Florist Edgware GDPR Privacy Policy

Introduction

Florist Edgware is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, store, process, and protect your data when you place an order with Florist Edgware. This policy applies to all customers who place orders with Florist Edgware from Edgware and the surrounding districts. It also outlines your rights under the General Data Protection Regulation (GDPR).

What Data We Collect

When you place an order with Florist Edgware, we collect personal information necessary to process and deliver your order, provide customer service, and fulfill our legal and contractual obligations. The categories of data we may collect include:

• Contact Information: Name, delivery address, billing address (if different), and phone number.
• Order Details: Products ordered, special delivery instructions, messages to recipients, order date, and value of the transaction.
• Payment Information: Payment card details (collected and processed securely through our payment processor), payment method, transaction reference numbers.
• Communication: Email correspondence, order notes, and recorded telephone communications (if applicable).

We do not collect more information than is necessary for the purposes described in this policy. We do not knowingly collect or process special categories of personal data (such as information about health or ethnicity) unless explicitly provided by you in order instructions (for example, allergy information for recipients).

Lawful Basis for Processing

Under the GDPR, we must have a valid lawful basis to process your personal information. For Florist Edgware customers, data processing is based primarily on the following lawful grounds:

• Contractual Necessity: To process your order, manage deliveries, and provide customer service, we must use your personal information.
• Legal Obligation: To comply with applicable legal and regulatory requirements, such as accounting and tax records retention.
• Legitimate Interests: We may process data to improve our services, prevent fraud, and ensure the security of our systems, provided these interests are not outweighed by your data protection rights.
• Consent: Where we use your data for purposes outside of those described above (e.g., marketing), we will obtain your explicit consent in advance. You may withdraw this at any time.

How Your Data Is Used

Your data is used solely to fulfill your orders, provide customer service, communicate order statuses, deliver products, process payments, handle returns or refunds, and comply with our legal obligations. We do not use your data for automated decision-making or profiling which may impact you legally or significantly.

Data Retention

We retain personal data only for as long as is necessary to fulfill the purposes described in this policy, including satisfying any legal, accounting, or reporting requirements. Typically, order and contact information is retained for a period of up to seven years from the date of your last transaction, in accordance with accounting and tax laws. Payment card details are not stored by Florist Edgware but are managed securely by our payment processor.

Data Sharing and Processors

Florist Edgware will never sell your personal data to third parties. We may share your information with trusted third-party service providers ("processors") for the following purposes:

• Payment processing: To securely process card payments via PCI-DSS compliant providers.
• Delivery and logistics: To ensure successful delivery to the address provided.
• IT and cloud hosting: For secure storage and back-up of your data.
• Professional advisers: For legal, tax, and accounting support as required by law.

All processors act strictly on our instructions and implement appropriate security measures. We require all processors to process your data in accordance with data protection law and not for their own purposes. Your data is not transferred outside of the United Kingdom or European Economic Area unless such transfers are legally permitted, and adequate safeguards are in place.

Data Security

We take the security of your data seriously. Reasonable physical, electronic, and managerial measures are in place to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include access controls, encryption of data in transit where required, secure storage, and staff training on data privacy responsibilities.

Your GDPR Rights

Under the GDPR, you have several rights regarding your personal information. These rights include:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to Erasure: You may request that we delete your data where there is no lawful basis for retaining it.
• Right to Restrict Processing: You may ask us to restrict processing your data in certain circumstances.
• Right to Data Portability: Where processing is based on your consent or a contract, you can request that we supply your data in a structured, machine-readable format for transfer to another provider.
• Right to Object: You can object to the processing of your data where we rely on legitimate interests.
• Right to Withdraw Consent: Where we process your data based on consent, you may withdraw that consent at any time.

To exercise your rights, please contact us with proof of identification so we can verify your request. We will respond within one month, unless the request is complex or numerous, in which case we will keep you informed of progress.

Changes to This Privacy Policy

This policy may be reviewed and updated from time to time to reflect changes in the law or in our business activities. Any significant changes will be communicated to customers as appropriate.

Contact and Complaints

If you have questions about this Privacy Policy or your data, or if you wish to make a complaint, please contact us using the methods outlined on our website or ordering platform. You also have the right to lodge a complaint with the Information Commissioner’s Office if you believe your rights under data protection law have been infringed.

Conclusion

We value your trust in Florist Edgware and are dedicated to protecting your personal information. By placing an order with us, you acknowledge and accept the data practices described in this Privacy Policy, which applies to all customers in Edgware and the surrounding districts.