Privacy Policy for Flower Delivery Greenwich

Introduction

This Privacy Policy explains how Flower Delivery Greenwich ("we", "our", or "us") collects, uses, stores, and protects your personal information in compliance with the General Data Protection Regulation (GDPR). It applies to all customers placing orders for flower delivery services in Greenwich and the surrounding districts. We are committed to protecting your privacy and ensuring that your personal data is handled lawfully and transparently.

What Personal Data We Collect

We only collect information that is necessary to provide our services and improve your experience. The personal data we collect may include:

• Contact details: such as your name, delivery address, billing address, and phone number.
• Order information: records of products you order, delivery instructions, and recipient details (if the flowers are for someone else).
• Payment details: transaction information (please note: card details are handled securely via our payment processors and are not stored by us).
• Communication data: any correspondence you send to us, such as feedback, enquiries, or complaints.
• Technical data: such as IP address, browser type, and device information, collected via cookies and similar technologies when you use our website.

We do not collect sensitive personal data unless strictly necessary and with your explicit consent.

Purposes and Lawful Bases for Processing Your Data

We process your personal data for the following purposes and on the corresponding lawful bases under the GDPR:

• Fulfilling your order: We process data such as your name, contact details, and order information to provide and deliver the requested service. Lawful basis: Performance of a contract.
• Processing payments: We transfer payment data to our payment processors to complete your purchase in a secure manner. Lawful basis: Performance of a contract and compliance with legal obligations.
• Customer service: We use your communication data to respond to enquiries, handle complaints, or provide support. Lawful basis: Legitimate interests and performance of a contract.
• Marketing (where applicable): We may send you updates about our services or offers if you have opted in. You can withdraw consent at any time. Lawful basis: Consent.
• Website improvement and security: Technical data helps us protect our website and improve user experience. Lawful basis: Legitimate interests.

How We Share and Disclose Your Data

Your data may be shared with third parties solely for the purposes described in this policy and only as permitted or required by law:

• Service providers: We use trusted processors such as payment gateways, IT service providers, and delivery partners to provide our service efficiently.
• Legal compliance: We may disclose your data when required to comply with legal obligations or respond to lawful requests from authorities.

All third-party processors are contractually bound to GDPR-compliant standards and will only process your personal data on our instructions.

International Transfers

Your personal data is generally stored and processed within the United Kingdom or European Economic Area (EEA). If data must be transferred outside these regions, we ensure it is protected by appropriate safeguards, such as Standard Contractual Clauses or other lawful mechanisms as required by GDPR.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. Specifically:

• Order and transaction records are retained for six years to comply with financial and legal record-keeping obligations.
• Customer correspondence is retained for up to two years for customer service and dispute resolution purposes.
• Data used for marketing is retained until you withdraw consent or opt out.

Once data is no longer needed, it is securely deleted or anonymised.

Your Rights Under GDPR

You have a range of rights concerning your personal data, subject to certain conditions. These include:

• Right to access: You can request a copy of any personal data we hold about you.
• Right to rectification: You can ask us to correct any incomplete or inaccurate data.
• Right to erasure: Also known as ‘the right to be forgotten’; you may request deletion of your data, subject to legal and contractual requirements.
• Right to restrict processing: You may request us to limit how we use your data in certain circumstances.
• Right to object: You may object to certain types of data processing, such as marketing.
• Right to data portability: You can ask for your data to be provided in a structured, commonly used electronic format, or transferred to another provider where feasible.

To exercise any of these rights, please contact us using the methods described on our website. We will process your request in accordance with GDPR requirements. You also have the right to lodge a complaint with the supervisory authority if you believe your data is not being handled properly.

How We Protect Your Data

We have implemented appropriate technical and organisational measures to safeguard your personal information from loss, misuse, unauthorised access, disclosure, or destruction. Examples include encrypted transmission of data, secure storage solutions, access controls, and regular staff training.

Cookies and Website Data

Our website uses cookies and similar technologies to enhance your browsing experience, process orders, and gather analytics. Where required, we will obtain your consent before placing cookies on your device and provide information about how to manage your preferences.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. Updated versions will be posted on our website, with the revision date noted. We encourage you to review this policy periodically.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please use the contact options available on our website. We are committed to responding promptly and assisting you in exercising your rights under GDPR.