Florist Kensington Privacy Policy

Introduction to Our Privacy Policy

At Florist Kensington, your privacy and data protection are of utmost importance to us. This Privacy Policy explains how we collect, use, store, and protect your personal information under the General Data Protection Regulation (GDPR). Our policy applies to every customer placing orders with Florist Kensington, whether residing in Kensington or the neighbouring districts.

Types of Data We Collect

To process flower orders and provide the best service, we may collect the following types of personal data:

• Contact information: Name, billing and delivery addresses, telephone number, and other relevant contact details.
• Order details: Product selections, delivery instructions, recipient details, and associated messages.
• Payment information: Payment method details, transaction records (note: card details are processed only by third-party payment providers and are not stored by us).
• Account information (if you create one): Username, password, and order history.
• Communication data: Any correspondence with us relating to your order or potential queries.
• Technical information: IP addresses, browser type, device identifiers, and similar data collected through cookies and analytics tools for website optimization and security.

Lawful Basis for Data Processing

Florist Kensington only processes personal data when there is a lawful basis to do so, as required by GDPR. Our primary bases include:

• Contractual necessity: Processing your information to fulfil your orders, deliveries, and payments.
• Legal obligation: Retaining certain records to comply with legal requirements such as tax regulations and business audits.
• Legitimate interests: Improving our services, addressing your queries, ensuring website security, and maintaining a record of our interactions, as long as your fundamental rights are not overridden.
• Consent: If we wish to use your data for purposes such as direct marketing, we will obtain your explicit consent, which can be withdrawn at any time.

How We Use Your Data

Your data is processed for the following purposes:

• Fulfilling and delivering your flower orders accurately and efficiently.
• Managing payments and preventing fraudulent transactions.
• Providing customer support, responding to queries, and handling complaints.
• Improving our products, services, and website functionality.
• Maintaining legal and regulatory compliance as a registered business.
• Communicating order updates, service notifications, and – if you have opted in – marketing messages regarding new products or promotions.

Data Retention Policy

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law. Typically:

• Order and delivery records are retained for up to 7 years to fulfil accounting and legal obligations.
• Account information is stored until your account is closed, after which it is deleted unless required for legal reasons.
• If you contact us with an enquiry and do not place an order, we generally retain related data for up to 12 months.
• Marketing preferences and consent records are kept for as long as you remain subscribed, or as required to demonstrate compliance.

Upon expiry of retention periods, your personal data will be securely deleted or anonymised.

Use of Processors and Data Sharing

Florist Kensington may use third-party service providers (known as "processors") to support our operations. These processors include payment platforms, IT support, courier and delivery companies, website hosting services, and analytics providers. All such processors are contractually bound to process data exclusively per our instructions and in full compliance with GDPR standards.

Personal data is never sold to third parties. We only disclose your personal information:

• To trusted processors required to complete your order and provide our services.
• If required by law, such as for regulatory compliance or at the request of law enforcement authorities.

Our contracts ensure that processors implement appropriate security measures to safeguard your data and do not retain or use it for purposes outside the scope of our agreement.

Your Rights Under GDPR

As a customer within Kensington and surrounding districts, you have the following rights regarding your personal data:

• Right to access: Request copies of your personal data we hold.
• Right to rectification: Request correction of any inaccurate or incomplete data.
• Right to erasure: When applicable, request deletion of your data.
• Right to restrict processing: Ask us to limit the processing of your data under certain conditions.
• Right to data portability: Obtain a copy of your data in a commonly used format for transfer to another provider.
• Right to object: Object to specific types of processing, including direct marketing, at any time.
• Right to withdraw consent: Where we rely on your consent, you may withdraw it at any time without affecting prior lawful processing.
• Right to lodge a complaint: You have the right to complain to the relevant data protection authority if you believe we have mishandled your data.

Data Security

We implement reasonable and appropriate technical, organisational, and physical measures to safeguard your personal data from unauthorized access, alteration, disclosure, or destruction. Our relevant employees and third-party processors are required to adhere to strict confidentiality obligations.

International Data Transfers

In the rare case that your data is transferred outside the UK or European Economic Area, we ensure that adequate safeguards, such as Standard Contractual Clauses or an adequacy decision, are in place as required by data protection laws.

Changes to This Privacy Policy

This policy is regularly reviewed and may be updated to reflect changes in our business or legal requirements. The current version will always be available to customers. We encourage you to review it periodically to stay informed on how we are protecting your data.

Contact and Further Information

If you have questions or wish to exercise your rights regarding your personal data, please refer to our website for the latest contact details and procedures. We are committed to addressing your concerns promptly and transparently.