Flowers East Finchley - Privacy Policy

Introduction

This Privacy Policy explains how Flowers East Finchley collects, uses, stores, and protects the personal information of customers placing orders from East Finchley and surrounding districts. We are committed to safeguarding your privacy in line with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Who This Policy Applies To

This policy applies to all individuals who place an order for flowers or related products and services with Flowers East Finchley, whether through our physical shop, by phone, or using our website, and who reside in East Finchley or the surrounding areas. By placing an order, you acknowledge that you have read and understood this Privacy Policy.

What Data We Collect

In the course of providing our services, we may collect and process the following categories of personal data:

• Identity Data: Includes your name, and any recipient’s name, where you are sending flowers to someone else.
• Contact Data: Includes your address, delivery address, and in some cases, limited contact information required to fulfil your order.
• Order Data: Details regarding the products you purchase, delivery instructions, card messages, and preferences.
• Transaction Data: Records of payments made by you and details of completed transactions (payment details are processed through secure third-party payment processors; we do not store card numbers).
• Technical Data: IP address, browser type and device information, if you use our website or online services.
• Correspondence: Copies of any communications (such as inquiries, complaints or feedback) between you and Flowers East Finchley.

Lawful Basis for Processing

We collect and process your personal data only when we have a lawful basis to do so under the GDPR. The applicable lawful bases include:

• Contract: Processing your data is necessary for us to fulfil your floral order, deliver it to you or a third party, and manage related transactions.
• Legal Obligation: Certain records must be maintained for tax, accounting, or regulatory purposes.
• Legitimate Interests: In specific cases, we may process data to pursue our legitimate business purposes, such as preventing fraud or maintaining secure systems, where these are not overridden by your rights.
• Consent: Where we need your explicit consent (for example, to send marketing communications), we will ask for this, and you have the right to withdraw your consent at any time.

How We Use Your Data

We use the personal information that we collect solely for the purposes for which it was provided. This includes to:

• Process and deliver your orders
• Contact you about your order or respond to inquiries
• Maintain records for accounting and taxation as required by law
• Improve our products and services
• Prevent fraud or misuse of our services
• If you have consented, send you information about our products, promotions, or news

Data Retention

Your personal information will only be kept for as long as necessary to fulfil the purposes for which it was collected, including for the purpose of satisfying any legal, accounting or reporting requirements. Typically, order and transaction records are retained for up to 7 years for tax and accounting compliance purposes. After this period, your data will be anonymised or securely deleted.

Data Processors and Sharing

We may use trusted third-party processors to facilitate our services, such as:

• Payment processors to securely handle your transactions
• Delivery and logistics providers to ensure items reach their destination
• IT and system support providers who assist with technical infrastructure

All processors act on our instructions and are required to process your data only for specified purposes. We do not sell, rent, or trade your data to other companies. We will only disclose personal data to other third parties if required to do so by law.

How We Protect Your Data

Flowers East Finchley employs appropriate technical and organisational measures to safeguard your data. These include secure storage solutions, encryption of sensitive data, restricted access controls, and regular reviews of our data protection practices. We also contractually require our processors to implement adequate security measures.

Your Rights under GDPR

As a data subject, you have several rights under the GDPR regarding your personal data. These include:

• Right to Access: You can request a copy of the data we hold about you.
• Right to Rectification: You can ask us to correct any inaccurate or incomplete information.
• Right to Erasure: In certain circumstances, you may ask to have your personal data erased.
• Right to Restrict Processing: You can request we limit the way we use your data in some cases.
• Right to Data Portability: You may request a copy of your data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to certain types of processing, such as direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you are entitled to withdraw it at any time.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in legislation or our data practices. We encourage you to review this policy periodically for the latest information on how your data is being processed.

Contact and Complaints

If you have any questions about this Privacy Policy or how your data is handled, or would like to exercise your rights, you may contact us in writing at our business premises. Details of the business address are available on our website and on order confirmation documents. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK or with your relevant supervisory authority.

This Privacy Policy was last reviewed and updated in June 2024.