Your Data and Florist Sidcup: Privacy Policy

Introduction to Our Privacy Policy

This privacy policy outlines how Florist Sidcup (“we,” “us,” or “our”) collects, processes, stores, and protects personal data provided by customers who place orders in Sidcup and surrounding districts. Our policy ensures compliance with the General Data Protection Regulation (EU 2016/679), known as the GDPR. We are committed to respecting your privacy and safeguarding your personal data at every stage of your interaction with us.

The Data We Collect

When you place an order or interact with Florist Sidcup through our services, we may collect and process the following types of personal data:

• Identity Data: Name, title, and relevant information to verify your identity.
• Contact Data: Delivery address, billing address, contact telephone numbers, and, where appropriate, alternative recipient details.
• Order Data: Product selections, special requests, gift card messages, occasion details, and delivery instructions.
• Payment Data: Transaction details, payment method, and necessary billing information (we do not store card details ourselves; see ‘Processors’ below).
• Technical Data: Device and browser information, IP address, usage logs, and cookies as required for site functionality and security.
• Communication Data: Correspondence or feedback you may provide, including reviews or customer service queries.

We only collect data that is necessary to fulfil your order, support customer service, improve our services, and comply with legal obligations.

Lawful Basis for Processing Your Data

Under GDPR, we must have a legal basis for processing your personal data. Florist Sidcup relies on the following lawful bases:

• Contractual Necessity: Most data is collected and used to fulfil orders placed with us (e.g., arranging delivery, managing your account, and providing customer support).
• Legal Obligation: Some data is retained as required by tax and accounting laws.
• Legitimate Interest: We may use certain information to improve our services, protect against fraud, or defend against legal claims.
• Consent: Where we rely on your consent (such as for optional marketing communications), you may withdraw it at any time without affecting your order.

How We Use Your Data

Your personal information is only used as necessary in relation to your order, including:

• Processing and fulfilling your flower or gift order
• Communicating order confirmations, updates, and responding to enquiries
• Managing payments, refunds, and resolving transactional issues
• Delivering flowers and communicating with delivery personnel
• Meeting applicable accounting, tax, or other legal requirements
• Enhancing our website security, troubleshooting issues, and improving your experience
• Sending marketing only if you have consented to such communications

Data Processors and Third Parties

Florist Sidcup only discloses your data to trusted partners as necessary and contractually required to provide services:

• Payment Service Providers: Secure, PCI-compliant processors handle payments. We do not store your card details.
• Delivery Partners: Recipient details and addresses may be shared with our trusted couriers to fulfil your flower orders efficiently and accurately.
• IT and Hosting Providers: Providers who host our website and maintain our IT infrastructure for secure data storage.
• Professional Advisors: Accountants, auditors, or legal advisors strictly bound by confidentiality obligations.

We do not sell or rent personal data to third parties. All processors and sub-processors must comply with GDPR and our security requirements. Where data is processed outside the UK or EU, we ensure adequacy protections are in place.

Data Retention Policy

Florist Sidcup will retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting obligations. The specific retention periods are:

• Order and Transaction Data: Retained for up to 7 years for legal, tax, and insurance purposes, after which it will be securely deleted or anonymized.
• Communication Records: Emails and messages are typically retained for 2 years unless related to a complaint, legal dispute, or regulatory issue requiring longer storage.
• Marketing Preferences: Retained until you opt out or withdraw consent, at which point related records are promptly deleted or anonymized.

We ensure that your data is securely disposed of or anonymized once its retention is no longer required.

Your Rights Under GDPR

You have several rights under GDPR concerning your personal information held by Florist Sidcup:

• Right of Access: You may request confirmation of the personal data we hold about you and receive a copy.
• Right to Rectification: You can ask us to correct inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where there is no lawful reason for its continued processing.
• Right to Restrict Processing: You can ask us to limit the way we use your data for certain purposes.
• Right to Data Portability: You can request a copy of your personal data in a machine-readable format, or for us to transfer it to another provider where applicable.
• Right to Object: Where processing is based on legitimate interests or direct marketing, you can object at any time.
• Right to Withdraw Consent: If we rely on consent, you may withdraw it at any stage.

Should you wish to exercise your rights, please contact us via the channels provided on our website. For your protection, we may need to verify your identity before fulfilling your request.

Policy Applicability

This privacy policy applies to all customers placing orders with Florist Sidcup from Sidcup and the surrounding districts. It covers all interactions made via our website, telephone, or in-person at our premises, ensuring full transparency regardless of how your order is placed.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in the law or our data processing practices. Please check this page periodically to ensure you are aware of any updates. The date of the latest revision will always be displayed at the top of this document.

Contact and Concerns

If you have questions or concerns regarding this privacy policy or the way Florist Sidcup handles your personal data, please use the contact details provided on our website to get in touch. Additionally, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your data rights have been breached. We encourage you to contact us first to allow us to address your concerns directly.