Florist Gipsy Hill GDPR Privacy Policy

Introduction

Florist Gipsy Hill is dedicated to safeguarding your personal data and upholding your privacy rights in accordance with the General Data Protection Regulation (GDPR) and relevant UK data protection laws. This Privacy Policy is designed to inform customers placing orders with Florist Gipsy Hill in Gipsy Hill and the surrounding districts about the nature of the data we collect, the reasons for collection, retention periods, data processors we may use, and your legal rights regarding your personal data.

Scope of Policy

This Privacy Policy applies to all personal data collected from customers who place orders with Florist Gipsy Hill, whether through our website, by phone, or in person. It also applies to all services and activities relating to fulfilling your floral orders in Gipsy Hill and nearby districts.

What Data We Collect

When you place an order with Florist Gipsy Hill or contact us for our services, we may collect and process the following personal data:

• Contact Information: Your name, delivery address, email address, and telephone number.
• Order Details: Information about the floral products or services you order, instructions for delivery, and messages to accompany your order.
• Payment Information: Transaction details such as amounts and payment methods. Please note that full credit/debit card details are processed securely by our third-party payment providers and are not stored by Florist Gipsy Hill.
• Correspondence: Records of your communication with us, including queries, feedback, or complaints.
• Technical Data: When visiting our website, we may collect data such as your IP address, browser type, device identifiers, and usage statistics via cookies and similar technologies for analytical purposes.

Lawful Basis for Processing Your Data

Our collection and processing of your personal data is conducted under the following lawful bases allowed by GDPR:

• Contract: The processing of your data is necessary to enter into and fulfill our contract to provide you with floral products and services.
• Legal Obligation: To comply with legal and regulatory requirements, such as retaining tax records.
• Legitimate Interests: We may process your data for purposes such as improving customer service or protecting our business interests, provided your rights do not override these interests.
• Consent: In cases where we ask for your explicit permission (for example, for sending marketing communications), you have the right to withdraw your consent at any time.

Data Retention

We retain your personal data only as long as it is necessary to provide our services, fulfil our contractual and legal obligations, and to resolve disputes or enforce agreements. Retention periods will differ depending on the data type and the purpose for processing:

• Order and Contact Information: Typically, this data is retained for up to six years for accounting and tax purposes.
• Payment Information: Card details are not retained by Florist Gipsy Hill. Transaction records (not card details) are kept in line with financial regulations.
• Marketing Data: If you have given consent for marketing, we will retain your data until you withdraw your consent.
• Technical and Analytics Data: Data collected via cookies may be kept for up to two years for analytical purposes, in line with industry norms.

After these periods, data will be securely deleted or anonymised unless a longer retention is required by law.

Data Processors and Third Parties

To operate effectively and fulfil your orders, Florist Gipsy Hill may share selected personal data with trusted third-party service providers ("processors") who perform services on our behalf. Examples include:

• Payment processing companies, for securely handling transaction payments
• Couriers or delivery service providers, for delivering your orders
• IT service providers, for secure infrastructure management and website operation
• Accountants or legal advisors, when required for regulatory compliance or defence of legal claims

All processors are engaged under legally binding contracts requiring them to process your data only in accordance with our instructions and to apply appropriate security measures. Personal information is never sold or disclosed to unrelated third parties for marketing purposes.

Your Rights Under GDPR

GDPR offers you several important rights with respect to your personal data. These include the right to:

• Access: You may request confirmation as to whether we process your data and obtain a copy of your information.
• Rectification: You have the right to ask us to correct inaccurate or incomplete data.
• Deletion (‘Right to be Forgotten’): You can request the erasure of your data when retention is no longer justified.
• Restriction: In certain circumstances, you can ask us to restrict the processing of your data.
• Portability: You may obtain and reuse your personal data in a structured, commonly used, machine-readable format for your own purposes.
• Object: You can object to certain types of processing, such as direct marketing or processing based on legitimate interests.
• Withdraw Consent: When processing is based on your consent, you can withdraw it at any time, and we will cease that processing activity.

You can exercise these rights by submitting a request to us. We will respond in accordance with GDPR requirements, usually within one month.

Data Security

Florist Gipsy Hill has implemented suitable technical and organisational measures to protect your personal data from accidental loss, unauthorised access, or disclosure. These include the use of secure servers, restricted access to personal information, encryption of sensitive data where appropriate, and regular data protection training for our staff.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our data practices or obligations under the law. We encourage you to review this policy periodically for any updates. The date of the most recent revision will be indicated in the policy.

Complaints

If you have concerns about how Florist Gipsy Hill handles your personal data, you have the right to lodge a complaint with the relevant data protection authority. We encourage you to contact us first to resolve any issues directly and swiftly.