Eltham Flowers Privacy Policy for Orders in Eltham and Surrounding Districts

Introduction

This Privacy Policy applies to all customers placing orders with Eltham Flowers, whether directly or via partner channels, from Eltham and surrounding districts. Eltham Flowers is committed to protecting your privacy and ensuring that your personal information is processed transparently, securely, and in full accordance with the UK General Data Protection Regulation (GDPR). This policy details what personal data we collect, our lawful basis for processing, how and for how long your data is retained, the third-party processors we work with, and your legal rights in relation to your data.

What Data We Collect

When you place an order with Eltham Flowers, we collect and process the following types of personal data to fulfil your request and provide our services:

• Contact Information: Name, delivery address, billing address, and telephone number.
• Order Details: Details of your bouquet or floral arrangement, messages for recipients, delivery instructions, and any gift options selected.
• Payment Information: Payment card details or transaction identifiers (payment card numbers are processed directly by payment service providers and are not stored by Eltham Flowers).
• Communication Records: Records of communications or queries you send us regarding your order, live chat conversations, and feedback submitted.
• Technical Data: IP address, browser type, and information on how you use our website, when orders are placed online. Cookies and analytics may be collected where you have consented.

Lawful Basis for Processing Personal Data

Under the GDPR, we must have a valid lawful basis to process your data. Eltham Flowers processes customer data under the following legal bases:

• Contractual Necessity: We need personal data to process, deliver, and manage your order and any related customer service requirements.
• Legal Obligation: In some cases, we are required by law to retain transaction records for tax and accounting purposes.
• Legitimate Interests: We may use your data to improve our products and services, to monitor and protect against fraud, or for limited direct marketing activities, unless you object.
• Consent: Where required, we process data (such as using cookies for analytics or sending marketing materials) only if you have given your explicit consent, which you can withdraw at any time.

How We Use Your Data

Your data is used for the following purposes:

• Fulfilling and delivering your floral order, including communicating with you about your purchase.
• Handling payment transactions securely via our payment processors.
• Providing customer support and responding to your queries, complaints, or feedback.
• Sending you service-related notifications such as order confirmations and delivery updates.
• With your permission, sending you updates about promotions, seasonal offers, and service information relevant to Eltham Flowers.
• Improving our website services and ensuring network security.

Data Retention

We retain your personal data only as long as is necessary for the purposes outlined in this Privacy Policy and to comply with our legal obligations.

Order and transaction records: Typically held for six years from the date of your purchase to meet accounting and legal requirements.

Communications data: Retained for up to two years, unless you request earlier deletion.

Marketing preferences: Retained until you withdraw consent or opt out of our marketing communications.

At the end of retention periods, your data will be securely erased or anonymised so it can no longer be linked to you.

Data Sharing and Processors

We do not sell your personal data. To facilitate our services, we may share personal data with trusted third-party processors and partners, including:

• Payment processors: To securely process and authorise your card payments.
• IT service providers: Companies that host our website and provide database, email, and order management software.
• Delivery partners: Couriers or delivery drivers who require your contact and address details to fulfil local deliveries.
• Professional advisors: Accountants and auditors for compliance with taxes and business regulations.
  All processors and partners acting on our behalf are contractually bound to adhere to strict data protection standards and may only use your data as instructed by Eltham Flowers.

Your Rights Under GDPR

You have a number of rights as a data subject when your data is processed by Eltham Flowers. These include:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You may correct inaccurate or incomplete personal data at any time.
• Right to Erasure: Also known as the right to be forgotten, you can request we delete your data under certain circumstances.
• Right to Restrict Processing: You may request that we restrict processing your personal data.
• Right to Data Portability: To receive your personal data in a commonly used, machine-readable format.
• Right to Object: You may object to processing, particularly for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time.

To exercise your rights or for any questions about how we use your data, please contact us by writing to our business address or contacting us through our website's enquiry form. We may request verification of your identity before responding to your request. We aim to respond to all requests within one month.

Data Security

Eltham Flowers implements appropriate organisational and technical measures to protect your personal data from loss, misuse, unauthorised access, disclosure, alternation and destruction. While we endeavour to use secure systems and follow best practices, no online transmission can be guaranteed fully secure. If you suspect misuse or unauthorised access to your data, please notify us promptly.

Children's Privacy

Our services are intended for individuals aged 18 and over. We do not knowingly collect or process personal data about children.

Updates to This Policy

This Privacy Policy will be reviewed and updated periodically. The latest version will always be available on our website. Where significant changes are made, we will take steps to notify you in advance where possible.

Contact and Complaints

If you have concerns about your data or are dissatisfied with our response to a privacy request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) or your local data protection authority.