Highams Park Florist Privacy Policy

Scope of This Policy

This Privacy Policy outlines how Highams Park Florist collects, uses, stores, and protects your personal data when you place an order with us, whether in Highams Park or neighbouring districts. It applies to all customers making purchases through our services, inclusive of in-person, online, or telephone orders, and explains your rights under the UK General Data Protection Regulation (GDPR).

What Data We Collect

When you interact with Highams Park Florist, we collect information necessary to process and fulfil your order, provide customer support, and comply with legal obligations. The types of data we may collect include:

• Contact Information: Your full name, delivery address, billing address, and telephone number.
• Order Details: Specifics about the products you purchase, delivery instructions, and preferences.
• Payment Information: Payment method details (note: card payment data is processed securely through third-party payment processors and not retained by us).
• Correspondence: Records of any communications with us, including any complaints or general enquiries.
• Recipient Details: Name and delivery information for the person receiving the flowers if you are ordering on someone else's behalf.

Lawful Basis for Processing

Our collection and use of your personal data is permitted under various lawful bases under GDPR. These include:

• Contractual Necessity: In order to fulfil and deliver your order, process your payment, and provide aftercare or customer support, we must process your data.
• Legal Obligation: Certain financial or tax regulations require us to retain basic transaction and customer details.
• Legitimate Interests: We may use your contact information to operate our business, improve our services, and ensure security, provided our interests do not override your rights.
• Consent: Where required (such as for marketing), we will obtain your explicit consent to use your information for specific purposes not covered by the above bases. You can withdraw your consent at any time.

How We Use Your Information

Your personal data may be used for the following purposes:

• To process and deliver your orders accurately and efficiently.
• To communicate with you regarding order updates, delivery status, or to resolve any issues.
• To improve our products and services and understand customer needs.
• To comply with legal and regulatory obligations applicable to our business.
• If you have opted in, to inform you of our promotions, offers, or updates.

Who Processes Your Data

We are committed to safeguarding your personal data. Occasionally, we employ third-party service providers ("processors") to assist in delivering our services. These include:

• Payment processors for secure payment handling.
• Couriers and delivery services for ensuring your orders reach the correct address.
• IT service providers who maintain and troubleshoot our systems.
• Accountants or legal advisors to assist with compliance obligations.

All processors are subject to strict contractual requirements under GDPR regarding the secure handling and deletion or return of your data. We do not sell or rent your personal information to third parties for marketing purposes.

Data Retention

Highams Park Florist only retains customers' personal data for as long as necessary for the purpose for which it was collected and in accordance with relevant laws and regulations. Typically, order and contact data is retained for up to seven years to comply with tax and accounting obligations. Non-essential information, such as order notes, are regularly reviewed and securely deleted when no longer necessary. Any information processed for marketing purposes will be kept until you advise us you no longer wish to receive such communications.

Security of Your Information

We have implemented appropriate physical, technical, and organisational measures to safeguard your personal data from accidental loss, theft, or unauthorised access and usage. Where data is transmitted to third-party processors, we ensure they adhere to high security standards and comply with GDPR.

Your Rights as a Data Subject

You have specific rights under the GDPR regarding your personal data. These include:

• Right of Access – You can request a copy of the personal data we hold about you.
• Right to Rectification – If any data is inaccurate or incomplete, you can ask us to correct it.
• Right to Erasure – You may request the deletion of your data, subject to any legal obligations to retain it.
• Right to Restriction – You may ask us to restrict processing where you have particular concerns.
• Right to Object – You have the right to object to processing based on our legitimate interests or direct marketing.
• Right to Data Portability – Where applicable, you can request your data in a structured, commonly used format for transfer to another provider.
• Right to Withdraw Consent – If processing is based on consent (such as for marketing), you may withdraw your consent at any time.

To exercise any of these rights, you may contact us using the contact information provided at our principal place of business. We will respond to all requests promptly and in accordance with legal requirements.

International Data Transfers

Your personal information is usually processed and stored within the UK or European Economic Area (EEA). If for any reason we need to transfer your data outside the EEA, we will ensure appropriate safeguards are in place in accordance with data protection laws.

Policy Updates

We may update this policy from time to time to reflect changes to our practices or relevant laws. The current version will always be available at our premises and upon request. Significant changes will be brought to your attention where appropriate. By continuing to use our services after changes have been made, you accept those updates.

Contact and Queries

If you have any questions regarding this Privacy Policy or how we process your personal data, you may contact us by visiting our shop at Highams Park or by reaching out via the contact details listed on your receipts or order documentation. Additionally, you have the right to lodge a complaint with the Information Commissioner’s Office if you believe your data has not been managed lawfully.