Privacy Policy for Chiswick Flowers Orders

About This Privacy Policy

This Privacy Policy explains how Chiswick Flowers collects, uses, stores, and protects your personal data when you place an order with us, whether online, by phone, or in person. It also outlines your rights under the UK General Data Protection Regulation (GDPR). This policy applies to all customers placing orders from Chiswick and the surrounding districts. Please read this privacy notice carefully so you are fully aware of how and why we process your data.

What Data We Collect

When you order flowers or products from Chiswick Flowers, we collect the following types of personal data where relevant:

• Contact Information: Your full name, phone number, and postal address.
• Order Details: Items purchased, delivery address, recipient’s name and contact details if different, special instructions, and order value.
• Payment Information: Payment card details (processed securely by our payment partners; we do not store your full payment details ourselves).
• Communication Preferences: Your preferences regarding marketing and updates.
• Correspondence: Any communications between you and Chiswick Flowers (for example, messages regarding your order).
• Technical Information: IP address, browser type, and device information if you use our website.

Lawful Basis for Processing Your Data

Chiswick Flowers collects and processes your personal data for several purposes. Our lawful bases are as follows:

• Contractual Necessity: To process and fulfil your order, deliver flowers/products, process payments, and provide customer service. Without this data, we would be unable to fulfil our contractual obligations to you.
• Legal Obligation: To comply with financial and tax regulations relating to record-keeping and accounting.
• Legitimate Interests: For our legitimate business purposes, such as managing our operations, improving services, handling queries, or sending relevant marketing (if you have not opted out).
• Consent: If we process your data for marketing purposes, we will only do so if you have provided explicit consent. You can withdraw your consent at any time.

How We Use Your Information

Your personal data is primarily used to:

• Process, confirm, and deliver your order to the correct location
• Send you order confirmations and deliver updates
• Respond to questions or customer service requests
• Keep legal business records for accounting and tax
• Send you service-related communications and, if agreed, relevant marketing
• Improve the quality and safety of our website and customer service

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Generally, we keep:

• Order and customer records for up to 7 years to comply with legal requirements.
• Marketing preferences until you withdraw your consent or opt-out.
• Website analytics for a shorter period, typically up to 12 months.

When we no longer need your data, it will be deleted or anonymised.

Sharing Your Information and Data Processors

Chiswick Flowers may share your personal data with trusted third parties (processors) for the following reasons:

• Payment Service Providers: To process your payments securely. We do not retain full payment details.
• Delivery Partners: To ensure your order reaches the intended recipient (address and contact information is shared only as required for the delivery).
• IT and System Providers: For hosting, website management, and customer database management.
• Professional Advisors: For legal, accounting, or tax advice, if necessary.

All processors are carefully selected and required to comply with GDPR and keep your data secure. Data is not sold or transferred outside the UK or European Economic Area unless adequate protection measures are in place.

Your Rights Under GDPR

Under the UK GDPR, you have various rights regarding your personal data:

• Right to Access: Request a copy of any personal data we hold about you.
• Right to Rectification: Ask us to correct any inaccurate or incomplete data.
• Right to Erasure (‘Right to Be Forgotten’): Ask us to erase your personal data, subject to legal and contractual constraints.
• Right to Restrict Processing: Ask us to restrict how we process your data under certain circumstances.
• Right to Data Portability: Obtain your data in a structured, machine-readable format and transfer it to another provider.
• Right to Object: Object to processing based on our legitimate interests or direct marketing.
• Right to Withdraw Consent: Withdraw consent to marketing at any time; this does not affect the lawfulness of processing before your withdrawal.

To exercise any of these rights, please contact us using the contact details on our website or in your order confirmation. We will respond promptly and in accordance with GDPR requirements.

Data Security

We have implemented appropriate security measures to prevent your data from being lost, accessed, or used in an unauthorised way. Only authorised staff and approved processors can access your data, and all are required to maintain confidentiality.

Policy Updates

This Privacy Policy may be updated periodically to reflect changes in our practices or for legal reasons. When we update, we will revise the 'Last Updated' date at the top of this document. Customers are encouraged to review the policy regularly.

Contact and Complaints

If you have any questions about how we handle your personal information or if you wish to make a complaint, please contact us using the contact details provided on your order confirmation or available on our website. If you are not satisfied with our response, you have the right to contact the UK’s Information Commissioner’s Office (ICO).