Florist Sutton Privacy Policy

About This Privacy Policy

This Privacy Policy explains how Florist Sutton collects, uses, protects, and stores your personal data when you place orders with us, whether online, over the phone, or in person. It applies to all our customers in Sutton and the surrounding districts, ensuring your privacy rights under the General Data Protection Regulation (GDPR) are respected and protected at all times.

What Data We Collect

When you place an order with Florist Sutton, we collect only the personal information necessary to process your request, fulfil our services, and comply with legal requirements. This may include:

• Name: To identify and address you.
• Contact details: Such as delivery address, phone number (for delivery or clarifications), and any alternative recipient details provided for gifting purposes.
• Email address: Required for order confirmations, receipts, and customer communication.
• Payment information: Including card or bank details processed securely through our payment processors. We do not retain payment details after transaction completion.
• Order history and preferences: For customer service and repeat orders.
• Other relevant notes: Such as delivery instructions or personalized messages as specified by you.

Lawful Basis for Processing

All personal data collected by Florist Sutton is processed lawfully, fairly, and transparently under GDPR guidelines. Our lawful bases for processing your data include:

• Contractual necessity: To fulfil your order and meet our obligations in providing floral products and services.
• Legal obligation: To comply with applicable laws, including tax and accounting regulations.
• Consent: For processing optional information or for sending marketing communications, where you have clearly agreed to this in advance. You may withdraw your consent at any time.
• Legitimate interests: For purposes such as improving our service, handling customer queries, or preventing fraudulent transactions, provided such activities do not override your rights or interests.

Data Retention Policy

We retain your personal information only as long as necessary for the fulfilment of your order, aftercare, legal, and legitimate business purposes. Specifically:

• Order and contact data are retained for up to seven years to comply with accounting and tax regulations.
• Where data is held solely on the basis of your consent (e.g., for marketing), it will be immediately erased once you withdraw consent.
• After the retention period, your data is securely deleted or anonymised in line with our internal procedures and GDPR best practices.

Processors and Data Sharing

Florist Sutton will not sell or rent your personal information to third parties. We may share limited data with trusted third-party processors only where this is necessary to complete your transaction, for example:

• Payment processors: For secure payment validation and completion.
• Delivery partners: To ensure prompt and accurate delivery of your order.
• IT service providers: For secure hosting, order management, and communication.

All processors have been vetted for GDPR compliance and are contractually bound to process data solely on our behalf, following strict data protection safeguards. We do not transfer your personal data outside the UK or European Economic Area unless adequate protection is provided as required under GDPR.

Your Data Protection Rights

Your privacy and control over your personal information are fundamental to Florist Sutton. Under GDPR, you have the right to:

• Access: Request access to the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request that we delete your personal data, subject to certain statutory exceptions.
• Restriction: Ask us to restrict processing of your data in certain circumstances.
• Portability: Receive a copy of your personal data in a machine-readable format or request its transfer to another provider, where applicable.
• Objection: Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent: Where we process your information based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise your rights or if you have concerns about how your data is used, you can make requests verbally or in writing. We will respond within one month, in line with GDPR requirements.

Data Security

Florist Sutton implements a range of organisational and technical measures to protect your information from loss, misuse, unauthorised access, disclosure, alteration, or destruction. These include secure storage, access controls, encryption, and staff training in data protection procedures. While we take every reasonable step to safeguard your data, transmissions via the internet are not entirely secure and are at your own risk.

Policy Updates

We regularly review and may update this Privacy Policy to reflect changes in regulations, technology, and our operational practices. We encourage you to review this policy periodically for any updates. Any material changes will be brought to your attention by appropriate means.

Contact and Complaints

If you have questions about this policy, wish to exercise your rights, or are concerned about data privacy issues, you may contact us using the contact options available on our website or at our premises. If you feel your data has not been handled appropriately, you also have the right to lodge a complaint with the relevant data protection authority.

Scope and Applicability

This Privacy Policy applies to all individuals placing orders with Florist Sutton from Sutton and the surrounding districts. By placing an order, you confirm your understanding of the data practices outlined above and your agreement with this policy's terms.