Privacy Policy for Elephant and Castle Florist Customers

Introduction

This Privacy Policy explains how Elephant and Castle Florist ("we", "us", or "our") collects, uses, stores, and protects your personal information when you place an order with us in Elephant and Castle and surrounding districts. We are committed to respecting your privacy and protecting your data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Scope of This Policy

This Policy applies to all individuals who place orders with Elephant and Castle Florist, whether in-store, by telephone, or online, residing or ordering for delivery within Elephant and Castle and surrounding districts. By ordering from us, you agree to the terms of this Privacy Policy.

Data We Collect

When you place an order or interact with Elephant and Castle Florist, we may collect the following categories of personal data:

• Identity Data: Your name (and recipient's name, if different).
• Contact Data: Address, delivery address, phone number, and other contact information provided during order placement.
• Order Data: Details of your purchases, delivery preferences, messages to recipients, and transaction history.
• Payment Data: Payment confirmation details and transaction references (but not full card details, as payments are processed through third-party processors).
• Communications Data: Correspondence with us via phone, web forms, or written notes with orders.
• Technical Data: When using our website, information such as IP address, device type, browser, and cookies may be collected for security and analytics purposes.

Lawful Basis for Processing Your Data

We collect and process your data under one or more of the following lawful bases as defined by GDPR:

• Contract: To fulfil your order, confirm delivery, process payment, or respond to queries relating to your purchase.
• Legal Obligation: To comply with applicable law, such as record-keeping and accounting regulations.
• Legitimate Interests: For business purposes such as internal record-keeping, business analysis, service improvement, and fraud prevention. We always ensure that our interests do not override your fundamental rights and freedoms.
• Consent: In limited cases, such as direct marketing communications, where required by law, we will seek your explicit consent, which you may withdraw at any time.

How We Use Your Data

Your personal information may be used for the following purposes:

• To process and deliver your order, including arranging delivery and contacting you about your purchase.
• To manage payment processing (through secure, vetted third-party providers).
• To maintain our business records and meet our accounting or legal requirements.
• To provide customer support and respond to your inquiries.
• To improve our products, website, and services.
• To send marketing communications, if you have opted in to receive them (which you may opt out of at any time).
• To prevent fraud or misuse of our services.

Data Processors and How Your Data is Shared

We may share your personal data with trusted third-party service providers ("processors") who assist us in delivering our services, such as:

• Payment processing services, who handle your card or electronic payments securely.
• IT or software providers that manage our website and order management system.
• Delivery couriers carrying out deliveries on our behalf.
• Accountants and professional advisers for statutory record-keeping.

All third-party processors are obliged to adhere to GDPR standards, process your data only on our instructions, and implement appropriate security measures.

We do not sell or share your personal information with third parties for their own marketing purposes.

Data Retention

We retain your personal data only as long as is necessary for the purposes it was collected, including to satisfy any legal, accounting, or reporting requirements. Typically, order, payment, and correspondence data is retained for up to seven years to comply with tax and financial regulations, after which it is securely deleted or anonymised. Marketing communications preferences are kept until you opt out or request deletion.

Data Security

We employ a range of physical, technical, and organisational safeguards to protect your data against accidental loss, unauthorised access, use, alteration, or disclosure. This includes secure data storage, restricted access, staff training, and encrypted transfer of sensitive information where appropriate.

Your Rights as a Data Subject

Under the GDPR, you have several rights in relation to your personal data. You can:

• Access: Request a copy of your personal data we hold.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Ask for your personal data to be deleted, subject to legal retention requirements.
• Restriction: Request we restrict further processing of your data in certain circumstances.
• Portability: Request transfer of your personal data to another provider.
• Objection: Object to processing of your personal data based on legitimate interests or direct marketing.
• Withdraw Consent: Where consent is the lawful basis, you may withdraw your consent at any time.

If you wish to exercise any of your rights, please contact us using the methods provided on our website or in our store. We will respond to all valid requests within one month, though we may require further information to confirm your identity for security reasons.

International Transfers

Your data is ordinarily stored and processed within the United Kingdom or European Economic Area (EEA). Where it is necessary to transfer your data outside the EEA (for example, if our service providers are located in other jurisdictions), we will ensure appropriate safeguards are in place to protect your information in accordance with data protection law.

Changes to This Policy

We reserve the right to update or revise this Privacy Policy at any time to reflect changes in our practices or legal requirements. The latest version will always be available in-store and on our website. We recommend reviewing our policy from time to time to stay informed of how we use your data.

Contact and Complaints

If you have questions about how we collect, use, or store your information, or wish to make a complaint, please refer to the contact section on our website or speak to us in-store. You also have the right to complain to the Information Commissioner’s Office (ICO) in the UK if you believe your data protection rights have not been upheld.