Fitzrovia Flowers Privacy Policy
Introduction
This Privacy Policy explains how Fitzrovia Flowers collects, uses, stores, and protects your personal data when you place an order with us. We are committed to ensuring your privacy and processing your personal information in accordance with the General Data Protection Regulation (GDPR) and all applicable UK data protection laws. This policy applies to all customers placing orders with Fitzrovia Flowers from Fitzrovia and the surrounding districts.
What Information We Collect
When you place an order with Fitzrovia Flowers, we may collect and process the following types of personal information:
- Contact Information: Name, delivery address, billing address, and other order-related addresses.
- Contact Details: Phone number and, where provided, email address.
- Payment Information: Only the necessary payment data required to process your transaction, such as card type and final four digits. We do not store complete payment details; these are processed securely by our third-party payment processors.
- Order Details: Information about the items you order and special instructions.
- Correspondence: Any information you provide in communications with us, such as messages or requests.
- Technical Data: IP address, browser type, device information, and website usage statistics (collected via cookies and analytics tools).
Our Lawful Basis for Processing Your Data
We rely on different lawful bases to process your personal data under the GDPR, depending on the specific purpose:
- Contractual Necessity: Most of the personal data we collect is necessary to process and fulfil your order, such as contact and delivery details.
- Legal Obligation: We may process certain personal data to meet legal requirements, such as maintaining transaction records for tax purposes.
- Legitimate Interests: We may process your data for our legitimate business interests, such as improving our services, handling potential complaints, and ensuring security. We ensure these interests do not override your rights and freedoms.
- Consent: In cases where we are required to obtain your consent (for example, for marketing or promotional activities), you have the right to withdraw your consent at any time.
How We Use Your Information
We use your personal data to:
- Process, confirm, and deliver your flower orders
- Communicate with you regarding orders, updates, and any issues
- Handle payments and refunds via secure third-party processors
- Comply with accounting, auditing, and other legal requirements
- Respond to customer inquiries or complaints
- Improve our website and services through analytics
Data Retention
We will retain your personal data only for as long as necessary for the purposes set out in this Privacy Policy, including complying with any legal or accounting requirements. Typically, identifiable order information will be retained for six years from the date of your transaction to meet our record-keeping requirements. Data used solely for analytical purposes may be retained in an anonymised or aggregated form.
Data Processors and Third Parties
In order to provide our services, we may share your personal data with selected third-party service providers acting as data processors on our behalf. These may include:
- Payment processors who handle transactions securely and do not retain payment details beyond processing
- Delivery partners or couriers to ensure the fulfilment of your order
- IT service providers who assist in maintaining our website and systems
- Professional advisors (such as accountants or legal counsel) when necessary
We require all our third-party service providers to respect the security of your personal data and to process it in accordance with the law. They are not permitted to use your data for their own purposes.
Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against accidental loss, misuse, unauthorised access, disclosure, alteration, or destruction. These measures include secure storage systems, encryption, and restricted access based on business need-to-know principles.
Your Rights Under GDPR
As an individual whose data we process, you benefit from the following rights under the GDPR:
- Access: You have the right to request a copy of the personal data we hold about you.
- Rectification: You may request correction of any inaccurate or incomplete personal data.
- Erasure: You can ask us to delete your personal data in certain circumstances (commonly known as the “right to be forgotten”).
- Restriction: You have the right to restrict the processing of your personal data in specific cases.
- Portability: You can request the transfer of your data to you or another organisation in a structured, commonly used machine-readable format.
- Objection: You may object to processing that is based on our legitimate interests, as well as to direct marketing.
- Withdrawal of Consent: Where we process data based on your consent, you have the right to withdraw your consent at any time.
To exercise any of these rights, please contact us using the contact details provided on our website or in your order confirmation communications. We may need to verify your identity before fulfilling your request.
Policy Updates
We may update this Privacy Policy from time to time to reflect changes to our practices, legal requirements, or for any other operational reasons. When we do, the revised policy will be posted on our website with a new revision date. We encourage you to review this page periodically to stay informed about how we protect your personal data.
Contact and Complaints
If you have any questions about this Privacy Policy or how we process your personal data, please get in touch with us using the contact information on our website. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.
