Bromley Florist GDPR-Compliant Privacy Policy

Introduction

This Privacy Policy outlines how Bromley Florist collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (GDPR). This policy is applicable to all customers placing Bromley Florist orders from Bromley and surrounding districts. We are committed to respecting your privacy and ensuring that your personal information is handled transparently and securely.

What Data We Collect

To fulfil your flower orders and provide our services, Bromley Florist may collect the following categories of personal data:

• Contact Information: Name, delivery address, billing address, and telephone number
• Order Details: Information about your purchases, delivery preferences, and recipient details
• Payment Information: Details necessary to process your payment (note: payment card details may be processed securely by our payment service provider, not stored directly by Bromley Florist)
• Communication Records: Any correspondence with us regarding orders, enquiries, or feedback
• Technical Data: Information collected via cookies and similar technologies, such as IP address, browser type, and website usage data

Lawful Basis for Processing

Under GDPR, we must have a lawful basis for processing your personal data. Bromley Florist relies on the following legal grounds:

• Contract Performance: Most personal data is processed to enable us to fulfil your order and provide our services (e.g., fulfilling deliveries, processing payments).
• Legal Obligation: Certain data may be retained or processed to comply with applicable laws, such as accounting or tax requirements.
• Legitimate Interests: We may use your data to improve our services, ensure network security, or prevent fraud, provided these interests do not override your rights and freedoms.
• Consent: Where required (e.g., for marketing communications), we will seek your explicit consent before processing your data for these purposes.

How We Use Your Data

Bromley Florist uses your personal data to:

• Process, confirm, and deliver your orders
• Contact you regarding your purchase or any changes related to your orders
• Respond to your enquiries or feedback
• Improve and personalise your customer experience
• Comply with statutory and regulatory obligations
• Send marketing materials, only if you have opted in

How We Share Your Data

We do not sell your personal data. We may share your data only in the following circumstances:

• With trusted third-party processors such as payment service providers, delivery partners, IT service providers, and our website hosting platform for the purposes described in this policy
• Where required by law or to respond to a legal process
• To protect the rights, property, or safety of our business, clients, or others

All third-party processors acting on our behalf are contractually obligated to process your data securely, only as instructed, and in compliance with GDPR.

Data Retention

Bromley Florist will retain your personal data only as long as necessary to fulfil the purposes we collected it for, including:

• Order fulfilment and customer support
• Legal, accounting, and reporting requirements

Typically, customer data related to purchases is retained for seven years to comply with financial and legal obligations. After this period, personal information is securely deleted or anonymised.

Your Data Protection Rights

As a data subject under GDPR, you have the following rights:

• Right to Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete data.
• Right to Erasure: You may request deletion of your personal data, subject to our legal obligations.
• Right to Restrict Processing: You can request limited use of your data in certain situations.
• Right to Object: You can object to our processing where it is based on legitimate interests or direct marketing.
• Right to Data Portability: You can request your data in a structured format for transfer to another service provider.

To exercise any of these rights, please contact us using our posted communication methods. We will respond to your request within the timeframes set out in GDPR, typically within one calendar month.

Data Security

We implement appropriate security measures designed to protect your personal data from accidental or unlawful destruction, loss, alteration, disclosure, or unauthorised access. This includes physical, technical, and organisational safeguards.

International Data Transfers

Generally, your data is stored and processed within the UK and European Economic Area (EEA). If it is necessary to transfer your data outside the EEA, we will ensure equivalent protection by using standard contractual clauses or other legally recognised measures.

Use of Cookies and Similar Technologies

Bromley Florist uses cookies and similar tracking technologies on our website to improve functionality, analyse site traffic, and personalise user experience. Where required by law, you will be given the opportunity to consent to the use of cookies not strictly necessary for website operation.

Policy Updates

We may update this Privacy Policy to reflect changes to our practices or legal requirements. Please check this page periodically for any updates. The date of the latest revision will be indicated at the top of the policy document.

Contact and Complaints

If you have questions about how Bromley Florist handles your personal data or wish to exercise your data protection rights, please contact us using the communication methods provided on our website. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) or your local supervisory authority.