Privacy Policy for Flowers Kensington Customers

Introduction

This Privacy Policy describes how Flowers Kensington (“we” or “us”) collects, uses, stores, and protects personal data from customers who place orders with us from Kensington and the surrounding districts. We are committed to protecting your personal data and complying with the General Data Protection Regulation (GDPR) and applicable UK data protection laws. Please review this policy to understand how your information is handled when you use our services.

Scope of this Policy

This Privacy Policy applies to all individuals who place orders with Flowers Kensington in Kensington and the surrounding districts. By placing an order, you confirm your agreement with the terms set out in this policy.

What Personal Data We Collect

We collect and process the following categories of personal data to fulfil your orders and provide our services:

• Identification Data: Name, address, postcode
• Contact Details: Phone number (where provided), delivery address
• Order Details: Information about your order, special instructions, delivery dates
• Payment Information: Card payment details are processed securely by our payment processors; we do not store card numbers after the transaction is complete
• Correspondence: Records of any communication with us regarding orders, feedback, or queries

We do not collect or store any special category (sensitive) personal data unless explicitly provided by you for order purposes (e.g., allergy information for floral arrangements). If you voluntarily provide such data, we will treat it with the strictest confidentiality and process it solely to fulfil your request.

Lawful Basis for Processing Personal Data

Our lawful bases for collecting and processing your personal data under the GDPR are as follows:

• Contractual Necessity: Processing your data is necessary to perform the contract of sale when you place an order for flowers or related services with us.
• Legitimate Interests: Processing is required for our legitimate interests, such as managing our services, responding to enquiries, courier logistics, and improving customer experience, provided these interests are not overridden by your rights and freedoms.
• Legal Obligations: We may process or retain your data where required by law, for accounting, tax, or regulatory compliance.
• Consent: Where you provide explicit consent, such as for marketing communications. You have the right to withdraw your consent at any time.

How We Use Your Personal Data

Your personal data is used to:

• Process and fulfil your flower orders, including arranging delivery and confirming details
• Communicate with you about your orders, respond to your enquiries, and provide after-sales support
• Process payments securely via our third-party payment processors
• Improve our services and address any complaints or feedback you may have
• Comply with applicable legal, accounting, and regulatory requirements
• Where applicable, provide you with promotional or marketing information if you have opted in

Retention of Personal Data

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to process your order, deal with any disputes, and meet our legal obligations. In general:

• Order information and related correspondence are retained for up to six (6) years to comply with legal and tax requirements.
• Payment card data is not retained by us after the payment is processed.
• Communications related to enquiries or feedback may be retained for as long as necessary to address your query or feedback.
• Where lawful or necessary, data may be retained for longer (e.g., in case of ongoing legal claims).

Data Processors and Third Parties

To deliver our services, we may engage trusted third-party processors. These include:

• Payment Service Providers: To securely process card payments on our behalf
• Delivery Partners/Couriers: To deliver your floral orders efficiently
• IT and System Providers: Who support our order management, email, and website hosting
• Legal and Regulatory Authorities: When required for compliance with laws or to respond to legal requests

All processors and service providers are contractually required to keep your data secure, to act only on our instructions, and not to use your data for their own purposes. We do not sell or rent your personal information to third parties for their marketing purposes.

Your Rights Under the GDPR

You have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data in certain circumstances ("right to be forgotten")
• Right to Restrict Processing: Request that we limit the use of your data in certain situations
• Right to Data Portability: Request a structured, commonly used electronic copy of your data
• Right to Object: Object to our use of your data where processing is based on legitimate interests or direct marketing
• Right to Withdraw Consent: Where we rely on consent, you have the right to withdraw it at any time without affecting prior processing

To exercise any of these rights, you may contact us using the contact methods provided on our website. We may request proof of identity to safeguard your information.

Security of Your Data

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures include secure payment processing, encrypted data storage (where applicable), access controls, and staff training. We regularly review our security policies and procedures to ensure ongoing protection.

International Data Transfers

Your personal data is generally processed within the UK. Where we need to transfer data outside the UK or European Economic Area (EEA), for example, if a third-party processor is located abroad, we will ensure adequate safeguards are in place to protect your data in compliance with the GDPR.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, service improvements, or legal requirements. We recommend you review this policy regularly. Any significant changes will be highlighted on our website when they take effect.

How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please refer to the contact details provided on the Flowers Kensington website. You may also contact the UK Information Commissioner's Office (ICO) if you are not satisfied with our response.