Blackheath Florist Privacy Policy – GDPR Compliance

Introduction

At Blackheath Florist, we are deeply committed to safeguarding your privacy and ensuring that your personal data is processed transparently, lawfully, and fairly. This Privacy Policy outlines how and why we collect, use, and retain your information when you place orders with us from Blackheath and surrounding districts. We comply with the General Data Protection Regulation (GDPR) and regularly review our practices to uphold the highest data privacy standards.

Scope of Policy

This privacy policy applies to all individuals and customers placing orders with Blackheath Florist, either via our website, telephone, or in person, for deliveries and services within Blackheath and nearby districts. By engaging our services, you acknowledge and accept the practices stated in this policy.

What Data We Collect

To fulfil your orders and provide outstanding florist services, Blackheath Florist may collect and process the following categories of personal data:

• Identity Data: Your full name, contact preferences, and title.
• Contact Data: Your delivery address, billing address, email address (if voluntarily provided), and telephone number.
• Transaction Data: Details about payments to and from you, and information about orders you have placed with us.
• Recipient Data: Name, delivery address, and any message included for flower deliveries to third parties.
• Technical Data (if ordering online): Internet Protocol (IP) address, device types, operating system, and web browser type (collected via cookies).
• Correspondence: Any communications you send to us, including special instructions, feedback, or complaints.

We do not collect or process sensitive personal data (special categories of data) unless you have explicitly provided this information and it is strictly necessary for the service requested.

Lawful Basis for Processing

Processing of your personal data is always underpinned by one or more lawful bases as required by the GDPR:

• Contractual Necessity: Most commonly, we process your data to fulfil any contract we have with you, such as processing flower orders and coordinating deliveries.
• Legitimate Interests: We may process your data for our legitimate business interests, such as improving our services, preventing fraud, and managing our relationship with you, provided that these interests do not override your privacy rights.
• Legal Obligation: Certain data may be processed to comply with legal or regulatory requirements, such as tax and accounting obligations.
• Consent: In some circumstances, where required by law (e.g., for certain marketing communications), we will seek your consent prior to processing and you may withdraw this at any time.

How We Use Your Data

The personal data we collect is primarily used to:

• Process and fulfil your orders and delivery requests.
• Communicate with you regarding your order, deliveries, or after-care support.
• Improve and personalise our customer service and offerings.
• Maintain internal records for administrative and regulatory purposes.
• Respond to queries, requests, or complaints you may make.
• If you have agreed, send you marketing communications about products, promotions, or seasonal offers.

Retention of Your Data

We only retain personal data for as long as necessary to fulfil the purposes for which it was collected, including for the ongoing provision of our services, legal, accounting, or reporting requirements. In most cases, this means:

• Order and transactional data is kept for a maximum of 7 years to comply with financial and tax obligations.
• Marketing data (subject to your consent or opt-in) is reviewed regularly and deleted upon withdrawal of consent.
• Recipient data is kept only as long as needed to ensure delivery, after which it is securely deleted or anonymised.

Sharing Your Personal Data: Processors

Blackheath Florist does not sell your data to third parties. However, to fulfil our services, we may share your information with trusted third-party processors, such as:

• Payment service providers tasked with secure payment processing.
• IT and system administration providers supporting our website and internal operations.
• Delivery and courier services engaged in transporting your floral orders.
• Professional advisers (accountants, auditors, or legal advisors), only where required.

All third-party service providers are required to respect the security of your personal data and comply with GDPR obligations. They may only process data on our instructions and are not permitted to use your data for their own purposes.

Security Measures

We implement appropriate technical and organisational measures to safeguard your data against accidental, unlawful, or unauthorised destruction, loss, alteration, disclosure, or access. This includes strict access controls, secure storage, and periodic reviews of our security procedures. Where possible, data is anonymised or pseudonymised.

Your Data Protection Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Right to Access: Request a copy of your personal data held by us.
• Right to Rectification: Request correction of any incomplete or inaccurate data.
• Right to Erasure: Request deletion of your data where there is no legitimate reason for us to continue processing it.
• Right to Restrict Processing: Request restriction on processing your data in certain circumstances.
• Right to Data Portability: Request transfer of your data to another service provider.
• Right to Object: Object to processing of your data where we rely on legitimate interests or for marketing purposes.
• Right to Withdraw Consent: Where we process on the basis of consent, you may withdraw this consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, please contact us using the details provided on our website or in-store. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

Changes to This Policy

We may update this Privacy Policy occasionally to reflect changes in our practices or for legal, regulatory, or operational reasons. Any changes will be effective immediately upon posting on our website or where otherwise communicated to you.

Contact and Complaints

If you have questions, concerns, or wish to exercise any of your data rights, please contact us using the contact methods provided on our website or in-store. If you are dissatisfied with our response to any privacy concern, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).