Privacy Policy for Flower Delivery Hoddesdon Customers

Scope of This Privacy Policy

This Privacy Policy describes how Flower Delivery Hoddesdon ("we", "us", or "our") handles the personal data of customers placing flower delivery orders in Hoddesdon and the surrounding districts. We are committed to protecting your privacy and ensuring the lawful and transparent use of your information, in line with the General Data Protection Regulation (GDPR).

Data We Collect

We collect a range of personal data to process and fulfill your orders, provide customer service, and improve our services. Depending on your interactions with us, the types of personal data we collect may include:

• Identity Information: Your name, and (if applicable) recipient’s name.
• Contact Details: Address, delivery address, telephone number (if provided), and any instructions needed for delivery.
• Order Information: Details of your order, payment method (but not your full payment card details as these are processed securely by our payment processor), order preferences, and any messages you include for the recipient.
• Transaction Data: Details about payments to and from you, and details about products and services you have purchased from us.
• Correspondence: Any information you provide when contacting our customer service.
• Technical Data: IP address, browser type and version, time zone setting, and location (collected if you interact with our website).

Lawful Basis for Processing

Under GDPR, we are required to identify a legal basis for collecting and processing your personal data. For Flower Delivery Hoddesdon, these include:

• Contractual Necessity: To process and deliver your order, provide customer service, and handle returns or refunds, we must collect and use your data.
• Legitimate Interests: We may use your information for purposes such as improving and personalizing our services, unless your interests or fundamental rights override these interests.
• Legal Obligation: Certain information may be required to fulfil our legal or regulatory responsibilities.
• Consent: Where required (for example, for some forms of marketing), we will only process your data if you have given consent. You have the right to withdraw your consent at any time.

How We Use Your Data

Your personal data is used for the following purposes:

• Processing and delivering your flower order
• Managing payments and refunds
• Providing customer service and responding to your queries
• Contacting you regarding your order status
• Improving our services and for internal record-keeping
• Complying with our legal obligations

How Long We Retain Your Data

We retain your personal data only as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. In most cases, your data will be retained for a period consistent with our need to respond to any queries or complaints and to comply with our legal obligations (usually a maximum of 7 years after your order has been fulfilled). After that, your data is securely deleted or anonymised so it can no longer be associated with you.

Processors and Data Sharing

To deliver our services, we use third-party service providers ("processors") who act on our behalf. These may include:

• Payment processors for handling transactions securely
• IT service providers who assist with website hosting and maintenance
• Delivery partners who may deliver flowers on our behalf in Hoddesdon and nearby areas

All processors are contractually bound to protect your data in compliance with GDPR. We do not sell or rent your data to third parties. We may disclose your information where required by applicable law or to protect our legal rights.

Your Privacy Rights

Under GDPR, you have several important rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request corrections to any inaccurate or incomplete data we hold about you.
• Right to Erasure: In certain circumstances, you may request deletion of your personal data.
• Right to Restrict Processing: You may ask us to restrict how we process your data in certain situations.
• Right to Object: You may object to our processing of your personal data based on our legitimate interests or for direct marketing purposes.
• Right to Data Portability: You may request to receive your data in a structured, commonly used, and machine-readable format, or for us to transfer it to another data controller.
• Right to Withdraw Consent: Where we process your data based on consent, you have the right to withdraw this at any time.

We will always endeavour to respond to any requests within one month, in line with GDPR requirements.

Security of Your Data

We take appropriate measures to ensure your personal data is kept secure and confidential, to prevent unauthorised access, disclosure, alteration, or destruction of your information. These include encryption, secure storage, and regular reviews of our security measures. Access to your data is strictly limited to those employees, agents, and processors who need it to provide our services.

International Data Transfers

Your personal data is ordinarily stored within the United Kingdom or European Economic Area (EEA). If in the course of providing our services, any data is transferred outside the EEA, we ensure appropriate safeguards are in place as required by GDPR, such as using approved Standard Contractual Clauses or ensuring the recipient is in a country deemed adequate by the European Commission.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or otherwise. We encourage you to check this page periodically so you are aware of how your data is being handled.

How to Raise a Concern

If you have any concerns or complaints about how your personal data is being used or wish to exercise any of your data rights, please contact us using the method described on our website. If you remain unsatisfied, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO) or your local data protection authority.