Florist Westcombe Park: Privacy Policy Overview

Introduction

This Privacy Policy describes how Florist Westcombe Park collects, uses, shares, and safeguards your personal information. It applies to all customers placing orders with Florist Westcombe Park, whether online, by phone, or in person, for delivery or collection in Westcombe Park and the surrounding districts. We are committed to protecting your privacy in compliance with the UK General Data Protection Regulation (GDPR) and relevant data protection legislation.

What Data We Collect

We collect and process the following categories of personal data about you when you place an order or interact with our services:

• Identity Information: Your first and last name.
• Contact Information: Delivery address, billing address, postcode, and, if provided, your telephone number.
• Order Details: Details of your order, including product selections, messages for flower delivery cards, and delivery instructions.
• Payment Information: Necessary payment details, including transaction references. We do not store your full card details; payment information is handled securely by our chosen payment processor.
• Communications: Records of your correspondence with us, including inquiries, feedback, and complaints.
• Technical Data: When you interact with our website, we may collect anonymised technical information (such as browser type and pages visited) via cookies to enhance user experience.

Our Lawful Basis for Processing Data

Under GDPR, we must have a lawful basis to process your personal information. We rely on the following bases for different activities:

• Performance of a Contract: Most data is collected to process your order, provide related services, deliver flowers, and communicate with you regarding your purchase. Without this data, we cannot fulfil your request.
• Legal Obligations: We process certain data to comply with tax, accounting, and other legal requirements.
• Legitimate Interests: We may use your data for our legitimate business interests, for example, to improve our services, respond to customer queries, and maintain security, provided this does not override your rights.
• Consent: Where required, such as for marketing communications, we will ask for your clear and explicit consent. You may withdraw consent at any time.

How We Use Your Information

Your personal data is used to:

• Process, confirm, and deliver your orders.
• Respond to your questions and communicate updates about your order.
• Facilitate payment via secure third-party payment processors.
• Comply with legal and regulatory requirements.
• Improve our services and customer experience.

Who Processes Your Data

Your personal information is processed primarily by Florist Westcombe Park staff. In some instances, we engage trusted third-party service providers ("processors") to perform functions on our behalf. These include:

• Payment Processors: Securely handling your payment transactions. We do not store or have access to your full card details.
• IT Service Providers: Hosting and supporting our website and systems.
• Delivery Partners: Fulfilling local deliveries, where required.

All processors are required by contract to process your data only as instructed, to keep it secure, and not to use it for their own purposes.

Retention of Personal Data

We retain your personal data only for as long as necessary to fulfil the purposes set out in this policy, including for the purposes of satisfying any legal, accounting, or reporting requirements. Generally, your order information and associated contact details are kept for up to six years, to comply with tax and contractual obligations. After this period, information will be securely deleted or anonymised.

Your Rights Under GDPR

You have several key rights regarding your personal data, subject to certain conditions and exceptions. These include:

• Access: You may request a copy of the personal data we hold about you.
• Rectification: You can ask us to correct any inaccurate or incomplete information.
• Erasure: You may request the deletion of your personal data in certain circumstances, such as where it is no longer needed for the purposes for which it was collected.
• Restriction: You have the right to ask us to restrict processing if you contest its accuracy, the processing is unlawful, or you have objected to the processing.
• Objection: You may object to our processing of your data where we rely on legitimate interests as the lawful basis.
• Data Portability: Where applicable, you can request your data be supplied in a structured, commonly used, and machine-readable format.
• Withdrawal of Consent: If processing is based on consent, you have the right to withdraw your consent at any time.

To exercise your rights, please contact us using the methods detailed at the end of this policy. We may ask you to verify your identity to comply with your request.

Data Security

We take the security of your data seriously, implementing technical and organisational measures to prevent loss, misuse, or unauthorised access. This includes secure servers, encryption technologies, and staff access controls. If a data breach is suspected or confirmed that may affect your rights, we will notify you and relevant authorities as required by law.

International Transfers

Your personal data is generally processed within the UK or European Economic Area (EEA). If we engage third-party processors outside the UK or EEA, we will ensure your data is protected by appropriate safeguards and GDPR-approved mechanisms.

Policy Updates

We may update this Privacy Policy from time to time. Changes will apply immediately after publication and will be made available on our website. We encourage you to review this policy periodically to stay informed about how we protect your data.

Contact and Questions

If you have questions about this Privacy Policy or wish to exercise your GDPR rights, please contact us by writing to our registered business address or by using our online contact form provided on our official website. We will respond to requests as soon as possible and always within statutory time limits.