Flower Delivery Norbury Privacy Policy – GDPR Compliance

Introduction

This Privacy Policy explains how Flower Delivery Norbury ('we', 'our', 'us') collects, uses, stores, and protects your personal data when you place an order with us. This policy applies to all customers placing Flower Delivery Norbury orders from Norbury and the surrounding districts. We are committed to maintaining the highest standards of privacy and complying with the General Data Protection Regulation (GDPR).

What Data We Collect

We collect and process a range of personal data to provide flower delivery services. This may include:

• Full name (sender and recipient)
• Delivery address and billing address
• Contact details such as phone number (sender and recipient)
• Email address (sender only, unless otherwise supplied)
• Order contents (details about purchased products and special delivery instructions)
• Payment information (processed securely by third-party providers)
• Correspondence with us (including customer queries and complaints)
• IP address and technical data (when placing online orders, for security and analytics)

We do not intentionally collect or process special category data (such as health information or data related to ethnicity or religious beliefs) through our website or order processes.

Lawful Basis for Processing Personal Data

Under GDPR, we process your personal data only when we have a lawful basis to do so. Our lawful bases include:

• Contractual necessity: To fulfil your order and deliver goods to you or your recipient
• Legal obligation: To comply with legal and tax regulations
• Legitimate interests: To improve services, address queries, and prevent fraud (provided such interests do not override your rights and interests)
• Consent: For direct marketing or promotional purposes, only where explicit consent has been given (for example, subscribing to our newsletter)

How We Use Your Data

We use the personal data collected to:

• Process and fulfil your flower delivery orders
• Communicate with you regarding your order or queries
• Arrange delivery logistics (such as contacting recipients about the delivery)
• Comply with legal obligations and record-keeping requirements
• Improve our website, customer service, and product offerings
• Send you marketing communications (only if you have consented)

Data Retention

We retain personal data for no longer than is necessary to fulfil the purposes for which it was collected or as required by law. In general:

• Order records (including names, addresses, and contact details) are retained for up to 7 years to comply with accounting and legal requirements.
• Marketing data is retained until you withdraw consent or unsubscribe from communications.
• Technical data and analytics are anonymised or deleted within 24 months.

Once your data is no longer required, it is securely deleted or anonymised.

Data Processors and Data Sharing

We share your personal data only with trusted third parties ('data processors') who assist us in delivering our services, strictly in line with GDPR requirements. These processors may include:

• Payment service providers (to process billing securely)
• Delivery partners (to arrange and confirm delivery of your flower order)
• IT service providers (who help host and maintain our website and systems)
• Email service providers (for order confirmations and service communication)
• Professional advisors and auditors (where legally required)

These data processors act under our instructions and are obligated to process your data securely and only for specified purposes. We do not sell or rent your personal data under any circumstances.

International Data Transfers

We primarily store and process personal data within the United Kingdom and the European Economic Area (EEA). If we transfer data outside the EEA, we ensure adequate safeguards are in place as required by the GDPR, such as standard contractual clauses or verification of adequacy decisions.

Your Data Protection Rights

You have the following rights in respect of your personal data under the GDPR:

• Right of access: Request a copy of your personal data and information about how it is processed
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data in certain circumstances
• Right to restrict processing: Request restriction or suppression of your data processing in certain situations
• Right to data portability: Receive your data or have it transmitted to another controller in a structured, commonly used format
• Right to object: Object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: If processing is based on consent, you may withdraw this consent at any time
• Right to lodge a complaint: Lodge a complaint with the Information Commissioner’s Office (ICO) or your local supervisory authority

To exercise any of your rights, please contact us using the contact information available on our website. We may need to ask for proof of identity before responding to your request.

Data Security

We are committed to the security of your data. Appropriate physical, technical, and administrative measures are in place to protect against unauthorised or unlawful processing, accidental loss, destruction, or damage. Our website uses secure SSL encryption for all transactions, and access to personal data is strictly limited to authorised personnel.

Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect or maintain personal data from individuals under this age. If you believe a child has provided us with personal data without parental consent, please inform us so we can take appropriate action.

Policy Updates

This policy is reviewed regularly and may be updated from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website. By continuing to use our services, you agree to the terms of the latest version of this Privacy Policy.