Privacy Policy for Customers Ordering from Sutton Florist

Introduction

At Sutton Florist, we are dedicated to protecting the privacy of our customers and ensuring the confidentiality of all personal data collected during the ordering process. This Privacy Policy outlines how we process, store, and protect your information in compliance with the UK General Data Protection Regulation (GDPR). This policy applies to all customers placing orders with Sutton Florist from Sutton and surrounding districts, whether online, by phone, or in person.

What Data We Collect

We collect information necessary to fulfil your order and provide our floral delivery services. Depending on how you interact with us, we may collect the following categories of personal data:

• Contact Details: Your name, address, phone number, and delivery address details.
• Order Information: Details of the products or services you order, including gift messages and special requests.
• Payment Information: Payment card details or transaction reference numbers. Please note, card details are processed securely and not stored directly by Sutton Florist.
• Recipient Information: Name, delivery address, and phone number of recipients (if different from the ordering customer).
• Correspondence: Records of any communications between you and Sutton Florist, including queries, requests, and feedback.
• Technical Data: Limited data relating to how you access our website, such as IP address, browser type, device, and cookies (as per our cookie policy).

Lawful Basis for Processing

Under GDPR, we are required to have a lawful basis to process your personal data. Sutton Florist processes your personal information primarily on the following grounds:

• Contractual Necessity: Most of the data we collect is necessary to enter into or perform a contract with you. For example, we need your contact and order details to deliver your flowers.
• Legal Obligation: We may process certain data to comply with legal or regulatory requirements, such as financial record-keeping and accounting.
• Legitimate Interests: We may also process your data for our legitimate business interests, such as improving our services, handling queries, or ensuring security and fraud prevention, provided these interests do not override your fundamental rights.
• Consent: Where we rely on your consent (for example, for marketing communications), you have the right to withdraw it at any time.

Data Retention

We retain your personal data only as long as is necessary to fulfil the purposes for which it was collected. Typically, this means:

• Order and transactional information is retained for up to seven years in line with legal and financial record-keeping obligations.
• Contact and recipient details are retained for a minimum period necessary for order fulfilment and service guarantee, after which they may be securely deleted or anonymised.
• Correspondence may be kept for up to three years to deal with queries or complaints.
• If you have subscribed to marketing or promotional communications, we will retain your details until you withdraw your consent or opt-out.

Data Processors and Sharing

Your information may be shared with trusted third-party service providers (processors) who support our operations. These may include:

• Payment processing providers to facilitate secure transactions.
• Technology partners for website hosting, email delivery, and order management systems.
• Delivery couriers to deliver your order to you or your recipient.
• Professional advisors (e.g., accountants) as part of our legal requirements.

All third-party processors are required to adhere to strict data protection standards, only process your data on our instructions, and are not allowed to use it for their own purposes. We do not sell or rent your personal data to any third parties for marketing purposes.

User Rights under GDPR

You have various rights under GDPR regarding your personal data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete data.
• Right to Erasure: You can request deletion of your personal data, subject to certain legal conditions.
• Right to Restrict Processing: You can request a restriction of the processing of your data in certain circumstances.
• Right to Object: You can object to the processing of your data for direct marketing or where processing is based on our legitimate interests.
• Right to Data Portability: Where applicable, you can ask us to transfer your data to another provider.

To exercise any of these rights, please contact us using the contact form available on our website or by writing to our business address. We will respond to your request in accordance with GDPR requirements and may need to verify your identity before acting. There is no fee for most requests, although we reserve the right to charge a reasonable fee if a request is unfounded or excessive.

Security of Your Data

We have implemented appropriate technical and organisational measures to ensure the security and confidentiality of your personal data. These include secure storage, encryption of sensitive data, restricted access controls, and regular staff training. However, please note that no data transmission over the internet can be guaranteed as entirely secure.

International Transfers

Your data is primarily processed and stored within the UK. If we need to transfer your data outside the UK or European Economic Area, we will ensure that adequate safeguards are in place, such as standard contractual clauses or the use of providers certified under appropriate data protection frameworks.

Policy Changes

We may update this Privacy Policy from time to time to reflect changes in legal obligations or the way we process your personal data. The updated version will always be available on our website with the latest revision date. We encourage you to review this policy periodically.

Contact and Complaints

If you have any further questions about how we use your personal data or wish to raise a concern, please contact us using the online contact form or by writing to our business address. If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK’s data protection regulator, though we would appreciate the opportunity to address your concerns first.