Privacy Policy for Flowers Bromley Common Customers

Introduction

At Flowers Bromley Common, we are committed to protecting your personal data and respecting your privacy. This Privacy Policy outlines how we collect, use, store, and safeguard your information in compliance with the UK General Data Protection Regulation (GDPR). It applies to all customers placing orders with Flowers Bromley Common from Bromley Common and the surrounding districts.

What Personal Data We Collect

When you use our services or place an order, we may collect and process the following categories of personal data:

• Identity Information: Name, title.
• Contact Information: Delivery address, billing address, phone number, postal code.
• Order Information: Details of orders placed, delivery instructions, preferred delivery timings, product preferences.
• Payment Information: Payment method (e.g., card type). Please note, we do not store full card details; these are managed securely by our payment processors.
• Correspondence: Emails, written communication regarding your order or enquiries.
• Technical Data: IP addresses, browser type, and other technical information collected via cookies (for website analytics and service improvement).

Lawful Basis for Processing Your Data

We only process your personal data where there is a lawful basis under GDPR. The legitimate bases under which we collect and use your data are:

• Contractual Necessity: To process and deliver your orders and provide related customer service.
• Legal Obligation: To comply with our legal requirements for tax, accounting, and record-keeping purposes.
• Legitimate Interests: To conduct and manage our business, improve our services, and ensure the security of our website and customers.
• Consent: For marketing communications and optional services, where we explicitly request your agreement. You may withdraw your consent at any time.

How We Use Your Personal Data

Your personal data is used to facilitate and fulfil your orders, manage customer accounts, respond to your queries, improve our customer experience, and comply with applicable laws. We may also use your information to notify you of updates, offer promotions (where you have opted-in), or request feedback on our service.

Data Retention

We only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The typical retention periods are:

• Order and customer information: Retained for up to seven years in line with tax and legal compliance.
• Correspondence: Retained for up to three years after your last order or interaction.
• Marketing data: Retained until you unsubscribe or request removal.

At the end of the relevant retention period, your data will be securely deleted or anonymised.

Data Processors and Third Parties

We may share your personal data with trusted third-party service providers ("processors") who assist in processing payments, delivering orders, maintaining our website, or carrying out analytics. These providers act only on our instructions and are contractually obliged to protect your data and not use it for their own purposes. Examples include:

• Payment service providers to enable secure transaction processing.
• Delivery and courier companies to facilitate order delivery.
• IT service providers and hosting companies for website management and data storage.
• Professional advisers such as accountants or legal advisors, only where necessary.

We do not sell or share your personal data with any other third parties for marketing or unrelated purposes. Personal data is not transferred outside the UK or European Economic Area unless appropriate safeguards are in place as required by GDPR.

How We Protect Your Data

We implement appropriate security measures to prevent your personal data from being accidentally lost, accessed, altered, disclosed, or destroyed. These include restricted access to personal data, secure password protocols, regular system monitoring, and staff awareness training. Where data is processed by third parties, we ensure they follow equivalent security standards.

Your Data Protection Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You may ask us to correct or update your information if it is inaccurate or incomplete.
• Right to Erasure: You can request the deletion of your data under certain circumstances.
• Right to Restrict Processing: You may request that we limit how we process your personal information.
• Right to Data Portability: You have the right to request your data be sent to another organisation in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to certain forms of processing, including direct marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time.

To exercise any of these rights, please contact us with your request. We will respond as required by law and endeavour to address your concerns promptly. Proof of identity may be requested for your protection.

Cookies and Website Analytics

Our website may use cookies to enhance your browsing experience, enable core functionalities, and collect aggregate analytics to help us improve our site. You may manage cookie preferences through your browser settings. Where required, consent will be sought before setting any non-essential cookies.

Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect changes in the law, our data processing practices, or service updates. The most current version will always be available on our website, and significant changes will be communicated as appropriate. Continued use of our services after changes indicates your agreement with the revised policy.

Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a complaint, please contact us through the details provided on our website. In addition, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data is not being processed in accordance with the law.

Thank you for trusting Flowers Bromley Common with your personal data. We are dedicated to keeping your information safe and using it responsibly in accordance with the GDPR.