Florist Chelsea GDPR-Compliant Privacy Policy

Introduction

Florist Chelsea ("we", "us", "our") is committed to safeguarding the privacy and security of our customers' personal information. This Privacy Policy explains how we collect, handle, store, and protect your personal data in accordance with the UK General Data Protection Regulation (GDPR). This policy applies to all customers placing orders with Florist Chelsea in Chelsea and the surrounding districts.

What Data We Collect

We collect only the necessary personal data required to fulfil our services and enhance your experience. Depending on the nature of your interaction with Florist Chelsea, the types of personal data we may collect include:

• Contact Information: Full name, delivery address, billing address, and contact details such as phone number (optional) and postal code.
• Email Address: To communicate order confirmations, updates, and resolve queries.
• Order Details: Product selections, delivery instructions, and occasion details (such as messages for bouquets).
• Payment Information: Details necessary to process your payments (e.g., method of payment), though we do not store full card details.
• Customer Correspondence: Records of communications via our website or customer service (not including messaging services such as WhatsApp).
• Website Usage Data: IP address, device information, browser data, and cookies as necessary for website functionality and analytics.

Lawful Basis for Processing Your Data

Under the GDPR, we must have a lawful basis to process your personal information. Florist Chelsea processes your data on the following grounds:

• Contractual Necessity: To process and deliver your orders, manage payments, and provide customer support.
• Legal Obligations: To comply with applicable laws, such as retaining certain purchase records for tax and accounting purposes.
• Legitimate Interests: To improve our services, handle customer feedback, and ensure website security, provided these interests are not overridden by your rights.
• Consent: For marketing communications (where applicable). You have the right to withdraw consent at any time.

How We Use Your Personal Data

Your personal data is used exclusively for the following purposes:

• Processing and fulfilling your flower orders.
• Managing customer relationships, including answering order queries.
• Sending transaction-related communications like order confirmations and delivery updates.
• Complying with legal and regulatory obligations.
• Improving our website, services, and customer experience through aggregated website analytics.
• Sending relevant promotions (only where you have provided explicit consent).

Data Retention

We retain your personal data only as long as necessary for the purposes it was collected. Typically, customer order records and related data are stored for up to 6 years to comply with accounting, reporting, and legal obligations. Data collected for marketing purposes will be retained until you withdraw your consent or unsubscribe from our communications. After these periods, data is securely deleted or anonymised.

Data Processors and Third Parties

Where necessary, we share your data with trusted service providers and data processors who assist in delivering our services. These may include:

• Payment processing partners to facilitate secure transactions.
• Delivery companies to ensure successful order deliveries.
• IT and website support providers (for website functionality and hosting).
• Statutory bodies where required for legal or regulatory reasons.

All processors and partners are contractually obliged to handle your data securely, process it only in accordance with our instructions, and comply with GDPR requirements. We do not sell or lease your personal information to third parties for their marketing purposes.

Your Rights under GDPR

As a customer of Florist Chelsea, you are granted several important rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct any inaccurate or incomplete information.
• Right to Erasure: You can request deletion of your data, subject to certain legal requirements.
• Right to Restrict Processing: You can limit how we use your data in certain circumstances.
• Right to Data Portability: You can ask for your data in a machine-readable format for transfer to another service provider.
• Right to Object: You may object to processing based on our legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: If processing is based on your consent, you may withdraw this at any time.
• Right to Lodge a Complaint: You have the right to complain to the Information Commissioner's Office (ICO) if you believe your data is not being handled appropriately.

To exercise any of these rights, please contact us via the methods outlined on our website. We respond to all valid requests within one month, in accordance with GDPR regulations.

Data Security

We use robust technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, or alteration. Secure servers, encryption technology, access controls, and regular reviews ensure your information remains safe with us.

International Data Transfers

Your personal data is primarily processed within the UK. If, in exceptional cases, data is transferred outside the UK or EEA, we have contracts and safeguards in place to ensure your data is treated securely and in accordance with GDPR.

Updates to this Policy

We may update this Privacy Policy from time to time to reflect changes in legal, regulatory, or operational requirements. The most recent version will always be available on our website. Please review it periodically for updates.

Contacting Us

If you have any questions, concerns, or requests regarding your personal data or this Privacy Policy, please refer to the contact details on our website. We are dedicated to addressing data protection matters promptly and transparently.