Flower Delivery Waterloo GDPR Privacy Policy

Introduction

This Privacy Policy outlines how Flower Delivery Waterloo ("we", "our", or "us") collects, uses, stores, and protects your personal data when you place orders with us. This policy applies to all customers ordering our flower delivery services in Waterloo and the neighbouring districts. We are committed to safeguarding your privacy and meeting our obligations under the UK General Data Protection Regulation (GDPR).

What Information We Collect

To fulfill your flower delivery orders and provide the best possible customer service, we collect the following types of personal data:

• Identity Data: Your name (and recipient's name if different), and, if relevant, business or organization name.
• Contact Data: Delivery address, billing address, and any email address or telephone number you provide for order communications.
• Transaction Data: Details of your orders, payment method (we do not store full card details), order history, and transaction amounts.
• Delivery Instructions: Any additional information you provide to ensure successful delivery (e.g., access codes, safe place details).
• Correspondence: Records of any communication you have with us by phone, online forms, or other means.
• Technical Data: IP address, browser type, and device information when you use our website, collected through cookies and similar technologies.

Lawful Basis for Processing Your Data

We process your personal data under the following lawful bases, as set out in Article 6 of the UK GDPR:

• Contractual Necessity: To process, fulfill, and deliver your orders, and to communicate with you regarding order status.
• Legal Obligation: To comply with legal and regulatory requirements, such as accounting and tax documentation.
• Legitimate Interest: For quality control, customer service, and to protect our business from fraud or misuse.
• Consent: Where you provide explicit consent, for example, to receive marketing communications or promotional offers (you may opt out at any time).

How We Use Your Information

Your data is used for the following purposes:

• Processing and delivering your flower orders.
• Communicating with you regarding orders, changes, or delivery arrangements.
• Responding to your enquiries, feedback, or complaints.
• Maintaining our business records and fulfilling legal obligations.
• Improving our services and website performance.
• Sending you marketing information if you have provided consent.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Typically, customer order data is retained for up to 7 years to comply with tax and accounting laws. If you have subscribed to marketing communications, your contact details will be stored until you withdraw consent or unsubscribe. Technical data from website visits may be retained for shorter periods for analytics and security monitoring.

Data Processors and Third Parties

We work with trusted third parties ("processors") to help us fulfil your orders and operate our business efficiently. These include:

• Payment Processors: Securely process card payments; we do not directly store card details.
• Delivery Partners: Assist in delivering flowers to your specified address.
• IT Service Providers: Host our website, provide cloud storage, and ensure security.
• Professional Advisors: Accountants and legal consultants as required for compliance.

All third-party processors are contractually obligated to handle your data securely, in accordance with our instructions, and consistent with data protection requirements. Your personal data will not be sold or shared with any third party for their own marketing purposes.

International Transfers

Your personal data is primarily processed within the United Kingdom. Should we engage service providers outside the UK or European Economic Area (EEA), we ensure appropriate safeguarding measures, such as Standard Contractual Clauses, are in place to protect your information.

Your Data Protection Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of your personal information held by us.
• Right to Rectification: If your information is inaccurate or incomplete, you can ask for it to be updated.
• Right to Erasure: You may request deletion of your personal data under certain circumstances.
• Right to Restrict Processing: You can ask us to stop processing your data in some situations.
• Right to Data Portability: You have the right to receive your data in a structured, commonly used format and to have it transferred to another controller.
• Right to Object: You may object to processing for direct marketing or where processing is based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw your consent at any time.

To exercise any of these rights, you may contact us using the contact options provided on our website. We may need to verify your identity before responding to your request. We aim to respond within one month of receiving your request.

Security of Your Personal Data

We take the security of your data seriously. Appropriate technical and organizational measures are in place to prevent unauthorized access, loss, or misuse of your information. Payment information is encrypted and processed securely via third-party providers. Where possible, we anonymize or pseudonymize your data to further protect your privacy.

Changes to This Policy

This Privacy Policy may be updated periodically to reflect changes in our services or legal requirements. The latest version will always be available on our website, with an updated revision date where appropriate.

Contacting Us

If you have questions or concerns about how your personal data is handled, or wish to exercise your GDPR rights, please visit our website for up-to-date contact information and support options.