Highgate Florist Customer Privacy Policy

Introduction

Highgate Florist is committed to ensuring that your privacy is protected. This Privacy Policy explains how we collect, use, store, and protect the personal data of customers placing orders with Highgate Florist from Highgate and surrounding districts. We adhere fully to the General Data Protection Regulation (GDPR) and other relevant UK data protection laws, ensuring transparency and respect for your rights.

What Data We Collect

We collect the minimum amount of personal data necessary to process and deliver your orders efficiently. The types of data we may collect include:

• Full name
• Delivery address
• Contact telephone number
• Order details (e.g. floral arrangements, messages to recipients)
• Billing address
• Payment information (processed securely via third-party providers; we do not store full card details)
• Email address (for communication and order confirmation)
• Customer service correspondence
• Special delivery instructions

We do not collect unnecessary data or data not relevant to fulfilling your order. No sensitive categories of personal data (such as health information) are requested or accepted, unless it is voluntarily provided by you in a message and considered necessary for the fulfilment of your order.

Lawful Basis for Data Processing

All personal data we collect and process from customers in Highgate and neighbouring districts is based on one or more lawful bases under the GDPR:

• Performance of a Contract: The majority of data processing activities are required to enter into or to fulfil our contract with you when you place an order, including processing payment, delivering flowers, and keeping you updated on your order status.
• Legal Obligation: We may need to retain certain information for financial or regulatory reasons, including accounting records.
• Legitimate Interests: We process your information to improve customer service, personalize your experience, and manage our business, balanced against your rights and freedoms.
• Consent: Where required, we may request your explicit consent to use your data for marketing or promotional communications unrelated to your order. You can withdraw consent at any time.

How We Use Your Data

The data you provide is used strictly for the following purposes:

• Processing and managing your order, including payment collection and delivery
• Communicating with you about your purchase and responding to your enquiries
• Improving our products, services, and customer experience
• Complying with legal and regulatory obligations
• Sending service-related announcements
• (With explicit consent) Sending marketing communications about special offers, new products, or updates

Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, including regulatory and legal requirements:

• Order Information: Kept for up to seven years for accounting and audit purposes, as required by law.
• Communication Records: Retained for up to two years after your last interaction, unless law requires it be kept longer.
• Marketing Preferences: Retained until you opt out or withdraw consent.

After the relevant retention period expires, your data will be securely deleted or anonymised.

Processors and Data Sharing

Your data may be processed by trusted third parties (“processors”) solely for order fulfilment, payment processing, or IT support. These may include:

• Payment service providers (to process card payments securely)
• Delivery partners (for local or courier-based delivery)
• Website host and IT systems providers (for website operations and data storage)

All processors operate under contracts that oblige them to comply with the GDPR, process information only as instructed, and keep your data confidential and secure. We do not sell or rent your personal data to third parties for marketing purposes.

If required to do so by law, we may share your data with authorities or in connection with legal proceedings. Data is not transferred outside the UK or the European Economic Area unless adequate safeguards are in place.

Your Rights Under GDPR

You have a number of important rights regarding your personal data:

• Right of Access: You can obtain confirmation of whether we process your data and request a copy of the information we hold about you.
• Right to Rectification: If your data is inaccurate or incomplete, you have the right to request correction.
• Right to Erasure: You can ask us to delete your personal data, subject to certain limitations (e.g. where retention is required by law).
• Right to Restrict Processing: In certain circumstances, you can ask us to restrict processing of your data.
• Right to Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format, and transfer it to another controller.
• Right to Object: You can object to processing in cases where we rely on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where you have provided consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, please get in touch using the contact details provided on our website or in your order confirmation. We will respond within one month as required by law.

Security Measures

We take the security of your data seriously. Technical and organisational measures are in place to protect your personal details from unauthorised access, alteration, disclosure, or destruction. All payment data is handled via secure, PCI-compliant providers.

Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or our data processing activities. Please review this page periodically for the latest information.

Contact and Complaints

If you have any questions or concerns about how your data is used, or wish to make a complaint, please refer to the contact details listed on our website. If you are unsatisfied with our response, you have the right to lodge a complaint with the UK data protection authority.