Privacy Policy for Flower Delivery Hertford Customers

Introduction

This Privacy Policy explains how Flower Delivery Hertford (“we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data from individuals who place flower delivery orders in Hertford and surrounding districts. We are committed to maintaining the confidentiality and integrity of your personal information and comply fully with the General Data Protection Regulation (GDPR).

Scope of This Policy

This policy applies to all customers and individuals (“you”, “your”) making purchases or placing orders with Flower Delivery Hertford. It covers all websites, web forms, telephone, and in-person orders within Hertford and adjacent areas.

What Personal Information We Collect

When you use our services, we collect personal data that is necessary to fulfil your order and provide a smooth customer experience. This includes:

• Contact Details: Name, address, email, and delivery instructions.
• Order Information: Details of the flowers and gifts ordered, recipient name and address, personalised notes.
• Payment Data: Limited payment details (such as payment reference, transaction amount, date). Full card details are not stored by us, they are processed securely by third-party payment processors.
• Communications: Any correspondence or feedback you send us, including queries and complaints.
• Technical Data: IP address, device information, and usage data collected from website interactions (such as cookies or analytics).

Lawful Basis for Processing Your Data

Under GDPR, we must have a lawful basis for collecting and using your personal data. Our main lawful bases include:

• Performance of a Contract: Processing your data is required to fulfil and deliver your flower order.
• Consent: On occasions where we use your data for marketing or promotions, we will always seek your explicit consent in advance.
• Legal Obligations: We may process your data where required by law (for example, to comply with tax regulations).
• Legitimate Interests: Processing may be necessary for our legitimate interests, provided these interests do not override your fundamental rights (such as improving service quality and security).

How and Why We Use Your Data

Your personal data is used strictly for purposes related to your orders and our service, including:

• Processing flower orders and arranging delivery.
• Communicating order status and resolving customer service matters.
• Customising and improving services based on usage trends and feedback.
• Fulfilling legal, accounting, and business record-keeping requirements.

Sharing Your Data with Processors and Third Parties

We share your data only when necessary and with trusted suppliers or service providers who help deliver our services. These may include:

• Payment Processors: Securely handle your payment details and process transactions on our behalf.
• Delivery Partners: Couriers or florists who deliver your orders to the intended recipient.
• IT and Hosting Providers: Companies that support our website, order management, and communications systems.
• Professional Advisors: Accountants or legal advisors, where required by law.

All data processors we engage are contractually bound to process your information in compliance with GDPR and to maintain confidentiality and security.

How Long We Keep Your Data (Data Retention)

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, including satisfying any legal, accounting, or reporting requirements.

• Order and transaction records: Kept for up to 7 years to comply with legal and taxation obligations.
• Marketing data: Retained until you withdraw your consent or request erasure.
• Customer correspondence: Kept for no longer than 2 years unless legally required for longer.

After these periods, your data will be securely deleted or anonymised.

Your Rights Under GDPR

As a customer, you have the following rights regarding your personal data:

• Right to Access: You have the right to request access to your personal data that we hold.
• Right to Rectification: You may request correction of incomplete or inaccurate information.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your data when it is no longer required, or when you withdraw consent, where applicable.
• Right to Restrict Processing: You can request that we limit how we use your personal information.
• Right to Data Portability: You can request a copy of your data in electronic format for transfer to another service provider.
• Right to Object: You can object to certain types of processing, including direct marketing.
• Right to Withdraw Consent: Where we rely on consent, you may withdraw this at any time.

To exercise any of these rights, please contact us using the contact details provided at the end of this policy. We will respond promptly, and always within the timelines mandated by GDPR.

Data Security Measures

We take the security of your data seriously. Measures implemented include secure (HTTPS) data transmission, encrypted storage for sensitive data, regular access reviews, and ongoing staff training on data protection. Only authorised personnel have access to customer data. Where third parties process data for us, we require strict commitments to privacy and security.

Cookies and Website Usage

Our website may use cookies or similar technologies to improve site functionality and analyse usage trends. Where required, we will seek your permission before placing non-essential cookies. You may manage your cookie preferences through your browser settings.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities or legal obligations. The latest effective date will always be shown at the top of this page. We encourage you to review this policy periodically.

Contacting Us

If you have any questions, concerns, or requests about how we use your personal data, or if you wish to exercise your rights outlined above, please reach out using our website contact form or in writing to our registered business address. We are committed to resolving any data protection concerns in a prompt and transparent manner.

Complaints

If you are dissatisfied with how we process your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO). We encourage you to contact us first so that we can address your concerns directly.