Flower Delivery Hampstead Privacy Policy

Introduction

This Privacy Policy outlines how Flower Delivery Hampstead ('we', 'us', or 'our') collects, uses, stores, and protects your personal data when you place orders with us. It applies to all customers making use of our flower delivery services in Hampstead and surrounding districts, in accordance with the General Data Protection Regulation (GDPR).

What Data We Collect

We collect a range of personal data necessary to provide our flower delivery services, fulfill orders, and enhance customer experience. The categories of data that we may collect include:

• Contact Information: such as your full name, address, telephone number, and any other delivery or billing addresses you may provide.
• Order Details: information about your purchases, including recipient names, delivery messages, and order preferences.
• Payment Information: such as payment card details (processed securely via our payment processors; we do not store card details), billing address, and payment status.
• Identifiers: such as order numbers, customer accounts, or unique tracking references.
• Communication Records: copies of communications between you and us, including emails and customer support requests.
• Website Usage: details relating to your visits to our website, such as IP address, browser type, access times, and pages visited (collected via analytical cookies and tools).

Lawful Basis for Processing Personal Data

Under GDPR, we process your personal data only if we have a valid lawful basis for doing so. The lawful bases relevant to our flower delivery services include:

• Contract: Processing is necessary for the performance of a contract with you (i.e., to process and deliver your flower orders).
• Legal Obligation: We may process data to comply with legal requirements, such as for accounting or fraud prevention purposes.
• Legitimate Interests: For the improvement of our services, communication with customers, and ensuring the security of our website and operations. We always consider your rights and interests when processing under this basis.
• Consent: Where required, for purposes such as marketing communications. You are free to withdraw consent at any time.

How We Use Your Data

Your data is used in the following ways:

• To process and fulfill your order, including delivering flowers to the recipient's address.
• To contact you regarding your order or in response to your queries.
• For payment processing and fraud prevention.
• To comply with our legal obligations.
• To improve our website, products, and customer service.
• For marketing purposes, if you have provided consent.

Retention of Personal Data

We retain your personal data only as long as necessary for the purposes for which it was collected, or as required by law. Typically, we keep order and transaction records for up to seven years to comply with financial and accounting standards. Communication and customer service records may be retained for up to three years from your last interaction with us. When data is no longer required, we securely erase or anonymize it.

Data Processors and Third Parties

In delivering our services, we use trusted third-party service providers (data processors) such as payment processors, delivery couriers, IT service providers, and website analytics firms. These data processors are contractually obliged to process your data securely and in compliance with GDPR, and may only use your data on our instructions.

We do not sell or disclose your personal data to external companies for their own marketing purposes. Where transfers outside the UK or European Economic Area (EEA) are required (for example, for IT support), we ensure appropriate safeguards are in place.

Your Rights Under GDPR

As a customer of Flower Delivery Hampstead, you have several important rights under GDPR. These include:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete data.
• Right to Erasure: In certain circumstances, you may request that your personal data is deleted.
• Right to Restrict Processing: You can request restriction of processing where appropriate.
• Right to Data Portability: Where applicable, you can request the transfer of your data to another provider.
• Right to Object: You can object to certain processing activities, including direct marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw this consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us using the details provided on our website. We will respond to your request within one month, subject to verification of your identity.

How We Protect Your Data

We take data security seriously and have implemented appropriate organisational and technical measures to guard against unauthorised access, loss, or misuse of your personal data. These measures include secure database storage, encrypted website traffic (HTTPS), and regular staff training on data protection.

Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices or to remain compliant with the law. We encourage you to review this policy periodically for any updates. The date of the latest revision will be stated at the top of the policy.

Contact and Complaints

If you have questions or concerns regarding this Privacy Policy or the way your data is processed, please contact us using the details on our website. Should you feel that your data protection rights have not been upheld, you also have the right to lodge a complaint with the relevant supervisory authority.