Privacy Policy for Flower Delivery Uxbridge Orders
Introduction
This Privacy Policy describes how Flower Delivery Uxbridge processes personal data of individuals placing flower delivery orders in Uxbridge and surrounding districts. We are committed to safeguarding your privacy and ensuring that your information is protected in accordance with the General Data Protection Regulation (GDPR).
Scope of Policy
This policy applies to all customers who place orders with Flower Delivery Uxbridge for delivery within Uxbridge and the neighbouring areas. By using our services, you acknowledge and agree to the terms of this Privacy Policy as set out below.
Types of Data Collected
When you place an order with Flower Delivery Uxbridge, we collect the minimum information necessary to process and deliver your order effectively. The types of personal data collected include:
- Contact Information: Such as your full name, delivery address, billing address, and occasionally a contact number for delivery purposes.
- Order Details: Products ordered, gift messages, recipient details (including recipient name and address), and any special instructions provided.
- Payment Information: Details required to complete payment. However, we do not store full card payment details. Payment is handled via secure payment processors.
- Communication Data: Correspondence relating to order queries, complaints, or customer service requests.
- Technical Data: Such as IP address, browser type, and device information, collected through our website for security and analytics.
Lawful Basis for Processing Personal Data
We process your personal data on the following lawful grounds as defined in the GDPR:
- Contractual Necessity: Processing is necessary to fulfil our contract with you, including order processing, delivery, and customer communication.
- Legal Obligation: In certain situations, we are required to process your personal data to fulfil our legal and regulatory duties (e.g., financial record keeping).
- Legitimate Interests: Where processing is necessary for the legitimate interests of improving our services, preventing fraud, or ensuring network and information security. We always balance these interests with your fundamental rights and freedoms.
- Consent: In specific cases, such as for direct marketing communications (if applicable), your data is processed only after obtaining your explicit consent. You have the right to withdraw your consent at any time.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, including satisfying legal, accounting, or reporting requirements. Typically:
- Order information and related communication are retained for up to 7 years to meet tax and accounting obligations.
- Technical and analytical data may be stored for a shorter period, in accordance with our website analytics policies.
After these periods, your data is securely deleted or anonymised so it can no longer be associated with you.
Use of Data Processors
We may work with third-party service providers (data processors) who help us deliver our services, such as:
- Payment Processors: Securely handle payment transactions and card processing. We never have access to your full card details.
- Delivery Partners: Assist with shipping and delivery of your orders, using only the information needed to complete the delivery.
- IT and Website Hosts: Provide website hosting, maintenance, and security services.
- Analytics Providers: Help us monitor website usage and service quality.
All processors are engaged under contracts that require them to protect your data in compliance with GDPR, and never use your data for their own purposes. Where processors are located outside the UK or EEA, we implement appropriate safeguards such as standard contractual clauses.
User Rights Under GDPR
As a customer, you have the following rights regarding your personal data:
- Right to Access: Request confirmation of whether we hold your personal data, and access to that data.
- Right to Rectification: Request correction or completion of your personal data if it is inaccurate or incomplete.
- Right to Erasure: Request the deletion of your personal data in certain circumstances, such as when it is no longer needed for the purposes collected.
- Right to Restriction: Request that we limit the processing of your personal data in certain cases.
- Right to Data Portability: Request a copy of your personal data in a structured, commonly used, and machine-readable format.
- Right to Object: Object to processing of your data where processing is based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Withdraw consent for processing where processing is based on consent. This will not affect the lawfulness of processing before withdrawal.
To exercise these rights, you may contact us using the contact options provided on our website or in your order documentation. We may require verification of your identity to respond to your requests.
Data Security
We implement appropriate technical and organisational measures to safeguard your personal data against accidental loss, unauthorised access, or disclosure. This includes using secure servers, encryption protocols, restricted access to personal data, and regular staff training in data protection best practices.
Children's Privacy
Our services are not directed at children under the age of 16. We do not knowingly collect or process personal data from children. If we become aware we have inadvertently processed data of a child, we will take steps to erase such data promptly.
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in regulatory requirements or our internal practices. Any changes will be posted on our website with the updated effective date. We encourage you to review the policy periodically.
Contact and Further Information
If you have questions or concerns regarding this Privacy Policy, or wish to exercise any of your GDPR rights, please refer to the contact details provided on our website. We are committed to resolving any issues in a fair and timely manner.
This policy was last updated on: 1 June 2024.
