Sidcup Florist Privacy Policy

Introduction

This Privacy Policy explains how Sidcup Florist collects, uses, stores, and protects your personal information in compliance with the General Data Protection Regulation (GDPR). This policy is relevant to all customers placing orders with Sidcup Florist in Sidcup and surrounding districts. By engaging with our services, you acknowledge and agree to the practices outlined in this policy.

What Data We Collect

To fulfil your flower orders, Sidcup Florist collects the following categories of personal data:

• Identity Information: Name, surname.
• Contact Information: Delivery address, billing address, postal code, phone number(s), and, where applicable, email address.
• Order Information: Details of your order, special requests, card messages, recipient name and address.
• Transactional Information: Payment confirmation history (no payment card details are ever stored), order value, order date.
• Communications: Any correspondence you send to us via order forms, customer service requests, or feedback.

We do not intentionally collect sensitive categories of personal data (such as information about health, race, religious beliefs, etc.) through our flower order process.

Lawful Basis for Data Processing

Sidcup Florist only processes your personal data when there is a valid legal basis under GDPR. The primary lawful bases for our data processing activities are:

• Contractual Necessity: Processing your data is required to fulfil your floral order, arrange delivery, and communicate order updates.
• Legal Obligation: We may retain certain data for auditing, tax, or regulatory purposes, as required by relevant laws.
• Legitimate Interests: We may process your contact details and purchase history to improve our services and customer experience, provided these interests are not overridden by your data protection rights.
• Consent: If we seek to send you marketing communications beyond your order, we will only do so with your explicit consent. You are free to withdraw this consent at any time.

How We Use Your Data

Your personal information is used solely for the purposes of:

• Processing, confirming, and delivering your order
• Notifying you about order status or issues
• Responding to your inquiries and requests
• Fulfilling our legal and regulatory obligations
• Improving and auditing our services

We do not use your data for automated decision-making that produces legal or similarly significant effects.

Data Retention

Sidcup Florist will not retain your personal data for longer than necessary. Specifically, your personal and order information will be stored securely for a period not exceeding 7 years from the date of your last transaction, in compliance with accounting and tax obligations. After this period, or upon a verified request for erasure (where no legal retention obligation exists), your data will be securely deleted or anonymised.

Processors and Data Sharing

Your personal data may be shared with trusted third-party processors solely for processing your order and delivering our services. These include:

• Payment processors: Secure handling of payment transactions. Your card details are never stored by Sidcup Florist.
• Delivery partners: Florist couriers responsible for delivering your order in Sidcup and nearby areas.
• IT and database hosting providers: To support the secure operation of our website and customer records.

All processors used by Sidcup Florist are contractually obliged to safeguard your data, act only on our instructions, and comply fully with GDPR requirements. We never sell, rent, or trade your personal data to third parties for marketing or profiling purposes.

Your information may be disclosed in the unlikely event it is required by law, regulation, subpoena, or court order, but only to the extent required by such obligations.

International Transfers

Your personal data is stored and processed within the United Kingdom or the European Economic Area. If, in the future, we transfer data outside these regions, this will only be to jurisdictions with adequate protection levels under GDPR or with appropriate safeguards, and you will be notified accordingly.

Your Data Protection Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you at any time.
• Right to Rectification: You may request that we correct or update inaccurate, incomplete, or outdated data.
• Right to Erasure: You may ask for your personal data to be deleted, subject to contractual, legal, or regulatory obligations that may require us to retain certain information.
• Right to Restrict Processing: In certain circumstances, you can request that we limit the way we use your data.
• Right to Data Portability: You may request the transfer of your data to another service provider in a structured, commonly used format.
• Right to Object: You can object to data processing based on legitimate interests. We will comply unless there are compelling legitimate grounds to continue.
• Right to Withdraw Consent: Where data is processed based on your consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, or to make a complaint, please contact us using the details provided via our website or in store. We take your privacy seriously and will respond as required by law.

Security Measures

We are committed to ensuring the security and confidentiality of your personal information. Sidcup Florist uses appropriate technical and organisational safeguards—including encryption, access controls, and staff training—to protect your data against loss, theft, misuse, and unauthorised access.

Updates to this Policy

This Privacy Policy may be updated periodically to reflect legal, operational, or technological changes. Any changes will apply to customers placing orders with Sidcup Florist from Sidcup and surrounding districts after the revised policy's effective date. Please review this policy regularly for the most up-to-date information regarding your privacy.

Contact and Complaints

If you have questions or concerns about how Sidcup Florist collects, uses, or stores your personal data, or if you wish to exercise your rights under GDPR, please contact us using the correspondence details available in-store or on our website. Should you remain dissatisfied, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO).