Old Malden Florist GDPR Privacy Policy

Introduction

This Privacy Policy explains how Old Malden Florist ('we', 'us', 'our') collects, processes, stores, and protects your personal data when you place an order with us. This policy is relevant to all customers ordering from Old Malden and the surrounding districts. We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR) and other applicable laws.

The Information We Collect

When you place an order with Old Malden Florist, we collect and process various types of personal data. The specific information we gather may include:

Identity Information: Your name, the recipient's name, and where relevant, titles or salutations.
Contact Details: Address, telephone number, and delivery address, for both sender and recipient.
Order Information: Details of your floral purchase, order notes, and preferences such as card messages.
Payment Information: Transaction details, though please note payment card details are processed securely by our payment service providers and are not stored on our systems.
Communication Records: Any correspondence with us, such as queries, complaints, or feedback provided by phone, in-person, or through written communication.

We do not intentionally collect data relating to children or any special category data (e.g., health or religious information).

Lawful Basis for Processing

Under GDPR, we must have a lawful basis for each way we use your data. Our primary lawful bases include:

Contractual Necessity: Processing is necessary to fulfil your order, including processing payment, making arrangements for delivery, and managing order queries.
Legal Obligation: Certain processing (such as invoicing and retention of transactional data) is required to comply with the law.
Legitimate Interests: Where we have a legitimate interest in using your data (such as improving our services or handling customer feedback), and this is not overridden by your rights.
Consent: For direct marketing or promotional communication, we will always obtain your explicit consent, which you have the right to withdraw at any time.

How We Use Your Data

We use your personal data to:

Process and fulfil your flower orders.
Arrange for the correct and timely delivery of floral products and gifts.
Communicate with you regarding your order status, questions, or any issues that may arise.
Improve our services and your customer experience based on feedback.
Comply with legal and regulatory requirements.
If you agree, send updates or marketing communications about future offers or services.

How We Store and Protect Your Data

Your personal information is stored securely on our systems and with trusted service providers. We implement appropriate technical and organizational measures to ensure your data is protected against loss, misuse, unauthorized access, disclosure, alteration, or destruction. Access to your personal data is strictly limited to those employees or contractors who need it for legitimate business purposes.

Data Retention

Your data is retained only as long as necessary for the purposes set out in this policy or as required by law. Typically, order and transactional data will be kept for a period determined by financial and auditing regulations, generally up to seven years. After this period, your data will be securely deleted or anonymized unless continued retention is required for legal reasons or active customer relationship management (with your explicit ongoing consent).

Third-Party Processors

We use carefully selected third-party processors to assist us in providing our services. These include:

Payment service providers to process payments securely.
IT service providers who host and maintain our order systems, website, and communication tools.
Delivery providers who may receive delivery details for completing your floral order.

In each case, we ensure that all data processors comply with GDPR, are contractually bound to handle your data securely, and only process it in accordance with our instructions. We do not sell or share your personal data with third parties for their own direct marketing purposes.

Your Data Protection Rights

Under GDPR, you have specific rights in relation to your personal data. These include:

Right of Access: Obtain a copy of the personal information we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Ask for your data to be deleted where there is no compelling reason for us to continue processing it.
Right to Restrict Processing: Request that we limit the way we use your information in certain circumstances.
Right to Data Portability: Receive your data in a commonly used format and transfer it to another controller if you wish.
Right to Object: Object to certain types of processing, such as direct marketing.

You can exercise these rights at any time (subject to certain legal exceptions), and we aim to respond to any legitimate requests within one month.

International Data Transfers

We aim to keep your data within the European Economic Area (EEA). If we ever need to transfer your information outside of the EEA, we will ensure that it is protected by appropriate safeguards, as required under GDPR.

Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or our business operations. We encourage you to review this privacy notice regularly to stay informed about how we protect your information. The latest version will always be made available by request or through our primary points of sale.

Contact and Complaints

If you have questions about how your personal data is used or wish to exercise your rights, please contact us through our usual business channels. If you have unresolved concerns, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) or your local data protection authority.

This policy applies to all orders placed with Old Malden Florist by customers in Old Malden and surrounding districts.