Your Data Protection at Flower Delivery Gipsy Hill

Introduction

This Privacy Policy describes how Flower Delivery Gipsy Hill collects, uses, stores, and protects the personal data of all customers who place flower delivery orders from Gipsy Hill and the surrounding districts. We are committed to maintaining your privacy and safeguarding your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and all relevant data protection legislation. This policy provides information regarding the categories of personal data we handle, the lawful basis for collection, our data retention periods, any third-party data processors we may use, and your legal rights.

Scope of the Policy

This Privacy Policy applies to all personal data provided by customers for the purpose of placing and fulfilling flower delivery orders from Flower Delivery Gipsy Hill, whether orders are placed online, by telephone, or via other methods within Gipsy Hill and adjacent districts. By using our services, you acknowledge the practices set out in this Privacy Policy.

What Data We Collect

When you interact with Flower Delivery Gipsy Hill or place an order with us, we may collect the following categories of personal data:

• Personal Identification Data: Full name, address, delivery location, and contact details such as telephone number.
• Order Details: Flower arrangements chosen, personalized message, delivery date and instructions.
• Payment Data: Payment card information (processed securely and not stored by us), billing address.
• Communications: Copies of correspondence, order queries, or feedback.
• Technical Data: IP address, browser type and version, device type, and website usage information when orders are placed online.

Lawful Basis for Processing

We process your personal data in accordance with the lawful bases outlined under the GDPR. Our main grounds for processing include:

• Contractual Necessity: We require personal data to process and deliver your order, undertake payments, and provide customer service.
• Legal Obligation: Certain data may be processed in compliance with accounting, tax, and other legal requirements.
• Legitimate Interests: We may use your personal data to improve and customize our services, manage security, and prevent fraud, provided our interests are not overridden by your privacy rights.
• Consent: For activities such as marketing communications, we rely on your explicit consent, which you may withdraw at any time.

How We Use Your Data

We use your personal data solely for the following purposes:

• Processing and fulfilling your flower delivery orders.
• Communicating with you about your order and responding to your inquiries.
• Managing payments and refunds.
• Complying with legal and regulatory obligations.
• Improving our website, services, and customer experience.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described above, and in accordance with our legal obligations and legitimate business interests. In general, we retain order and customer data for a period of six years from your last interaction with our services, to comply with legal and accounting requirements. Where data is processed based on consent (e.g., for marketing), your data will be retained until you withdraw consent or request erasure. After the applicable retention period, your data will be deleted or anonymized in a secure manner.

Data Processors & Data Sharing

Flower Delivery Gipsy Hill may use trusted third-party processors for payment processing, delivery management, IT services, website hosting, and analytics. We ensure all processors are GDPR-compliant and only process data as instructed by us. Data shared with such processors is only what is strictly necessary to perform their services. We will never sell your personal data or share it for purposes other than those described in this policy. If we are required to disclose personal data by law, we will do so as needed to comply with legal proceedings or requirements.

How We Protect Your Data

We implement appropriate technical and organizational security measures to protect your personal data against loss, misuse, unauthorized access, disclosure, alteration, and destruction. These measures include encryption, secure servers, regular data protection reviews, and limited access to personal data to only those employees and partners with a legitimate business need.

Your Data Protection Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: You may request confirmation of whether we hold your personal data and receive a copy of such data.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You can request your personal data to be deleted where there is no lawful reason for us to continue processing it.
• Right to Restrict Processing: You may ask us to restrict processing of your data under certain circumstances.
• Right to Data Portability: You may request to receive your data in a structured, commonly used, and machine-readable format, and to have that data transferred to another processor.
• Right to Object: You have the right to object to data processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw this consent at any time.

If you wish to exercise any of these rights, you may contact us through the communication methods detailed on our website. We may require identity verification before fulfilling your request and will respond in accordance with applicable law.

Policy Updates

We may amend this Privacy Policy from time to time to reflect changes in legal obligations or our practices regarding personal data. Any modifications will appear in this document, with the date of last update indicated. We encourage customers to review this policy periodically to remain informed about how we handle and protect your data.

Contact and Complaints

If you have concerns about the way your personal data is handled, or would like to exercise your data protection rights, you can reach out to us using the contact details provided on our website. Should you have further concerns, you also have the right to lodge a complaint with the relevant data protection authority in your country.