Sidcup Flowers Privacy Policy

Introduction

This Privacy Policy explains how Sidcup Flowers collects, uses, stores, and protects your personal data when you place an order with us as a customer from Sidcup or the surrounding districts. We are committed to respecting your privacy and fulfilling our responsibilities under the UK General Data Protection Regulation (GDPR). This Policy provides clarity on what data we collect, our lawful bases for processing your information, how long we retain your data, the third-party processors we use, and your rights.

Scope of this Policy

This Privacy Policy applies to all customers placing orders with Sidcup Flowers, whether by phone, online, or in person, in Sidcup and the surrounding districts. It covers the collection, use, and protection of your personal data throughout your engagement with our services.

What Data We Collect

When you order from Sidcup Flowers, we may collect and process the following categories of personal data:

Identification Data: Your name and, if applicable, the recipient’s name.
Contact Data: Delivery address, billing address, telephone numbers, and, where provided, email addresses.
Order Details: The products or services purchased, notes for delivery, and order amounts.
Payment Data: Payment method information (we do not retain complete card numbers, but payment processors may store tokens or references to the payment).
Communication Data: Records of communications with us regarding orders or customer service matters.

We do not intentionally collect special categories of personal data (such as health or religious information), nor do we knowingly collect any data related to children.

Lawful Basis for Processing

Sidcup Flowers processes your data under one or more of the following lawful bases:

Performance of a Contract: Most data is processed as it is needed to fulfill your order, arrange delivery, and provide customer service.
Legal Obligations: Some information may be retained or shared to meet statutory requirements, such as accounting, tax, or fraud prevention regulations.
Legitimate Interests: For operational purposes such as improving our services, responding to queries, or handling complaints, where such interests do not override your fundamental rights and freedoms.
Consent: Where we rely on your explicit consent (for instance, for certain marketing communications), you may withdraw it at any time.

Data Retention Periods

Your personal data is retained only for as long as necessary for the purposes for which it was collected and to comply with legal obligations. Our retention practices are as follows:

Order and Contact Data: Kept for up to 7 years after your last order to comply with accounting, tax, and audit requirements.
Payment Data: Transaction tokens or references are retained in line with payment processor policies but we do not have access to your full payment details.
Marketing Communications: If you consent to marketing, your data will be retained until you withdraw consent. Unsubscribing from marketing does not affect transactional communications related to your orders.
Customer Service Records: Communications are retained for up to 3 years after closing the related enquiry or complaint.

Use of Data Processors

To deliver our services, we may use established third-party processors who process data on our behalf. These include:

Payment Processors: For secure payment processing and fraud prevention.
IT and Hosting Providers: For secure hosting of our website, ordering platform, and email systems.
Delivery Partners: For arranging the delivery of flowers and products to your specified address.
Accountancy and Compliance Teams: To meet statutory record-keeping obligations.

All processors are engaged under contract and required to comply with data protection requirements equivalent to those of Sidcup Flowers. Your data is not transferred outside the UK or European Economic Area except where adequate safeguards are in place.

User Rights Under GDPR

Under the GDPR, you have several rights in relation to your personal data:

Right of Access: You have the right to request a copy of your personal data we hold.
Right to Rectification: You can ask us to correct inaccurate or incomplete personal information.
Right to Erasure: Also known as the ‘right to be forgotten’, you may ask for your data to be deleted where it is no longer necessary for the purpose it was collected.
Right to Restrict Processing: You may request we restrict the processing of your data in certain circumstances.
Right to Object: You can object to processing based on legitimate interests or direct marketing.
Right to Data Portability: Where applicable, you may receive your data in a structured, commonly used format for transfer to another provider.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us using the details provided on our website or via our published communication channels. We may need to verify your identity before actioning your request. We strive to respond to all requests within one month.

Security of Your Data

We take appropriate technical and organisational measures to safeguard your personal data, including restricting data access to authorised staff and encrypting personal information during transfer and storage where feasible. In the unlikely event of a data breach, we will follow all statutory reporting and notification procedures.

Policy Updates

This Privacy Policy may be updated from time to time to reflect changes in the law or our data processing practices. Please regularly check our website for the latest version. Continued use of our services indicates acceptance of the current policy terms.

Contact and Complaints

If you have any concerns or complaints regarding your personal data or if you wish to exercise your rights, please reach out using the contact information provided on our official website. Should you feel your data has not been handled in a lawful manner, you may also contact your local supervisory authority.