Florist Chessington Privacy Policy for Customers

Scope of This Privacy Policy

This Privacy Policy outlines how Florist Chessington ('we', 'us', 'our') collect, use, store, and protect your personal information when you place an order with us. This policy applies to all customers ordering from Florist Chessington within Chessington and the surrounding districts. By placing an order, you agree to the collection and use of your information as described in this Privacy Policy. We process your data in accordance with the General Data Protection Regulation ('GDPR').

What Data We Collect

When you place an order with Florist Chessington, we collect personal data necessary to fulfil your order and provide the best possible service. The types of data we collect may include:

• Contact Information: Your name, delivery address, billing address, and telephone number.
• Order Details: Information about the products you order, messages for cards or special instructions.
• Payment Information: Transaction details (note: we do not store card information, but payment providers may process it).
• Communication Data: Any information you provide when you contact us via phone, post, or other means.
• Website Usage Data: Information about your visits to our website such as IP addresses, browser types, and access times (collected via cookies and similar technologies).

We only collect data that is necessary to process your order and improve our service. We do not collect or process special categories of personal data (such as health or biometric data) for order processing.

Lawful Basis for Processing Your Data

We process your personal data on one or more of the following lawful bases as defined under GDPR:

• Contractual Necessity: Most of the data we process is needed to perform our contract with you (i.e., fulfilling your order and delivering your flowers).
• Legal Obligation: Certain data may be required to comply with legal or regulatory requirements (such as invoicing and record keeping).
• Legitimate Interests: We may process data to pursue our legitimate interests, such as ensuring the security of our service or improving service quality, provided your interests and rights do not override these.
• Consent: Where required, we will request your consent before processing your data for purposes such as marketing communications. You may withdraw your consent at any time.

How We Use Your Data

We use your personal information for the following purposes:

• Processing and delivering your flower orders.
• Communicating with you about your order or account.
• Handling payments and refunds.
• Improving our products and services.
• Complying with legal and regulatory requirements.
• Responding to your enquiries or feedback.

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

Sharing Your Data with Third Parties (Processors)

We take care to ensure your personal data is only shared with trusted partners and service providers (data processors) who help us deliver our services. These may include:

• Payment processors (to process transactions securely).
• Delivery partners and couriers (to deliver your order).
• IT service providers (who support our website and systems).
• Accountants and professional advisors (for record-keeping and compliance).

All third-party processors are contractually required to protect your data in accordance with GDPR and only process it as instructed by us. We do not sell or rent your personal information to others.

Data Retention: How Long We Keep Your Information

Your personal data is kept only for as long as necessary for the purpose for which it was collected and to comply with legal, accounting, or reporting requirements. In general:

• Order and transaction data is retained for up to seven years to comply with financial and tax regulations.
• Customer communication data is typically retained for up to two years after your last contact with us, unless a longer retention period is required by law.
• If you withdraw consent for marketing or request data deletion, your preferences will be respected, unless we are legally required to retain certain information.

Once retention periods expire, we securely delete or anonymise your data.

How We Protect Your Data

We are committed to securing your personal information. We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, misuse, alteration, or disclosure. These include secure storage, encryption where appropriate, and access controls. Only authorised staff and selected processors have access to your personal information.

Your Rights Under GDPR

You have a number of rights regarding your personal data under GDPR, including:

• Right to Access: You may request a copy of your personal information we hold.
• Right to Rectification: You can request corrections to inaccurate or incomplete data.
• Right to Erasure: In certain circumstances, you may request that your data be deleted ("right to be forgotten").
• Right to Restrict Processing: You can ask us to restrict certain types of processing.
• Right to Data Portability: You may request that we provide your data in a commonly used format.
• Right to Object: You can object to certain processing, such as direct marketing.
• Right to Withdraw Consent: Where consent is the basis for processing, you can withdraw this at any time.

To exercise your rights, please contact us using the contact options on our website or visit us directly at our Chessington location. We will respond to all legitimate requests in accordance with GDPR timelines and requirements.

Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have inadvertently obtained data from a child, we will take steps to delete it as soon as possible.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal compliance. We encourage you to review this policy periodically. When changes are made, we will update the date at the top of the policy.

Contacting Us

If you have any questions or concerns about this Privacy Policy or how your personal data is handled, please contact us using the details provided on our website or visit our premises in Chessington.