Gospel Oak Florist Privacy Policy

Scope of This Policy

This Privacy Policy sets out how Gospel Oak Florist collects, uses, stores, and protects your personal data when you place an order with us. It applies to all customers making purchases from Gospel Oak Florist, including those based in Gospel Oak and neighbouring districts. We are committed to ensuring your privacy is safeguarded and that your data is handled in full compliance with the General Data Protection Regulation (GDPR).

What Personal Data We Collect

When you place an order or interact with our services, we may collect and process the following types of personal information:

• Contact Details: Name, delivery address, billing address, and telephone number
• Order Information: Details of your order, including product choice, delivery preferences, and card messages
• Payment Details: Partial payment information as processed by approved payment providers (we do not retain full card details)
• Communication Records: Any correspondence or feedback you provide, including enquiries and complaints
• Usage Data: When you visit our website, certain technical information may be logged such as IP address, browser type, and time zone

We do not knowingly collect data from children under 16 years of age.

Lawful Basis for Processing Personal Data

Gospel Oak Florist processes your personal data based on the following lawful grounds, as permitted by Article 6 of the GDPR:

• Performance of a Contract: Processing is necessary to fulfil your order, arrange delivery, and provide associated services
• Legal Obligation: Certain data may be retained or shared to comply with statutory requirements, such as accounting and tax records
• Legitimate Interests: We may use your data to improve our services, handle customer service queries, and ensure the security of our operations, except where those interests are overridden by your fundamental rights
• Consent: For direct marketing communications, where legally required, we will seek your specific, separate consent

Retention Periods

Your personal data is retained only as long as is necessary for the purposes for which it was collected, or as required by law. The typical retention schedule is as follows:

• Order and Contact Data: Retained for up to 7 years to comply with accounting and legal obligations
• Marketing Preferences: Retained until you withdraw your consent or request deletion
• Communications and Enquiries: Retained for up to 2 years after resolution for quality assurance and dispute resolution

After expiry of these periods, your personal data will be securely deleted or anonymised.

Data Processors and Third Parties

We only share your personal data with trusted third-party service providers who support our business operations. These include:

• Payment Service Providers: To process your payment securely
• Delivery Partners: To ensure orders are delivered accurately to your chosen recipient
• IT and Website Support: For secure hosting, analytics, and backup services
• Legal and Regulatory Authorities: Where required by law or to protect our legal rights

All third-party processors are contractually obliged to process your data only in accordance with our instructions, to maintain confidentiality, and to adhere to high standards of security. We do not sell your personal data to third parties.

Security of Your Data

We implement appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect. This includes restricted access to data, secure payment processing, and regular staff training on data protection. While we strive to protect your information, no method of transmission over the Internet is 100% secure, but we employ industry best practices to minimise risks.

Your Rights Under GDPR

Under GDPR, you are entitled to exercise the following rights regarding your personal data:

• Right of Access: You may request a copy of your personal data held by us
• Right to Rectification: You can ask for incorrect or outdated data to be corrected
• Right to Erasure: Also known as the "right to be forgotten," you may request the deletion of your data when there is no lawful reason for us to continue processing it
• Right to Restrict Processing: In certain circumstances, you can request that we halt further use of your data
• Right to Data Portability: You have the right to obtain and reuse your data for your own purposes across different services
• Right to Object: You may object to our processing of your data in certain contexts, such as direct marketing
• Right to Withdraw Consent: Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal

If you wish to exercise any of these rights, please contact us using the details published on our website. We may request proof of your identity to ensure the security of your information.

Policy Updates

We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our practices or regulation. The latest version will always be available on our website, and significant changes will be communicated to affected customers where appropriate.

Contact and Queries

If you have any concerns about the way your personal information has been handled, or wish to make a complaint, please get in touch using the contact details provided on our official website. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your data has been mishandled.