Flowers South Kensington Privacy Policy

Overview

This Privacy Policy explains how Flowers South Kensington collects, uses, stores, and protects your personal information. It applies to all customers placing Flowers South Kensington orders from South Kensington and surrounding districts. We are committed to safeguarding your privacy and handling your data in accordance with the General Data Protection Regulation (GDPR).

What Data We Collect

When you place an order with Flowers South Kensington, we may collect and process the following categories of personal data:

• Identity Data: Name, title.
• Contact Data: Delivery address, billing address, recipient address, phone number, alternative contact number, and home or business address if relevant.
• Order Data: Information about your order, purchase history, payment method (but not payment card details themselves, see below), and special delivery instructions.
• Payment Data: Transaction ID and status – we do not store your full payment card details, but may hold information necessary to complete or manage payments as provided by payment processors.
• Communications Data: Correspondence sent to us, preferences for receiving marketing (where applicable), and any feedback or queries submitted.
• Technical Data: IP address, browser type, operating system, device information, and details about how you use our website and place orders.

Lawful Basis for Processing Data

Under GDPR, we must have a lawful basis to process your information. Depending on the context, we process your data on the following bases:

• Contractual necessity: To process, confirm, and deliver your orders, manage payments, and communicate order-related information.
• Legal obligation: To comply with laws regarding accounting, taxation, and regulatory matters.
• Legitimate interests: To improve our products and services, enhance customer experience, or prevent fraud. We ensure such processing does not override your rights and interests.
• Consent: For direct marketing or processing optional information, only if we have received your explicit, informed consent. You may withdraw your consent at any time.

How Data is Collected

We collect your data directly from you when you place an order, contact us, or interact with our services. We may also collect some technical data automatically through cookies and similar technologies when you use our website. We only collect data that is necessary for the delivery and fulfilment of your order or for business administration in accordance with GDPR.

Data Retention

We store personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Typically, we retain order data and associated personal information for up to seven years after your last transaction, to comply with legal obligations and resolve disputes. Payment data handled by processors is retained as per their policies.

Once retention periods expire, your personal data is securely deleted or anonymised so that it can no longer be associated with you.

Data Sharing and Processors

Your personal data may be shared with trusted third parties, known as data processors, but only where necessary for service fulfilment or as required by law. These may include:

• Payment service providers: For secure processing of your payments. We do not store full card details on our systems.
• Delivery partners: To arrange and fulfil floral deliveries.
• IT and website support providers: To maintain and operate our systems securely.
• Accountants and legal professionals: For compliance with financial and legal requirements.

All processors and third parties engaged by Flowers South Kensington are subject to contractual obligations to protect your information and act in accordance with applicable data protection laws. We do not sell, rent, or trade your personal data to third-party organisations for their own marketing purposes.

International Data Transfers

Your personal data is primarily processed within the United Kingdom and European Economic Area (EEA). If processing outside these jurisdictions is required, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your data rights.

User Rights Under GDPR

As a data subject in the UK and EEA, you have the following rights:

• The right to access: You may request a copy of the personal data we hold on you.
• The right to rectification: You can ask us to correct or update your information if it is inaccurate or incomplete.
• The right to erasure: You may ask us to delete your data, unless we have a legal obligation or legitimate interest to retain it.
• The right to restrict processing: You may request us to limit the way we use your data in certain circumstances.
• The right to object: You can object to us processing your data for direct marketing or on grounds relating to your situation.
• The right to data portability: Where processing is based on consent or contract, you may ask to have your data transferred to another controller.

To exercise any of these rights, you may contact us using your preferred contact method. We will respond to your request in accordance with GDPR requirements and may need to confirm your identity before fulfilling your request.

Data Security

We are committed to protecting your personal data from unauthorised access, alteration, and disclosure. We implement appropriate technical and organisational measures such as secure servers, data access controls, and regular staff training. Despite these precautions, no internet transmission is completely secure, and we cannot guarantee absolute security.

Changes to This Privacy Policy

We may review and update this Privacy Policy periodically in line with changes to our practices or legal requirements. Updated versions will be posted on our website with the date of revision. We recommend reviewing this page regularly to stay informed about how we process your data.

Contact and Complaints

If you have any questions about this Privacy Policy, your rights, or how we handle your data, please contact us using your preferred method. If you are dissatisfied with our response, you may contact the data protection supervisory authority relevant to your residence or the United Kingdom’s regulatory body for data protection matters.