Florist Pimlico Privacy Policy

Introduction

This Privacy Policy explains how Florist Pimlico collects, uses, stores, and protects your personal data in compliance with the UK General Data Protection Regulation (GDPR). It applies to all customers who place orders with Florist Pimlico from Pimlico and the surrounding districts. We are committed to safeguarding your privacy and ensuring that your personal information is handled transparently, securely, and lawfully.

What Personal Data We Collect

When you place an order or interact with Florist Pimlico, we may collect the following categories of personal data:

• Contact Information: Name, delivery address, billing address, and contact details such as telephone number.
• Order Information: Details of the products ordered, order notes, gift messages, and delivery instructions.
• Payment Information: Payment method, transaction details (please note: we do not store full card details on our servers).
• Communication Data: Emails or correspondence relating to your orders or inquiries.
• Technical Data: IP address, device type, browser type, and usage data collected through website cookies for site functionality and security.

The Lawful Basis for Processing Your Data

Under GDPR, we must have a valid legal reason, or 'lawful basis,' to process your personal data. For Florist Pimlico, the primary lawful bases include:

• Contractual Necessity: Processing your order, delivering goods, or providing customer support is required to fulfill our contract with you.
• Legitimate Interests: For operational reasons such as improving our services, preventing fraud, or handling queries. We ensure such processing does not override your rights and interests.
• Legal Obligations: When we are required by law to keep certain records for tax or accounting purposes.
• Consent: In certain situations (e.g., direct marketing), we rely on your specific, informed consent, which you can withdraw at any time.

How We Use Your Data

Florist Pimlico processes your personal data in the following ways:

• To manage and fulfill your orders, including arranging delivery and updating you about your order status.
• To respond to customer service inquiries or complaints.
• To process payments and prevent fraud.
• To improve our services and website functionality based on customer usage and feedback.
• To comply with applicable laws and regulations.

Data Processors and Third Parties

We may engage third-party service providers, known as data processors, who process personal data on our behalf to help us deliver and manage our services. Such processors may include:

• Payment Processors: Securely handling payment transactions.
• Courier and Delivery Services: Delivering flowers or gifts to the designated addresses.
• IT and Website Hosting Providers: Enabling our website, maintaining security, and backing up data.

We only share your information with trusted third parties necessary for fulfilling your order or operating our business. We require our processors to uphold GDPR standards and not use your data for their own purposes.

Data Retention

Florist Pimlico will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. Typical retention periods are:

• Order Data: Retained for up to 7 years in line with legal and tax obligations.
• Customer Queries: Retained for up to 3 years after the resolution of any inquiry.
• Marketing Data: Retained until you withdraw your consent or unsubscribe.

After the applicable retention period, your data will be securely deleted or anonymised.

Your Data Protection Rights

Under GDPR, you have a number of important rights in relation to your personal data. These include:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request correction of any inaccurate or incomplete data.
• Right to Erasure: You can request deletion of your personal data where it is no longer necessary for us to keep it.
• Right to Restrict Processing: You can ask us to suspend the processing of your personal data in certain circumstances.
• Right to Data Portability: You can request the transfer of your data to you or to another service provider.
• Right to Object: You can object to our processing based on legitimate interests or direct marketing.
• Right not to be subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling.

To exercise any of these rights, please contact us using the details provided at the end of this policy. We may require specific information from you to help us confirm your identity and fulfill your request. There is typically no fee, but we may charge a reasonable fee if your request is manifestly unfounded or excessive.

Data Security

Florist Pimlico takes security seriously and implements measures to protect your personal data from unauthorised access, loss, misuse, or disclosure. This includes encryption of payment data, secure storage procedures, and regular review of our information handling processes.

International Transfers

Your personal data is stored and processed within the United Kingdom. Should it be necessary to transfer personal data outside the UK or European Economic Area (EEA), we will ensure appropriate safeguards are in place, such as contractual clauses or ensuring the country has adequate data protection laws.

Updates to This Policy

We may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. The latest version will always be available on our website. We recommend reviewing this policy periodically to stay informed about how we are protecting your information.

Contact and Complaints

If you have questions or concerns about this Privacy Policy or how we handle your personal data, you can get in touch with us using the contact information provided at the end of this document, or by visiting our premises. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe we are not complying with data protection laws.