Clerkenwell Flowers GDPR Privacy Policy

Introduction

At Clerkenwell Flowers, we are committed to protecting your privacy and handling your personal information in compliance with the General Data Protection Regulation (GDPR) and other applicable UK data protection laws. This Privacy Policy describes how we collect, use, and safeguard your data when you place orders with us in Clerkenwell and the surrounding districts. We also outline your rights regarding your personal data and how you can exercise them.

Scope of This Privacy Policy

This Privacy Policy applies to all individuals who purchase products or services from Clerkenwell Flowers in Clerkenwell and neighbouring locations. By ordering from us, you acknowledge and agree to the practices described in this policy.

Types of Data We Collect

Clerkenwell Flowers collects and processes personal data required to provide our floral services and fulfill orders in an efficient and secure manner. The personal data we may collect include:

Contact Information: Name, address, phone number, and delivery address.
Payment Details: Payment card information (processed securely through our payment processor), transaction details, and billing address.
Order Information: Details of your purchases, delivery instructions, and correspondence related to your order.
Special Requests: Any messages or personalisation you provide for bouquets or deliveries (e.g., for notes and recipients).
Device and Usage Information: When you interact with our website, technical data such as your IP address, browser type, and pages visited may be collected through cookies or similar technologies, in accordance with our Cookie Policy.

Lawful Basis for Processing Your Data

Under the GDPR, we must have a lawful basis for collecting and processing your personal data. Clerkenwell Flowers processes your data on the following grounds:

Contractual Necessity: To process and fulfill your orders, deliver your products, and communicate with you about your purchases.
Legal Obligation: To comply with applicable legal requirements (such as tax or accounting records).
Legitimate Interests: To improve our products, services, and customer experience; and to safeguard our business from fraud and misuse.
Consent: Where you have specifically agreed (for instance, consent to receive marketing communications). You may withdraw consent at any time.

How We Use Your Data

We use your data for the following purposes:

To process and deliver your orders, including communicating order status and handling payments.
To respond to your queries and provide customer support.
To fulfil legal and regulatory obligations.
To improve our services and ensure the security of transactions.
For marketing purposes, where you have consented to such communication.
To detect and prevent fraud or misuse of our services.

How Long We Keep Your Data (Data Retention)

We keep your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The retention periods are as follows:

Order and contact information: Retained for up to 7 years in accordance with tax and accounting regulations.
Payment card data: Not stored by Clerkenwell Flowers, but processed and retained by our payment processors in accordance with their retention policies.
Marketing data: Retained until you opt-out or withdraw your consent.
Technical data (such as cookies): Retention depends on browser and settings, typically no longer than 24 months.

Once the retention period expires, your data will be securely deleted or anonymised.

Sharing and Processing of Data

To provide our services, certain data processing activities are carried out by trusted third-party partners on our behalf (data processors). These include:

Payment service providers who process payments securely.
Delivery partners and couriers responsible for delivering your orders.
IT service providers who support our website and internal systems.

All third-party processors are carefully selected, GDPR-compliant, and process personal data only as instructed by Clerkenwell Flowers for the above purposes. Personal data is never sold to third parties. We may also disclose personal data to authorities if required by law.

Your Data Rights

Under the GDPR, you have several rights in relation to your personal data. These include:

Right of Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can request correction of inaccurate or incomplete data.
Right to Erasure: You can request deletion of your data in certain circumstances (“right to be forgotten”).
Right to Restrict Processing: You can request limitation of processing of your data in certain situations.
Right to Data Portability: You have the right to receive your data in a structured, machine-readable format and to transfer it to another data controller.
Right to Object: You can object to the processing of your data for direct marketing or, in some cases, for other legitimate interests.
Right to Withdraw Consent: Where we rely on your consent for processing, you have the right to withdraw it at any time.

To exercise any of these rights, please contact us using the details provided at the end of this policy. We will respond to your requests within one month as required by law.

Security of Your Personal Data

We implement security measures appropriate to the nature of data we process to protect your information from unauthorised access, alteration, or loss. These include secure IT systems, limited access controls, and regular staff training. Despite our efforts, no method of transmission over the internet is completely secure; we recommend that you also take precautions when sending information online.

Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or our data practices. The latest version will always be available on our website. Please review this policy regularly to stay informed about how we protect your data.

Contact and Complaints

If you have questions, requests, or complaints regarding this Privacy Policy or our handling of your data, please reach out using the contact options provided on our website. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data rights have been infringed.