Flowers Belgravia Customer Privacy Notice

Introduction

At Flowers Belgravia, we are committed to protecting the privacy and security of our customers’ personal information. This Privacy Policy explains how we collect, use, store, share, and protect your data when you place orders with us. It applies to all customers placing orders from Belgravia and the surrounding districts. We adhere to the principles of the General Data Protection Regulation (GDPR) and other applicable privacy laws, ensuring transparency and fairness in all our data handling practices.

What Data We Collect

We collect the following categories of personal data when you engage our services or place an order:

• Identity Data: This includes your name and, if provided, the recipient’s name.
• Contact Details: Your delivery address, billing address, and phone number are required for order fulfillment.
• Order Information: Details of the products or services you purchase, requested delivery date, and order notes.
• Payment Information: Payment transaction details (such as payment method) processed securely through our payment processors. We do not store your complete payment card details.
• Correspondence: Records of your communications with us, including inquiries or feedback you provide by phone, online form, or in writing.
• Technical Data: Information collected through our website such as IP address, browser type, device type, and browsing activity. This data is collected via cookies and similar tracking technologies to ensure website functionality and for security purposes.

Lawful Basis for Processing Your Data

We only process your personal data when we have a valid legal basis. This section outlines our lawful grounds under GDPR:

• Contractual Necessity: Most of the data collected is necessary for us to process your order and fulfill our contract with you.
• Legal Obligation: We retain certain records to comply with tax requirements, accounting, and other legal obligations.
• Legitimate Interests: To protect our business (e.g., anti-fraud measures), improve our services, and communicate relevant product or order information to you, provided these do not override your fundamental rights.
• Consent: For optional processing, such as marketing communications, we will obtain your explicit, recorded consent. You can withdraw this consent at any time.

How We Use Your Data

Your personal data is processed for the following purposes:

• To process, confirm, and deliver your orders.
• To communicate order updates, delivery notifications, or to clarify any order details.
• To handle customer service requests and resolve complaints.
• To comply with our legal and regulatory duties.
• To improve our products and services based on anonymized customer feedback.
• If consent is given, to provide you with updates about new products, special offers, or floral tips.

Data Retention Periods

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, including for legal and accounting requirements:

• Order and transaction data are typically held for up to six years after the order date, in compliance with UK tax and accounting laws.
• Communications (such as emails and order notes) may be kept for up to three years after the last contact, to ensure quality customer service and dispute resolution.
• Where we rely on consent (e.g., for marketing), your data will be retained until you withdraw your consent or request erasure.
• Technical log information is retained for up to two years for security and website performance monitoring.

Processors and Data Sharing

To fulfill our commitments to you, we may need to share your data with trusted third parties who assist in delivering our services. These include:

• Payment processing providers, who securely process your financial transactions.
• IT and website hosting providers, who store and manage customer data under strict confidentiality agreements.
• Delivery partners, for arranging and tracking flower deliveries or contacting recipients where necessary.
• Professional advisers (such as accountants or auditors), where required by law.

All processors acting on our behalf are contractually obligated to process your data securely and may not use it for purposes beyond our explicit instructions. We do not sell your data to any third parties. Data may be transferred or stored securely outside the UK or EEA only when necessary and with adequate safeguards in place, such as approved standard contractual clauses.

Your Data Protection Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right to Access: You have the right to request a copy of the personal information we hold about you.
• Right to Rectification: Let us know if any data we hold is incorrect or incomplete so we can update it promptly.
• Right to Erasure: You may request the deletion of your personal information, subject to certain legal exceptions.
• Right to Restrict Processing: You may ask us to pause or limit the use of your personal data.
• Right to Object: You have the right to object to the processing of your data for certain purposes, such as direct marketing.
• Right to Data Portability: You can request that we transfer your personal data, in a structured and commonly used format, to another provider if feasible.

If you wish to exercise any of these rights, please contact us using the contact details displayed on our website or contact pages. We respond to all rights requests within one month or less in accordance with applicable laws.

Policy Updates

We may revise this Privacy Policy from time to time to reflect changes in our business, legal requirements, or data processing activities. Any updates will be posted on our website, and we encourage you to check regularly for any changes.

Contact and Complaints

If you have any questions, concerns, or complaints regarding our use of your personal data, please get in touch with us via the details provided on our official contact page. You also have the right to raise your concerns with the relevant Data Protection Authority should you feel your rights under GDPR have not been respected.