Flowers Clerkenwell Privacy Policy

Scope of This Privacy Policy

This policy explains how Flowers Clerkenwell (“we”, “us”, “our”) collects, uses, protects, and processes the personal information of customers placing orders with us from Clerkenwell and surrounding districts. We are committed to respecting your privacy and ensuring strict compliance with the UK General Data Protection Regulation (GDPR). This privacy policy applies to all transactions, communications, and interactions you have with us as a customer of Flowers Clerkenwell.

Information We Collect

To provide our services effectively, we collect and process a range of personal data about you:

• Personal Identification Data: Name, delivery address, billing address, and contact details (such as phone number).
• Order Details: Product selections, delivery instructions, card messages, and any preferences you provide when placing your order.
• Payment Information: Payment card details, billing information (please note that card details may be processed directly by secure third-party payment processors and not retained on our own servers).
• Correspondence: Details of your communications with us, including queries, complaints, or feedback.
• Technical Data: Device and browser type, IP address, and anonymised usage statistics through essential website cookies.

Lawful Basis for Processing Your Data

Under the GDPR, we must have a lawful reason for processing your data. Flowers Clerkenwell processes your personal data for the following purposes and bases:

• Performance of a Contract: To process, confirm, and deliver your flower orders and related services.
• Legal Obligation: For record-keeping, tax, and compliance as required by law.
• Legitimate Interests: To improve our products and services, respond to your communications, and prevent fraud. We ensure that our legitimate interests do not override your rights.
• Consent: Where required (for example, marketing by email), we will only process your data with your explicit consent. You may withdraw your consent at any time.

How We Use Your Information

Your personal data will only be used to:

• Process and fulfil your orders, including arranging delivery.
• Communicate order statuses, respond to queries, and provide customer support.
• Operate and improve our website and services.
• Meet contractual, legal, or regulatory obligations.

Data Retention Policy

Flowers Clerkenwell retains your personal data only for as long as necessary for the purposes set out in this policy, while also complying with applicable legal or regulatory retention periods. Typically, we retain:

• Order and contact details for up to seven years to comply with financial and tax regulations.
• Enquiries and correspondence for a maximum of three years after resolution of your request.
• If you have consented to receive marketing, we will retain your marketing preferences until you withdraw your consent.

After these periods, your data will be securely deleted or anonymised unless we must retain it for ongoing legal proceedings.

Disclosure and Data Processors

Flowers Clerkenwell does not sell or rent your personal information to third parties. We only share personal data with trusted third-party service providers (“processors”) where necessary to fulfil our services, as outlined below:

• Payment Processors: Securely process your payments; your payment card details are handled directly by these providers.
• Delivery Partners: Provide delivery services and ensure flowers reach your intended recipient.
• IT & Hosting Providers: Support and maintain our website and infrastructure.
• Professional Advisors: Such as accountants or auditors, where required by law.

Each processor is contractually required to handle your data securely and only in accordance with our instructions. We do not authorise processors to use your data for any other purpose. Where data is transferred or stored outside the UK or EEA, we ensure adequate safeguards are in place as required by GDPR.

Your Rights Under GDPR

As a customer of Flowers Clerkenwell, you have the following rights over your personal data:

• Right of Access: Obtain confirmation of whether we are processing your data and a copy of your personal data on request.
• Right to Rectification: Have inaccurate or incomplete data corrected.
• Right to Erasure: Request the deletion of your data when there is no compelling reason for its continued processing (subject to any legal obligations).
• Right to Restrict Processing: Ask us to restrict processing under certain circumstances.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Data Portability: Receive your data in a structured, commonly used format and transfer it to another provider.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing), withdraw your consent at any time.

To exercise any of these rights, please contact us using your preferred method and we will address your request in accordance with GDPR requirements.

How We Protect Your Data

We recognise the importance of security and have appropriate technical and organisational measures in place to safeguard your personal information. These measures include secure servers, encrypted communications, regular system monitoring, and restricted access controls. We actively monitor our systems and processors for compliance and address data protection risks as an ongoing priority.

Updates to This Policy

We review and update this privacy policy periodically to reflect changes in our operations, legal obligations, or best practices. Updated versions will apply immediately to all existing and new customers in Clerkenwell and the surrounding areas. Please revisit this page regularly to stay informed about how we protect your privacy.

Contact and Complaints

If you have any questions about this privacy policy or your personal information, you may contact us for further details. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.