White City Florist Privacy Policy

Introduction

This Privacy Policy outlines how White City Florist collects, uses, and protects personal data of customers placing orders with us from White City and neighboring districts. We are committed to ensuring that your privacy is respected and your data is managed in accordance with the EU General Data Protection Regulation (GDPR).

Scope of this Policy

This policy applies to all individuals who interact with White City Florist in relation to purchasing, ordering, or receiving floral products and services in White City and the surrounding areas. By placing an order or sharing your details with us, you agree to the terms outlined below.

Personal Data We Collect

We collect information necessary to fulfill your orders and to provide our services to you efficiently. The types of personal data we may collect include:

• Contact Information: Name, delivery address, billing address, telephone number.
• Order and Payment Details: Products ordered, order history, payment transaction information (note: payment card details are handled securely by our payment processors and are not stored by us).
• Communication Records: Emails, messages, and notes from customer service interactions.
• Recipient Information: Name, delivery address, and contact telephone (when you are sending flowers to someone else).
• Technical Data: IP address, browser type, device information, and website interactions (collected via cookies for website security and analytics purposes).

Lawful Basis for Processing Your Data

White City Florist processes your personal data based on one or more of the following lawful grounds as detailed in Article 6 of the GDPR:

• Contractual Necessity: Processing is required to fulfill your order or respond to your requests before a contract is entered into.
• Legal Obligation: We may process your data when required to comply with relevant legal and regulatory obligations, such as record-keeping for tax purposes.
• Legitimate Interests: Processing may be necessary for our legitimate business interests, such as ensuring the security of our services, managing customer relationships, or preventing fraud.
• Consent: In certain situations, we may ask for your consent to use your data (for example, for direct marketing). Where we collect consent, you may withdraw it at any time.

How We Use Your Data

Your personal data is used for the following purposes:

• To manage and process your orders, including delivery and payment.
• To communicate with you regarding your orders or any customer service support you request.
• To comply with legal and regulatory requirements.
• To improve our products, website, and customer service through aggregated analysis.
• To protect against fraudulent or unauthorized transactions.
• If expressly agreed by you, to send you updates and promotional offers related to White City Florist.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy or as required by law. Most customer order information is kept for seven years to meet legal and accounting requirements. Data collected for marketing purposes will be retained for as long as you remain a customer or until you withdraw your consent. Once retention periods lapse, we securely delete or anonymize your personal data.

Data Processors and Third Parties

White City Florist may engage trusted third-party service providers to perform functions on our behalf, such as payment processing, delivery logistics, IT support, and website analytics. These service providers act as data processors under GDPR and are contractually bound to protect your data, use it only for authorized purposes, and act in accordance with applicable data privacy laws. We do not sell or rent your personal data to any external parties for marketing purposes.

International Data Transfers

Your personal data is not routinely transferred outside the European Economic Area (EEA). If, for specific technical or operational reasons, it becomes necessary to transfer your data to a third country, we will implement appropriate safeguards as required by GDPR to ensure your data remains protected.

Protecting Your Personal Data

We take reasonable technical and organizational steps to protect your personal data from unauthorized access, loss, misuse, or alteration. These include secure storage, access controls, regular staff training, and working only with reputable service providers who maintain high security standards.

Your Rights under GDPR

You have several rights regarding your personal data, which include:

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can ask us to correct any inaccurate or incomplete data.
• Erasure: You can request deletion of your personal data, subject to certain legal obligations which may require us to retain some records.
• Restriction: You can request the restriction of processing in certain circumstances.
• Portability: You can request a copy of your data in a commonly used, machine-readable format.
• Objection: You may object to processing based on legitimate interests or direct marketing.
• Withdrawal of Consent: Where processing is based on consent, you can withdraw your consent at any time.

To exercise any of these rights, please contact us using the appropriate method stated on our website or in your order confirmation. Before fulfilling your request, we may ask for additional information to confirm your identity and ensure your request is handled securely.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in the law or our business practices. The current version will always be available on our website. We encourage you to review it periodically to stay informed about how we protect your data.

Contact and Further Information

If you have questions about this policy, about how your personal data is handled, or wish to make a complaint, please refer to the contact details published on our website. You also have the right to raise concerns with your local data protection authority if you believe your data has been processed unlawfully.