Privacy Policy for Carshalton Flowers Customers

Introduction

This Privacy Policy explains how Carshalton Flowers (“we”, “us”, “our”) collects, processes, and protects the personal data of individuals who place orders with us. This policy applies to all customers placing Carshalton Flowers orders from Carshalton and the surrounding districts. We are committed to safeguarding your privacy and handling your personal information in a lawful and transparent manner, complying with the UK General Data Protection Regulation (GDPR).

What Data We Collect

When you place an order with Carshalton Flowers, we collect and process a range of personal data as necessary to fulfil our services. The types of data we may collect include:

• Contact Information: such as your name, delivery address, billing address, and telephone number.
• Order Details: including order contents, recipient name and address (if different), card messages, and delivery preferences.
• Payment Information: basic payment details, such as payment method (note: payment processing details are managed by external payment processors and Carshalton Flowers does not store full card details).
• Communications: any correspondence with us, including queries, feedback, or complaints.
• Website Usage Data: segmented information such as IP address, device type, and browsing actions, collected through standard website analytics.

Lawful Basis for Processing Your Data

Under the GDPR, Carshalton Flowers must have a legal basis to process your personal data. We rely on one or more of the following bases:

• Contractual Necessity: The majority of the data we collect is necessary to enter into and perform our contract with you, such as processing and delivering your flower order.
• Legal Obligation: Certain processing activities are required to comply with legal or regulatory obligations, including record-keeping and accounting rules.
• Legitimate Interests: We may process data to improve our website, services, and customer experience, as long as these activities do not override your rights and freedoms.
• Consent: For certain marketing communications, we will ask for your explicit consent, which you may withdraw at any time.

How We Use Your Personal Data

We process your personal data only for specified purposes and to the extent necessary. These purposes include:

• Processing and fulfilling your flower orders, including contact and delivery information.
• Communicating with you regarding your order, delivery updates, or customer service queries.
• Managing payments and refunds via secure payment processors.
• Keeping records for tax and accounting compliance.
• Enhancing our website and service offerings through analytics.
• Sending promotional material if you have given your consent to receive marketing communications.

How Long We Retain Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, as well as to meet legal, tax, or accounting requirements. Typically, we retain customer order information for up to seven years to meet legal obligations relating to financial record-keeping. Data used for marketing purposes is held until you withdraw consent or request deletion.

Who Processes or Has Access to Your Data

We take appropriate measures to ensure your information is secure and only accessible to authorised personnel. In order to operate efficiently, we may share your data with trusted third-party service providers (processors), each of whom are contractually bound to handle your data only in accordance with our instructions and GDPR requirements. These may include:

• Payment Processors: Handle your payment securely; Carshalton Flowers does not store your card details.
• Delivery Partners: Required to fulfil your delivery; recipient information may be shared for this purpose.
• IT and System Providers: Support our online ordering system, customer database, and website analytics.

We do not sell or rent your personal data to any third parties for marketing or other purposes.

Your Data Rights

Under the GDPR, you have the following rights in relation to your personal data:

• The right to access: You can request a copy of the personal data we hold about you.
• The right to rectification: If you believe your data is inaccurate or incomplete, you can ask us to correct it.
• The right to erasure: You can request that we delete your personal data where lawful and applicable.
• The right to restrict processing: You can request limits on how we use your data in certain circumstances.
• The right to object: You can object to processing based on our legitimate interests or for direct marketing.
• The right to data portability: Where processing is based on consent or contract, you can request your data in a machine-readable format.
• The right to withdraw consent: Where processing is based on your consent (e.g., for marketing), you have the right to withdraw it at any time.

To exercise your rights or for any queries about your personal information, you may contact us using the details provided on our website or by post.

How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. This includes secure servers, restricted access, staff training, and the use of trusted, GDPR-compliant processors.

Policy Updates

We may update this Privacy Policy from time to time to reflect legal, regulatory, or operational changes. We encourage you to review this page periodically for the latest information about our privacy practices. This policy was most recently updated in June 2024.

Contact and Complaints

If you have any concerns about how we handle your personal data, please contact us directly. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK.

Thank you for placing your trust in Carshalton Flowers. We are committed to protecting your data and your privacy.