding your personal data.

Retention and Storage of Your Data

Florist Epsom will retain your personal data only as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Typically, we will retain order records, communications, and essential contact information for up to seven years in line with legal obligations. After this period, personal data is securely deleted or anonymised.

Data Processors and Sharing Your Information

We may share your personal data with trusted third-party service providers (also known as data processors) who assist us in delivering our services. Examples of processors include:

• Payment processors: To process your card or online payments securely.
• Delivery partners: To ensure your flowers and gifts are delivered to the correct address.
• IT support and hosting providers: To manage our website, email systems, and order processing platform.

All data processors engaged by Florist Epsom are contractually obliged to safeguard your personal data and act only under our instructions. We do not sell or share personal information with third parties for their marketing purposes.

International Data Transfers

Your data is processed and stored within the United Kingdom or the European Economic Area (EEA). If, in the future, your personal data needs to be transferred outside this area, we will ensure that appropriate safeguards are in place as required by GDPR.

Your Rights Under GDPR

You have clear rights regarding the processing of your personal data under the GDPR. These rights include:

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You may request that we correct any inaccurate or incomplete data.
• Erasure: You have the right to request deletion of your personal data, unless we have a lawful reason to retain it.
• Restriction: Ask us to restrict processing if you contest the accuracy, legitimacy, or necessity of the data use.
• Data Portability: Receive your data in a usable electronic format and have the right to transmit it to another controller.
• Objection: You may object to certain processing activities, such as direct marketing.

If you would like to exercise these rights, please contact us directly. We will respond to your request in accordance with GDPR requirements.

Children's Privacy

Florist Epsom does not knowingly collect personal data from children under the age of 16 without parental consent. If we become aware that such information has been collected, we will take steps to remove it from our records.

How We Protect Your Personal Data

We employ appropriate technical and organisational measures to safeguard your data against loss, theft, and unauthorised access. This includes secure payment processing, encryption where appropriate, staff training, and limited access measures. In the unlikely event of a data breach affecting your data, we will notify you and the relevant authorities as required by law.

Updates to This Privacy Policy

We reserve the right to update or amend this privacy policy from time to time to align with changes in legal requirements or our business practices. The latest version will always be available on our website. We encourage you to review this policy periodically.

Contact and Complaints

If you have questions about this Privacy Policy or your personal data, please use the contact details provided on our website. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) or your local data protection authority if you believe your rights under GDPR have been infringed.