Forest Hill Florist GDPR Privacy Policy

Introduction

This Privacy Policy explains how Forest Hill Florist ('we', 'our', or 'us') handles the personal data of customers placing orders with us from Forest Hill and the surrounding districts. We are committed to safeguarding your privacy and managing personal data responsibly, in compliance with the UK General Data Protection Regulation (GDPR). This Policy provides information about what data we collect, our lawful basis for processing, how long we keep your data, our use of data processors, and your rights.

Scope of the Policy

This Privacy Policy applies to all individuals who place orders with Forest Hill Florist, whether via our website, by telephone, or in-store at our premises, for delivery within Forest Hill and the neighbouring districts. By placing an order with us, you acknowledge the collection and use of your information as described in this Policy.

What Data We Collect

When you place an order or interact with Forest Hill Florist, we collect and process the following types of personal data:

• Contact Information: Your name, address, telephone number, and if applicable, email address.
• Order Details: Details of your order (such as products ordered, delivery message, recipient details, delivery date, and delivery address).
• Payment Information: Limited payment card details are processed via secure payment gateways; we do not store your full payment card information.
• Correspondence: Any communication between you and Forest Hill Florist, including inquiries, complaints, or feedback.
• Technical Data: Basic website usage information and cookies, where applicable, to enhance the customer experience. For more details, please see our separate Cookie Policy.

Lawful Basis for Processing Data

We process your personal data only where we have a valid lawful basis under the GDPR. These bases include:

• Contractual Necessity: Most data processing takes place to fulfil our contract with you, such as processing your order, delivering products, and communicating updates about your order.
• Legal Obligation: We may be required to process your data to comply with UK legal and regulatory obligations, such as record-keeping for tax purposes.
• Legitimate Interest: We have a legitimate interest in running our business efficiently, maintaining customer records, responding to your queries, and promoting our products, provided these interests do not override your rights.
• Consent: In certain situations, such as direct marketing by email, we will seek your explicit consent before processing your data for these purposes.

How We Use Your Data

Your personal data is used for the following purposes:

• Processing, fulfilling, and delivering your floral order
• Communicating regarding your order or responding to customer service requests
• Improving our website and services
• Meeting legal, regulatory, or tax obligations
• Sending marketing communications (if you have consented to receive them)

Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, including meeting any legal, accounting, or reporting requirements. In general:

• Order records are retained for a period of up to seven years to comply with UK tax and accounting laws.
• Marketing consent is kept until you withdraw your consent or request erasure.
• Basic contact information not associated with an order is deleted within two years unless you have subscribed to ongoing communications.

After the applicable retention period, your data will be securely deleted or anonymised.

Processors and Data Sharing

We use carefully selected third-party service providers (processors) to assist with order processing, payment, delivery, and IT support. These may include:

• Payment gateways for secure processing of card transactions
• Delivery or courier services for local and national floral deliveries
• IT providers for maintaining our website and secure data storage

All processors are contractually obligated to protect your data, act only on our instructions, and not share your data with unauthorised parties. Personal data is not sold or shared for third-party marketing purposes.

Your Data Protection Rights

Under the GDPR, you have a range of rights regarding your personal data. As our customer, you can:

• Access: Request a copy of the personal data we hold about you
• Rectification: Ask us to correct inaccurate or incomplete data
• Erasure: Request deletion of your data under certain circumstances ('right to be forgotten')
• Restriction: Request a temporary halt to data processing where accuracy or use is contested
• Portability: Obtain your data in a structured, commonly used format or request transmission to another data controller
• Objection: Object to processing based on legitimate interests or for direct marketing
• Withdraw Consent: Withdraw your consent to marketing or other activities based on consent, at any time

To exercise any of these rights, please contact us using the methods specified on our website or visit our shop to speak with our staff. We will respond to your requests within the timeframes set out in the GDPR and will require confirmation of your identity before fulfilling your request.

Data Security

We take the security of your personal data seriously. Technical and organisational measures are in place to prevent accidental loss, unauthorized access, or theft of your data. Processors are only engaged after appropriate due diligence to ensure their data protection standards meet legal requirements.

Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices or legal obligations. When we make significant updates, we will notify customers in-store or through our website. The most current version of this Privacy Policy will always be available for your review before you place an order.

Contact and Complaints

If you have any questions about this Privacy Policy or how your personal data is handled, please contact us using the details provided on our website or speak to our team in-store. If you remain dissatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).