Privacy Policy for Islington Florist Customers
Introduction
This Privacy Policy sets out how Islington Florist ("we", "us", or "our") collects, stores, and processes your personal information. This policy applies to all customers placing orders with Islington Florist within Islington and the surrounding districts.
What Data We Collect
We collect and process a range of personal data to provide our services and operate efficiently. The personal data we collect may include:
- Contact Details: Full name, address, telephone number, and delivery address.
- Order Information: Purchase history, products ordered, delivery preferences, and order messages (e.g., card messages).
- Payment Information: Payment confirmation details (we do not store full card numbers or CVC codes; these are processed via our secure payment processor).
- Communication Records: Emails, order-related correspondence, and customer service queries.
- Technical Data: IP address, browser type, and device information collected through our website for functional and security purposes.
Lawful Basis for Processing Personal Data
We process your personal data in compliance with the UK General Data Protection Regulation (GDPR) and associated data protection laws. The lawful bases under which we process your data include:
- Performance of a Contract: Most personal data is needed to fulfill orders, process payments, deliver flowers, and provide customer support.
- Legal Obligation: Retaining certain transaction and payment details to comply with accounting, tax, or other legal requirements.
- Legitimate Interests: Maintaining business records, improving our services, fraud detection, and ensuring the security of our website and transactions.
- Consent: If required, such as for direct marketing communications (you will always have the option to opt in or out).
How We Use Your Data
We use the personal data collected for the following purposes:
- To process and deliver your order accurately.
- To contact you with order updates or queries.
- To manage payments and refunds where applicable.
- To improve our products, services, and website functionality.
- For fraud prevention and to maintain the security of our systems.
- To comply with our legal and regulatory obligations.
How Long We Keep Your Data: Retention Policy
Your personal data is retained only for as long as necessary to fulfill the purposes for which it was collected. In general:
- Order and payment information is retained for up to 7 years to comply with HMRC regulations and for potential legal claims.
- Communication records are retained for up to 3 years from the date of last contact.
- Technical data is retained for up to 2 years for analytics and security purposes.
We regularly review our retention periods and will remove or anonymize data when it is no longer needed.
Processors and Data Sharing
We work with third-party service providers ("processors") who assist us in delivering our services. These may include payment processors, delivery partners, IT and website support, and accountancy services. All third-party processors are carefully selected and required to handle your data securely and in compliance with GDPR requirements. We do not sell or rent your personal data to third parties for marketing purposes.
If required by law, or to protect our rights or the safety of others, we may disclose your data to authorities or legal representatives.
Your Rights Under GDPR
As an individual whose data we process, you have the following rights:
- Access: You can request access to the personal data we hold about you.
- Rectification: You can ask us to correct inaccurate or incomplete data.
- Erasure: You have the right to ask us to delete your personal data, subject to legal and contractual obligations.
- Restriction: You may request that we restrict the processing of your personal data in certain circumstances.
- Data Portability: Where applicable, you can ask to receive your data in a structured, commonly used format and transmit it to another provider.
- Objection: You can object to the processing of your data in certain situations, such as direct marketing.
- Withdraw Consent: When we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior.
To exercise any of these rights, please contact us using the details provided on our website. We may need to verify your identity for security reasons before fulfilling your request.
Data Security
We employ physical, electronic, and managerial safeguards to protect your personal data from unauthorized access, alteration, disclosure, or destruction. Access to personal data is limited to trusted staff and authorized processors on a need-to-know basis.
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in practices, legal requirements, or operational needs. The current version is always available on our website and significant changes will be communicated as appropriate.
Contacting Us
If you have questions about this Privacy Policy or how we process your personal information, please refer to the contact details listed on our website. We are committed to working with you to resolve any concerns about your information.
