Privacy Policy for Cambridge Heath Flowers Customers

Introduction

This Privacy Policy outlines how Cambridge Heath Flowers ('we', 'us', or 'our') collects, uses, stores, and protects your personal data in accordance with the UK General Data Protection Regulation (GDPR) and all relevant local laws. This policy applies to all individuals placing orders with Cambridge Heath Flowers within Cambridge Heath and its surrounding districts.

Personal Data We Collect

When you place an order with Cambridge Heath Flowers, we collect and process certain personal information to fulfill your requests and provide our services effectively. The personal data we may collect includes:

• Contact Information: Name, billing and delivery addresses.
• Order Details: Product selections, order notes, preferred delivery times, and recipient information (if you are sending flowers to another person).
• Payment Details: Limited payment information, such as payment confirmation or transaction amounts, processed securely by our chosen payment processors. We do not store full card details on our servers.
• Communication Records: Any emails, correspondence, or messages regarding your order.
• Technical Data: IP address, browser type, and other data automatically collected when accessing our website, to help us improve our services and ensure security.

Lawful Basis for Processing

Cambridge Heath Flowers only processes your data where there is a lawful basis under GDPR. These bases include:

• Contractual Necessity: We process your data to fulfil our contract with you, such as providing and delivering your flower order.
• Legal Obligations: In certain cases, we must process personal data to comply with applicable legal requirements (for example, accounting or tax records).
• Legitimate Interests: We may process your data where it is necessary for our own legitimate interests, such as improving our website, fraud prevention, or maintaining business records, provided these are not overridden by your rights and interests.
• Consent: Where required, we will seek your consent, for instance, if you agree to receive marketing communications. You may withdraw your consent at any time.

How We Use Your Data

Your data is used to:

• Process and fulfill your orders, including delivery of flowers and communication regarding your order status.
• Respond to your enquiries or complaints.
• Process payments securely through our payment processors.
• Improve our services, including website performance and customer experience.
• Maintain accurate business and financial records as required by law.
• Send information regarding promotions or updates if you have opted-in to receive such communications.

Data Retention

We retain your personal data only for as long as is necessary to fulfill the purposes described in this policy or as required by law. Typically, we will maintain customer order and communication records for up to six years to comply with business and taxation requirements. Technical and website usage data may be retained for a shorter period, unless necessary for security or legal reasons.

Once your data is no longer required, it will be securely erased or anonymised so that you can no longer be identified from it.

Data Processors and Third Parties

Cambridge Heath Flowers may use third-party service providers (processors) to assist with certain business operations. These may include payment processing companies, delivery service partners, IT support providers, and website analytics services. We ensure that all third-party processors comply with GDPR requirements and protect your data to the same high standards. Your personal data will not be sold or shared with organisations for their own marketing purposes.

Where such processors operate outside the UK or European Economic Area, we take steps to ensure that your data remains protected through recognized safeguards such as Standard Contractual Clauses.

Protecting Your Data

We implement appropriate technical and organisational measures to protect your personal data, including role-based access controls, encrypted storage solutions, and secure data transfers. Only authorised personnel who require access to your data to perform their duties will be permitted such access. We review and update our security practices regularly to safeguard your information against unauthorised access, loss, or misuse.

Your Rights Under GDPR

Under GDPR, you have several rights in relation to your personal data. These include:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Ask us to correct or complete inaccurate or incomplete information.
• Right to Erasure: Request deletion of your data where there is no lawful basis for its continued processing.
• Right to Restrict Processing: Request that we limit the way we use your data in certain circumstances.
• Right to Data Portability: Request a copy of your data in a structured, commonly used, and machine-readable format, and have it transferred to another data controller where feasible.
• Right to Object: Object to certain types of data processing, such as direct marketing or processing based on legitimate interests.
• Right to Withdraw Consent: If processing is based on your consent, you may withdraw it at any time.
• Right to Lodge a Complaint: Complain to the Information Commissioner’s Office (ICO) if you believe your rights have been infringed.

Policy Updates

We may revise this Privacy Policy from time to time to reflect changes in regulations, our data processing practices, or for other operational reasons. Updates will take immediate effect upon publication. We encourage customers to review this policy regularly to stay informed of how we protect your information.

Contact Us

If you have any questions about this Privacy Policy or about your rights regarding your personal data, please contact us using the details provided on our website. We will endeavour to respond to your queries promptly and to resolve any concerns you may have about your data.