Privacy Policy for Flowers Fortis Green Customers

Introduction to Our Privacy Policy

At Flowers Fortis Green, we are dedicated to respecting and safeguarding the privacy of our customers. This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the General Data Protection Regulation (GDPR). This policy applies to all customers placing orders with Flowers Fortis Green from Fortis Green and its surrounding districts.

What Personal Data We Collect

When you place an order or interact with us, we may collect and process the following categories of personal data:

• Identification Details: Your full name, billing address, and delivery address.
• Contact Information: Telephone numbers and, where required for order processing, email address.
• Order Details: Information about the products you have ordered, including messages for card enclosures where you supply them.
• Payment Information: Payment card or transaction details processed through our secure payment provider. We do not store your payment card details ourselves.
• Correspondence: Records of communications such as feedback, queries, or complaints.
• Technical Information: Limited device and browsing information collected automatically when you access our website (such as IP address and browser type) to ensure effective operation and security.

Lawful Basis for Processing Your Data

We process your personal data under the following lawful bases as defined by GDPR:

• Contractual Necessity: Most of our data processing is necessary to fulfil our contract with you as a customer, such as processing and delivering your floral orders and handling payments.
• Legitimate Interests: We may process your data as necessary for our legitimate business interests, including managing our business operations, improving our services, and preventing fraud, provided these interests are not overridden by your rights and interests.
• Legal Obligations: In some cases, we must process data to comply with statutory obligations, such as accounting, taxation, or responding to law enforcement requests.
• Consent: Where you specifically consent (for example, opting in to marketing communications), we will process your data for these purposes. You can withdraw your consent at any time.

How We Use Your Information

Your personal data is used to:

• Process and deliver your flower orders efficiently.
• Update you regarding your orders or respond to your queries.
• Handle payments through our secure payment processors.
• Meet our legal and regulatory responsibilities.
• Improve our customer service and operate our website securely.
• Send relevant marketing information if you have opted in to receive it.

How Long We Retain Your Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Generally, we keep order and transaction records for up to six years to comply with accounting and tax regulations. Where data is processed for marketing, we retain it until you opt out or withdraw your consent. Correspondence may be retained for up to one year after resolution unless a longer period is legally required. After these periods, your data will be securely deleted or anonymised.

Data Processors and Third Parties

In delivering our services, we use reputable third-party service providers (data processors) who process your information on our behalf. These may include:

• Payment processing companies for secure handling of transactions.
• Website hosting and IT support providers responsible for the security and maintenance of our systems.
• Logistics and courier services for delivery of your flower orders.
• Professional advisors such as accountants and legal consultants where required.

All processors are contractually required to protect your data, only process it for the intended services, and adhere to GDPR requirements. We do not sell or share your personal data with third parties for commercial purposes.

International Data Transfers

Your data is generally processed within the United Kingdom or European Economic Area (EEA). If it is necessary to transfer your data outside of the UK or EEA (for example, if an IT provider is based abroad), we will ensure appropriate safeguards are in place such as ensuring the destination country is recognised as having adequate data protection standards or utilising standard contractual clauses approved by the UK or EU.

Your Data Protection Rights

As a customer, you have the following rights regarding your personal data under the GDPR:

• The right to be informed: You have a right to know what personal data we collect and how we use it, as set out in this policy.
• The right of access: You can request a copy of the personal data we hold about you.
• The right to rectification: You may ask us to correct inaccurate or incomplete data.
• The right to erasure: You can request deletion of your personal data in certain circumstances.
• The right to restrict processing: You may ask us to limit how we use your data.
• The right to data portability: You can ask us to provide your data in a format that allows you to move it to another provider.
• The right to object: You may object to processing based on legitimate interests or direct marketing.
• Rights regarding automated decision-making: If we use automated systems for decision-making, you have the right not to be subject to decisions based solely on automated processing.

You may exercise these rights at any time. We aim to respond to all legitimate requests within one month, or inform you if more time is required. Please note, certain rights may be limited due to legal obligations or legitimate business needs.

Data Security

We place great importance on keeping your data safe. We use appropriate technical and organizational measures to safeguard your personal data against unauthorised access, accidental loss, destruction, or damage. Access to personal data is strictly controlled and limited to those who need it for business or legal purposes.

Policy Updates

We may occasionally update this Privacy Policy to reflect changes in the law or our internal practices. All changes will be posted on our website with the revised effective date. Please review this document regularly to stay informed about how we protect your information.

Contact and Further Information

If you have questions or concerns about this policy or how we process your data, please contact us through the available channels shown on our website. If you have unresolved concerns, you also have the right to lodge a complaint with the UK Information Commissioner's Office or your local supervisory authority.

This Privacy Policy is effective as of 1 June 2024 and applies to all Flowers Fortis Green customers in Fortis Green and surrounding districts.