Ardleigh Green Flowers Privacy Policy

Introduction

This Privacy Policy sets out how Ardleigh Green Flowers collects, uses, stores, and protects your personal information when you purchase flowers or place orders with us. The policy applies to all customers making Ardleigh Green Flowers orders in Ardleigh Green and surrounding districts.

What Data We Collect

When you interact with Ardleigh Green Flowers, we collect only data which is necessary to process your order and provide you with the best possible service. The types of information we collect may include:

• Your full name
• Address (billing and delivery, if different)
• Contact details (such as phone number)
• Order details (including occasion and message for the card)
• Payment details (processed securely through third-party providers; we do not store your full payment card details)
• Correspondence details if you contact us (such as queries or feedback)

We do not actively seek to collect any special categories of personal data (such as health, ethnicity, or religion) about our customers. Please avoid including such information when placing your order.

Lawful Basis for Processing Your Data

Under the General Data Protection Regulation (GDPR), we must have a valid lawful basis to process your personal data. The main lawful bases on which Ardleigh Green Flowers processes your personal data are:

• Contractual necessity: In order to fulfil your order, deliver flowers, and manage customer requests, we require certain personal details.
• Legal obligation: We may be required to retain transaction records to meet obligations under tax or accounting laws.
• Legitimate interests: For the purpose of improving our services, maintaining security, responding to queries or concerns, and certain types of marketing (where appropriate and not overridden by your rights).
• Consent: For sending direct marketing communications, we will only do so with your explicit consent, where applicable. You can withdraw your consent at any time.

Data Retention Periods

Ardleigh Green Flowers keeps your personal data only as long as required for the purposes it was collected, in line with relevant regulations:

• Order and transaction data is typically retained for up to 7 years, as required by law for financial and tax records.
• Customer communications and feedback may be retained for up to 3 years to help respond to queries or improve services.
• Contact details held for marketing purposes will be kept until you withdraw consent or until three years after your last order or correspondence with us, whichever comes first.
• Once the relevant retention period expires, your data will be securely deleted or anonymised.

Use of Data Processors

We sometimes use trusted third parties to help us deliver orders, process payments, or manage our IT systems. Whenever we share your data with a processor, we ensure they are compliant with GDPR and only use your information according to our instructions. Such processors might include:

• Digital payment providers (who process payment card information securely)
• Delivery partners (to help us deliver your order to the right address)
• IT and hosting providers (to store and manage our business data systems securely)

Processors are not permitted to use your data for their own purposes and must meet necessary security requirements. We do not sell your data to third parties or allow their use for unrelated marketing.

How We Protect Your Data

Your personal information is protected by appropriate technical and organisational measures to prevent unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption and secure transmission of sensitive data
• Restricted access to staff with specific training and responsibilities
• Regular review of data systems and security practices

If we become aware of a data breach that may affect your rights or freedoms, we will take immediate steps to notify you and the Information Commissioner’s Office, as required by law.

Your Data Protection Rights

Under GDPR, you have important rights in relation to your personal data, including:

• Right to access: You can request details of the personal data we hold about you.
• Right to rectification: You may ask us to correct inaccuracies or complete incomplete data.
• Right to erasure: You can request the deletion of your personal data, where we have no legal grounds to retain it.
• Right to restrict processing: You can ask us to pause the processing of your data under certain circumstances.
• Right to data portability: Where applicable, you can request your data in a machine-readable format for transfer to another service provider.
• Right to object: You have the right to object to processing, particularly in relation to direct marketing or where processing is based on legitimate interests.
• Right to withdraw consent: Where we rely on your consent to process data, you may withdraw it at any time.

To exercise any of these rights, please contact us using the details provided on our website or through your usual method of communication. We may need to verify your identity before fulfilling your request, to protect your data and that of others.

Policy Updates

This Privacy Policy may be updated from time to time, for example to reflect changes in the law or in how we process your data. The latest version will always be available on our website. Please review it regularly to ensure you are aware of any updates.

Contact and Complaints

If you have any questions about this Privacy Policy or how Ardleigh Green Flowers processes your personal information, please contact us using the methods provided on our website. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office or your local supervisory authority.

This policy is effective as of June 2024 and applies to all orders placed with Ardleigh Green Flowers by customers in Ardleigh Green and surrounding districts.