Privacy Policy for Epsom Flowers Customers

Introduction

At Epsom Flowers, we are committed to protecting your privacy and handling your personal information in a transparent and secure manner. This privacy policy explains how we collect, use, and store your data in line with the General Data Protection Regulation (GDPR). It applies to all customers placing orders with Epsom Flowers for delivery in Epsom and the surrounding districts.

What Data We Collect

When you place an order or interact with Epsom Flowers, we may collect the following types of personal data:

• Identification Details: Name, address, postcode, and contact details of the customer and, if different, the recipient.
• Order Information: Products ordered, delivery instructions, and personalised messages.
• Payment Information: Payment method details (note: payment card data is processed by payment processors and not stored directly by us).
• Communication Records: Correspondence with Epsom Flowers regarding orders, customer service, or feedback.
• Website Usage Data: Data on how you use our website, such as pages visited and order history, if applicable.

Lawful Basis for Processing Personal Data

We ensure that all personal data we process has a lawful basis under GDPR. Our primary reasons for collecting and using your data include:

• Contractual Necessity: Processing is required to fulfil your orders, deliver flowers, and manage payments.
• Legal Obligations: We retain certain records to comply with laws relating to transactions and taxation.
• Legitimate Interests: We may process your data to improve our products and services, enhance user experience, or handle queries efficiently, provided such interests do not override your rights.
• Consent: For certain activities, such as sending direct marketing communications where not based on legitimate interests, we request your permission. You have the right to withdraw consent at any time.

Data Retention

Epsom Flowers retains your personal data only as long as necessary to fulfil the purposes for which it was collected, and to satisfy any legal, accounting, or reporting requirements. Typically, personal data related to orders is kept for up to seven years after your last interaction with us to comply with tax and business record obligations. After this period, your data is securely deleted or anonymised.

Third-Party Data Processors

To deliver an efficient service, we may share your personal data with trusted third-party processors, strictly for the purposes specified in this policy. These processors may include:

• Delivery partners responsible for transporting your flowers to the requested address.
• Payment service providers who handle your payment and ensure secure transactions.
• IT and website hosting providers, who support our business systems and maintain data security.
• Professional advisers, such as accountants, for compliance with legal obligations.

All third-party processors are contractually obliged to safeguard your data and only process it according to our instructions in accordance with GDPR requirements.

Your Rights Under GDPR

As a customer of Epsom Flowers, you have the following rights concerning your personal data:

• Right of Access: You may request a copy of personal information held about you.
• Right to Rectification: You may ask us to correct any inaccuracies or incomplete data we hold.
• Right to Erasure: Also known as the ‘right to be forgotten’, you may request deletion of your personal data where there is no good reason for us to retain it.
• Right to Restrict Processing: Under certain circumstances, you may ask us to limit how we use your data.
• Right to Data Portability: You can request that we transmit your data to yourself or another organisation, where technically feasible.
• Right to Object: You can object to us processing your personal data for direct marketing or other legitimate interests.

To exercise these rights, you may contact us with details of your request. We will respond within one month as required by law, and there is no fee unless requests are unfounded or excessive.

International Data Transfers

Epsom Flowers stores and processes your personal data within the United Kingdom and does not transfer your data outside of the UK or the European Economic Area. Should there be a need in the future to transfer data internationally, we would ensure strict safeguards and notify you of such changes as required by law.

Data Security

We have implemented appropriate technical and organisational security measures to protect your personal data from loss, misuse, unauthorised access, disclosure, alteration, and destruction. Access to your data is strictly limited to those employees and third-party processors who need it to fulfil your order or support our services.

Changes to This Privacy Policy

This privacy policy may be updated from time to time to reflect changes in legal requirements or our business practices. When we make changes, we will revise the date of the update at the end of this document. Please check this policy periodically to remain informed.

Contact and Complaints

If you have any questions about your personal data, how it is used, or wish to raise a complaint about how we have handled your information, please contact us using the details provided on our website. If you are dissatisfied with our response, you have the right to lodge a complaint with the relevant data protection authority.

Last updated: June 2024