Privacy Policy for Cambridge Heath Florist Orders

Introduction

This Privacy Policy sets out how Cambridge Heath Florist (“we”, “us”, or “our”) collects, uses, stores, and protects your personal information when you place orders with us in Cambridge Heath and the surrounding districts. We take data privacy seriously and process your information in compliance with the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains your rights regarding your personal data and how to exercise them.

Scope of Policy

This policy applies to all customers placing orders with Cambridge Heath Florist from Cambridge Heath and its surrounding areas, whether orders are placed in person, by phone, via our website, or through other respected channels we may use for order processing and delivery.

Personal Data We Collect

When you place an order with us, we collect the following categories of personal data:

• Identity Data: Your name and, if applicable, the recipient's name.
• Contact Data: Billing and delivery addresses, telephone numbers, and contact preferences.
• Transaction Data: Details about the products you purchase, delivery instructions, and payment information (note: payment card details are processed securely by reputable payment providers and are not retained by us).
• Marketing and Communication Data: Your preferences in receiving marketing communications from us, if you choose to subscribe or opt-in.
• Technical Data: IP address, browser type, and device information when you interact with our website. These are collected via cookies and similar technologies solely for website functionality and analytics.

Lawful Basis for Processing

Under the UK GDPR, we must have a lawful basis for processing your personal information. Cambridge Heath Florist processes your data based on the following grounds:

• Contractual Necessity: To fulfil your order, deliver products, and provide customer service.
• Legal Obligation: To comply with legal and regulatory requirements, including accounting and tax obligations.
• Legitimate Interests: To improve our services, protect against fraud, and manage business operations, provided these interests are not overridden by your privacy rights.
• Consent: Where required, such as for marketing communications, we process your information only if you have given explicit consent, which can be withdrawn at any time.

How We Use Your Data

Your data is used strictly for the purposes for which it was collected, including:

• Processing and fulfilling your flower orders.
• Communicating order updates, delivery times, or resolving queries.
• Maintaining accurate records for accounting and legal purposes.
• Enhancing our customer service and business processes.
• Sending you marketing information (only if you opt in).

Data Retention

We will keep your personal information only as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements:

• Customer order and transaction records: Retained for up to 7 years to comply with UK tax and accounting laws.
• Marketing data: Retained until you opt out or withdraw consent.
• Technical data (Cookies/Logs): See our separate Cookie Policy for specific retention periods.

After these periods, personal information will be securely deleted or rendered anonymous.

Data Sharing and Processors

Your personal data may be shared with trusted third-party service providers (“processors”) who help us fulfil orders, process payments, deliver flowers, maintain our website, or perform marketing on our behalf. These processors include delivery couriers, CRM and payment systems, and IT support services. Each processor is strictly bound by an agreement to maintain the confidentiality and security of your data and is only permitted to process your data following our instructions.

We do not sell, rent, or trade your personal data to third parties.

Where required by law or to protect our rights or customers’ safety, we may disclose data to governmental bodies or law enforcement agencies.

International Data Transfers

Your personal data is stored in the UK or the European Economic Area (EEA). If any processing occurs outside these jurisdictions, safeguards will be implemented to ensure your data remains protected in line with UK GDPR standards.

Your Rights Under GDPR

Under the UK GDPR, you have the following rights regarding your personal data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request correction of inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): You can request deletion of your personal data where there is no legitimate reason for us to continue processing it.
• Right to Restrict Processing: In certain circumstances, you can request we limit the processing of your data.
• Right to Data Portability: You can receive your personal data in a structured, commonly-used format and have the right to transmit those data to another controller.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: If you have concerns about how we handle your data, you may lodge a complaint with the UK Information Commissioner’s Office (ICO).

Security Measures

We are committed to ensuring that your data is secure. We have put in place appropriate technical and organisational measures to protect your personal information from unauthorised access, accidental loss, misuse, alteration, or disclosure. Access to your data is strictly limited to authorised personnel and trusted processors. All data transmissions are secured using industry-standard encryption where appropriate.

Policy Updates

We may update this privacy policy from time to time to reflect legal requirements or changes in our business processes. Significant updates will be communicated to you where appropriate. The most recent version is always available through our main customer communication channels and on our website.

Contact & Further Information

If you have any questions about this Privacy Policy or about your data protection rights, please contact us using the usual customer enquiry channels or by writing to our premises during business hours.