Cranham Florist Privacy Policy

Introduction

This Privacy Policy explains how Cranham Florist ('we', 'our', or 'us') collects, uses, retains, and protects your personal information in the course of providing flower delivery and related services in Cranham and the surrounding districts. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR). This policy applies to all customers placing orders with Cranham Florist, whether online, by phone, or in-store.

Data We Collect

We collect personal data necessary to process your flower orders, arrange delivery, and provide customer service. The types of data we collect include:

• Contact Information: Your name, address, email address, and phone number.
• Recipient Details: Name, address, and contact information for those receiving a delivery.
• Order Details: Information about the products you order, delivery instructions, messages for recipients, and payment details (note: card payments are processed via secure third-party processors—we do not store card data).
• Communication Records: Records of inquiries, feedback, or complaints you raise with us.
• Technical Information: Device, browser, and usage data collected via cookies when you visit our website.

Lawful Basis for Processing Your Data

Our collection and processing of your personal data is grounded in the following lawful bases under the GDPR:

• Contractual Necessity: We require your details to fulfill and deliver your order and meet our contractual obligations.
• Legal Obligation: We may process and retain certain information to comply with applicable laws (e.g., tax regulations).
• Legitimate Interests: To manage and improve our service, respond to inquiries, and ensure the security of our operations.
• Consent: For marketing communications or the use of non-essential cookies, we will request your explicit consent.

Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including order processing, handling customer service inquiries, meeting legal and accounting requirements, and resolving disputes. Standard retention periods are as follows:

• Order and Delivery Details: Retained for up to 7 years in line with financial record-keeping obligations.
• Customer Communication: Retained for 2 years following the completion of your last order or inquiry.
• Marketing Preferences: Retained until you withdraw your consent or ask for your information to be deleted.

After these periods, your data will either be deleted securely or anonymised so it can no longer be linked to you.

Data Processors and Third Parties

To fulfill your orders and operate our business efficiently, we may share your information with trusted third-party processors. These include:

• Delivery Partners: Couriers and local delivery services used to deliver your flowers and gifts.
• Payment Processors: Reputable payment service providers who handle your financial transactions securely.
• IT and System Providers: Providers of website hosting, security, IT support, and customer relationship management systems.
• Professional Advisors: Accountants, legal advisors, or consultants if required.

We ensure all processors handle your data in line with GDPR requirements, and we do not sell or share your data for unrelated commercial purposes.

User Rights Under the GDPR

Under GDPR, you have the following rights in relation to your personal data:

• Right to Access: You can request a copy of the personal information we hold about you.
• Right to Rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to Erasure: You have the right to request deletion of your data where there is no legal obligation for us to retain it.
• Right to Restrict Processing: You may ask us to limit the processing of your data under certain circumstances.
• Right to Data Portability: You have the right to receive your data in a machine-readable format and transmit it to another controller where feasible.
• Right to Object: You can object to processing of your data based on legitimate interests or for marketing purposes.
• Right to Withdraw Consent: Where we rely on your consent, you can withdraw it at any time.

To exercise your rights, please contact us through our advertised means. We will respond to your request as soon as possible and within one month in accordance with GDPR requirements.

Security Measures

We take the security of your data seriously. We have put in place appropriate physical, electronic, and managerial procedures to help safeguard your information, including encrypted connections for online transactions, regular security reviews, and staff training. Where we engage third party processors, we ensure they adhere to high data protection standards and are contractually bound to protect your data.

International Data Transfers

Your data is stored and processed within the UK or the European Economic Area (EEA). If we need to transfer your information outside this region, we will ensure appropriate safeguards are in place in accordance with GDPR requirements.

Policy Updates

We reserve the right to update this Privacy Policy at any time to reflect changes to our practices or for other operational, legal, or regulatory reasons. Please review this policy regularly to stay informed about how we protect your data.

How to Contact Us

If you have any questions or concerns about this Privacy Policy or your data protection rights, please contact us using the details advertised on our website or at our physical shop premises in Cranham. If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).