Privacy Policy for Flowers High Wycombe Customers

Introduction

This Privacy Policy explains how Flowers High Wycombe ('we', 'us', or 'our') collects, uses, shares, and protects the personal data of customers placing orders from High Wycombe and surrounding districts. We are committed to processing your personal information in line with the UK General Data Protection Regulation (UK GDPR) and other applicable laws, safeguarding your privacy rights at all times.

Scope of this Policy

This policy applies to all customers ordering floral arrangements, gifts, or related services from Flowers High Wycombe, whether online, by phone, or in person, and residing in or placing delivery or pickup orders in High Wycombe and nearby areas. By placing an order, you acknowledge the practices described herein.

Personal Data We Collect

We collect and process various types of personal data necessary to fulfil your order and enhance your experience. The categories of data we collect include:

• Identity Data: Your full name, delivery recipient's name (if different), and title.
• Contact Data: Delivery and billing address, telephone number, and optional contact preferences.
• Order Information: Details of your order, including product choices, instructions, and preferences.
• Payment Details: Payment method, partial information for financial identification (we do not store full card numbers or security codes).
• Communications Data: Any correspondence or communication with us, including complaints or compliments.
• Technical Data: Browser type, device type, IP address, and usage data if you use our website.

Lawful Bases for Processing

Under the UK GDPR, we must have a lawful reason to process your data. Our main purposes and lawful bases include:

• Performance of a Contract: To fulfil your order, process payment, and arrange delivery or collection.
• Legal Obligation: To meet regulatory requirements (for example, recordkeeping for tax or customs purposes).
• Legitimate Interests: To improve our services, prevent fraud, and manage customer relationships (balanced against your rights and freedoms).
• Consent: For certain non-essential communications or marketing, only with your explicit permission.

How We Use Your Information

Your personal information is used solely for:

• Processing and delivering your orders
• Communicating with you about your order status or enquiries
• Improving our products and customer service
• Complying with legal responsibilities
• For marketing communications, if you have opted in

How Long We Keep Your Data (Data Retention)

Your personal data will only be retained for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. In general:

• Order and delivery data is kept for up to 6 years for financial, legal, and tax reasons.
• Communication records may be retained for up to 3 years from closure of a query or complaint.
• Marketing preferences are maintained until you withdraw your consent or request erasure.

Following retention periods, your data will be securely erased or anonymised.

Sharing Your Data with Processors

We use trusted third-parties (‘processors’) to support the processing of your order and delivery. Our data processors may include:

• Payment service providers (to process transactions securely)
• Delivery couriers or agents (to deliver orders to intended recipients)
• IT and website support services (to maintain our systems)
• Cloud hosting platforms (for secure data storage)

All processors act strictly under our instructions and are required by contract to protect your personal data in accordance with GDPR standards. We do not sell your data to third parties and do not permit processors to use your data for their own purposes.

Your Data Protection Rights

You have the following rights regarding your personal information under the UK GDPR:

• Right to Access: Request a copy of the data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure: Request deletion of your data where there is no lawful reason for continued processing.
• Right to Restriction: Request temporary suspension of processing while the accuracy or purpose of processing is verified.
• Right to Object: Object to processing, including for direct marketing purposes.
• Right to Portability: Obtain your data in a structured, commonly used, machine-readable format and (where feasible) transfer to another provider.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw this at any time.

You may exercise these rights by contacting us through the channels provided on our website or order forms. Please note, some rights may be subject to limitations or exemptions under the law.

Protecting Your Information

We implement appropriate security measures to prevent your personal data from being lost, accessed, or disclosed by unauthorised persons. This includes use of secure servers, encryption, restricted access controls, and regular staff training. If a data breach is likely to result in a risk to your rights or freedoms, you will be notified as required by law.

International Data Transfers

Your personal information is stored and processed within the UK or the European Economic Area (EEA). Should data be transferred outside these regions (for example if a cloud provider has a secure international location), we ensure appropriate safeguards and standard contractual clauses are in place under the GDPR.

Policy Updates

We may periodically review and amend this Privacy Policy to reflect changes in legal requirements or operations. The revised policy will apply from the date of publication. You are advised to review this policy occasionally to stay informed.

Contact and Complaints

If you have questions about this Privacy Policy or wish to make a complaint about how your data is handled, please contact us through the methods listed on our website. Furthermore, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been breached.