Privacy Policy for Flowers Crystal Palace

Scope of This Privacy Policy

This Privacy Policy describes how Flowers Crystal Palace collects, uses, retains, and safeguards your personal data when you place orders with us, either online or by phone, from Crystal Palace and the surrounding districts. Your privacy is important to us, and we are committed to compliance with the General Data Protection Regulation (GDPR).

Personal Data We Collect

When you interact with Flowers Crystal Palace—such as by placing an order, making an enquiry, or requesting delivery—we may collect the following categories of personal data:

• Identification data: such as your name and title.
• Contact data: including your postal address, delivery address, telephone number, and (if provided) email address.
• Order details: information about your purchase, including requested delivery date, recipient’s name and address, and any personal messages or notes.
• Payment information: necessary payment details processed through secure third-party providers (note that we do not store full card information ourselves).
• Communication data: records of correspondence, feedback, or any special requests related to your order.
• Website usage data: information collected through cookies and similar technologies, such as IP address, browser type, and browsing behaviour on our website, only with your consent.

Lawful Basis for Processing Your Data

Under the GDPR, we rely on specific lawful bases to process your personal data:

• Contract performance: Processing is necessary to fulfil your contract with us—for example, to deliver your order or to communicate about your purchase.
• Legal obligation: We may process data to comply with legal and regulatory requirements, such as tax or accounting obligations.
• Consent: Where applicable (such as for marketing communications or certain cookies), we will request your explicit consent, and you may withdraw this consent at any time.
• Legitimate interests: To improve our services, manage enquiries, prevent fraud, and ensure the security of our website, provided that such interests are not overridden by your data protection rights.

How We Use Your Personal Data

Your personal data may be used for the following purposes:

• Processing and fulfilling your orders.
• Delivering flowers and related products to your requested address.
• Communicating with you regarding your order, delivery updates, or to respond to your queries.
• Processing payments and refunds through trusted payment processors.
• Enhancing our products, services, and customer experience by analysing feedback and usage data (where permitted).
• Complying with our legal obligations and resolving disputes.
• Providing marketing updates or offers only if you have opted in to receive such communications.

Data Retention

We retain your personal data only as long as it is necessary to fulfil the purposes outlined in this Privacy Policy, or as required by law (for example, accounting or tax purposes). Typically, order-related data is kept for up to six years in accordance with UK accounting standards. Where data is processed solely based on your consent, we will delete this data once you withdraw your consent or after a reasonable period of inactivity.

Sharing and Disclosure of Data

Your personal data may be shared with trusted third parties only as necessary, including:

• Payment processors: For securely processing your payment (credit/debit card information is managed by them).
• Delivery partners: To ensure your flowers and gifts reach their destination as requested.
• IT and website hosting providers: For the secure hosting and technical operation of our website and order system.
• Professional advisors: Such as accountants or legal consultants strictly when necessary for our business operations or legal compliance.

We ensure that all data processors act in compliance with data protection law and only process your data on our prior written instructions. Your personal data will never be sold or rented to third parties for marketing purposes.

Your Rights Under GDPR

Subject to certain conditions, you have rights concerning your personal data under the GDPR:

• Right of access: Request a copy of the personal data we hold about you.
• Right of rectification: Ask us to correct incomplete or inaccurate information.
• Right to erasure: Request deletion of your data, subject to legal obligations for retention.
• Right to restrict processing: Request a restriction on how we process your data in certain circumstances.
• Right to data portability: Receive your data in a commonly used digital format for your own use or for transfer to another provider.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you can withdraw your consent at any time.

To exercise any of your rights, please contact us using the contact methods provided through our website, or by writing to our place of business.

International Data Transfers

Flowers Crystal Palace operates primarily within the UK. If personal data is transferred outside the European Economic Area (EEA), for example when using cloud hosting providers, we take appropriate safeguards to ensure that your data is protected to EU standards.

Security of Your Personal Data

We are dedicated to ensuring the security of your personal data. We implement suitable technical and organisational measures including encryption, access controls, and regular reviews of our security practices to prevent unauthorised access, disclosure, or loss.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, to reflect changes in our processing activities or legal requirements. The most recent version will always be available on our website, with the date of revision clearly indicated.

Contact and Complaints

If you have any queries about this policy or wish to exercise your data protection rights, you can contact us through the channels detailed on our website or by writing to our business address in Crystal Palace. If you are not satisfied with our response, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK’s supervisory authority for data protection.

This policy applies to all customers and users placing orders with Flowers Crystal Palace from within Crystal Palace and the surrounding districts.