Lewisham Flowers Privacy Policy

Introduction

This Privacy Policy explains how Lewisham Flowers (“we”, “our”, or “us”) collects, uses, stores, and protects your personal information in accordance with the UK General Data Protection Regulation (GDPR) and relevant data protection laws. This policy is especially relevant to customers placing orders with Lewisham Flowers within Lewisham and surrounding districts. We are committed to maintaining the privacy and security of your information at all times.

Scope of this Policy

This policy applies to all individuals who purchase from or interact with Lewisham Flowers, both online and offline, in relation to orders placed from Lewisham and its nearby areas. By using our services, you agree to the practices described in this policy.

Personal Data We Collect

We may collect and process the following categories of personal data depending on your interactions with us:

• Identification Data: Name, recipient name, and title.
• Contact Information: Delivery address, billing address, and postcode.
• Communication Data: Order notes, gift messages, and any emails or communications sent to us.
• Order Details: Product/item selections, purchase history, order references, and delivery preferences.
• Payment Information: Payment confirmation (we do not retain full credit or debit card details, only transaction confirmation and the last four digits of the card where relevant).
• Technical Data: IP address, device information, browser type, and access logs collected through our website for security, analytics, and functional purposes.

Lawful Basis for Processing

Our collection and use of your personal data rests on several legal grounds as required by GDPR:

• Performance of Contract: Processing necessary for fulfilling your order and delivering products to you or your chosen recipient.
• Legal Obligation: Certain data may be processed to comply with legal, regulatory, or tax requirements.
• Legitimate Interests: Processing for our legitimate business interests, such as record-keeping, service improvement, fraud prevention, and responding to customer queries, provided these interests are not overridden by your rights and interests.
• Consent: Occasionally, we may seek your consent for marketing communications. You can withdraw this consent at any time.

How We Use Your Data

We use your personal data to:

• Process and deliver your flower orders accurately and efficiently
• Communicate with you about your order or respond to queries
• Fulfil any customer service requests
• Maintain proper business records (including financial accounts and tax obligations)
• Monitor, improve, and safeguard our services and website
• Send order confirmations, delivery updates, and related service information
• Where consented, send information about our products, services, and promotions

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, including satisfying any legal, accounting, or reporting requirements. Customer order information (including delivery details) is typically retained for up to 6 years to comply with tax and business reporting regulations. Where data is no longer required, it will be securely deleted or anonymised.

Third-Party Processors

We use trusted third parties to support our business operations (“processors”), such as couriers for deliveries, technology providers for website hosting, payment processors, and bookkeeping services. Each is contractually required to handle your data securely and only as instructed by us, in accordance with GDPR requirements. Information is never sold or shared with marketers unconnected to your order. We only share the minimum necessary data with these partners to provide you with our service (for example, passing a delivery address to a courier).

International Data Transfers

Should we transfer personal data outside the UK or the European Economic Area (EEA), we will ensure an adequate level of protection as required by law, such as using approved contractual clauses or ensuring the recipient country benefits from an adequacy decision.

Keeping Your Data Secure

We implement appropriate technical and organisational measures designed to keep your personal data secure. This includes access controls, encryption where relevant, limiting data access to authorised personnel, and regular review of our security procedures. While we strive to protect your personal data, no method of transmission over the internet or electronic storage is totally secure. We will always act swiftly if we identify any suspected data breach.

Your Rights as a Data Subject

You have the following rights regarding your personal data under the GDPR:

• Right to Access: You may request details of the personal information we hold about you.
• Right to Rectification: You have the right to ask us to correct any incomplete or inaccurate information.
• Right to Erasure: In certain circumstances, you can request that we delete your data, such as when it is no longer needed for the purpose collected.
• Right to Restrict Processing: You can ask us to restrict processing in certain circumstances, for example, while we resolve an inaccuracy.
• Right to Object: You may object to our processing of your data where we rely on legitimate interests. We will then stop unless we have compelling legitimate grounds to continue.
• Right to Data Portability: In some cases, you have the right to request a copy of your data in a structured, commonly used format.
• Right to Withdraw Consent: If you have given consent for marketing communications, you may withdraw it at any time.

How to Exercise Your Rights

If you wish to exercise any of your GDPR rights, please contact us using the details provided on our website or place of business. We may need to verify your identity before fulfilling your request to ensure your personal data is protected. We aim to respond to all requests within one month. If you are not satisfied with our response, you also have the right to lodge a complaint with the UK Information Commissioner's Office.

Updates to this Policy

We may update this Privacy Policy occasionally to reflect changes in applicable laws, regulations, or our practices. We recommend reviewing this notice periodically to stay informed about how we are protecting your information.

Contact Us

If you have questions about this Privacy Policy or how your information is handled by Lewisham Flowers, please refer to our website or contact us through our published contact details. Your privacy matters to us, and we are here to address your concerns.