Florist Wembley Privacy Policy for Customers

Introduction

This Privacy Policy explains how Florist Wembley collects, uses, stores, and protects your personal data when you place an order with us from Wembley or any of the surrounding districts. Florist Wembley is committed to safeguarding your privacy and complying with all applicable data protection laws, including the General Data Protection Regulation (GDPR). This policy outlines the types of information we collect, the purposes for processing your information, how long we retain it, and your rights as a data subject.

Scope of This Policy

This privacy policy applies to all customers who place orders with Florist Wembley, whether ordering flowers and related products online, by telephone, or in person. It is applicable for customers based in Wembley and the adjoining areas that we serve.

What Data We Collect

We may collect and process various types of personal data about you, depending on the nature of your interactions with us. The information we collect may include:

• Identity Data: Name, title.
• Contact Data: Delivery address, billing address, email address (if provided), and telephone number (if provided).
• Order Data: Details of products and services you have purchased, recipient information (such as name and delivery address), and any messages included with your order.
• Payment Data: Payment method details (note: payments are processed through secure third-party providers; we do not store full payment card details).
• Communication Data: Records of communications such as queries, feedback, or complaints.
• Technical Data: Automatically collected data such as IP address, browser type, operating system, and how you use our website (if ordering online).

Lawful Basis for Processing Your Data

The GDPR requires us to have a lawful basis for processing your personal data. Florist Wembley relies on one or more of the following lawful bases:

• Contractual Necessity: Processing your data to fulfill your orders, deliver products, and manage payments.
• Legal Obligation: Retaining certain records as required by law (for example, for tax or accounting purposes).
• Legitimate Interests: Using your data to improve our services, handle enquiries, prevent fraud, and market relevant products (only where permitted).
• Consent: Where required, and you have provided your explicit consent (for example, subscribing to marketing communications).

How We Use Your Information

Your data will be used solely for specific, explicit, and legitimate purposes, primarily to:

• Process and fulfil orders for you or your nominated recipients.
• Communicate order confirmations and updates.
• Handle your queries, feedback, and customer service issues.
• Meet our legal and regulatory obligations.
• Enhance our website and service offerings (using technical and usage data).
• Send you marketing information if you have agreed to receive it (you may withdraw consent at any time).

How We Share and Store Your Data

Your personal information is treated as confidential and only shared with third parties where necessary to process your order or meet legal requirements. These may include:

• Payment and Transaction Processors: Securely process payments on our behalf.
• Delivery Partners: Couriers and postal services for delivering products.
• IT Service Providers: Support and maintain our business systems.
• Professional Advisors: Accountants, insurers, and legal advisors, if required.
• Regulatory Authorities: If the law requires us to disclose information to authorities.

All processors handling personal data on our behalf operate under strict contractual controls and comply with GDPR requirements. We do not sell or rent your data to third parties for marketing purposes.

Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Typically, this means we keep order and delivery records for up to seven years for tax and regulatory reasons. Communication and enquiry data are generally kept for up to two years after the interaction. When data is no longer needed, it is either deleted securely or anonymised so it cannot be linked back to you.

Your Data Protection Rights

Under the GDPR, you have certain rights regarding your personal data:

• Right of Access: You can request information about what personal data we hold about you and how it is used.
• Right of Rectification: You may ask us to correct or complete your personal data if it is inaccurate or incomplete.
• Right to Erasure ("Right to be Forgotten"): In some circumstances, you can request we erase your personal information.
• Right to Restrict Processing: You can request that we restrict the way we process your data in certain situations.
• Right to Data Portability: You can request a copy of your information in a common machine-readable format.
• Right to Object: You can object to certain types of processing, such as receiving direct marketing communications.
• Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time.

To exercise any of these rights, please contact us through our website or by post. We do not accept requests via phone or instant messaging for security reasons. We will respond as quickly as possible and within all required legal time limits.

International Data Transfers

Florist Wembley processes and stores customer data within the United Kingdom and the European Economic Area (EEA). If we ever need to transfer your data outside these areas for specific processing purposes, we will take steps to ensure your data is protected with appropriate safeguards as required by data protection law.

Protecting Your Data

We employ appropriate technical and organisational measures to keep your personal information safe from loss, misuse, unauthorised access, disclosure, alteration, or destruction. These measures include physical controls, IT security, access controls, and regular staff training on data protection.

Children's Data

Our products and services are not intended for use by children under the age of 16. We do not knowingly collect information from anyone under 16 years of age. If you believe a child has provided us with their data, please notify us so we can delete the information.

Changes to This Privacy Policy

We reserve the right to update this Privacy Policy as necessary to reflect changes to our data practices or legal requirements. Please review this policy regularly. Where significant changes are made, we will make reasonable efforts to inform you.

Contact and Complaints

If you have questions about this Privacy Policy or how your personal information is handled, please contact us through our website or by writing to our postal address. Should you wish to make a complaint, you may also contact the UK Information Commissioner's Office (ICO). We will always aim to resolve concerns professionally and promptly.