Flowers Epsom Privacy Policy for Customers

Introduction

This Privacy Policy describes how Flowers Epsom collects, uses, stores, and protects your personal information when you place an order with us, whether online, over the phone, or in-person. It outlines our commitment to maintaining your privacy and provides clarity on your rights under the General Data Protection Regulation (GDPR).

This policy covers all customers placing orders with Flowers Epsom from Epsom and the surrounding districts.

What Data We Collect

When you order from Flowers Epsom, we may collect and process the following categories of personal data:

• Contact Information: Full name, delivery address, billing address, and telephone number.
• Order Details: Selected products, delivery instructions, order date and time, and any relevant personal messages attached to your order.
• Payment Information: Card payment details or other payment method identifiers (processed securely through third-party payment providers).
• Correspondence: Records of communication, including queries, feedback, complaints, and any other customer service interactions.

We do not intentionally collect special category or sensitive personal data except where required by law or necessary to fulfill specific requests. In such cases, you will be informed and your explicit consent obtained.

Lawful Basis for Processing

The lawful basis under the GDPR for collecting and processing your personal data includes:

• Contractual Necessity: Most data is processed in order to fulfill your purchase, process payment, deliver your order, provide customer service, and resolve any after-sales queries.
• Legal Obligations: Some data may be processed to comply with applicable laws, such as bookkeeping, tax regulations, or obligations to cooperate with law enforcement.
• Legitimate Interests: We may process your data for legitimate purposes, including improving our services, maintaining security, preventing fraud, or marketing our products to existing customers. Where appropriate, we consider and balance any potential impact on your rights before processing for these purposes.
• Consent: In situations where required by law or where none of the above grounds apply, we will only process your data if you have given clear and unambiguous consent. You have the right to withdraw your consent at any time.

How Your Data Is Used

Your personal information is used to:

• Process and fulfill your orders, including providing associated services such as delivery and customer support.
• Manage billing, payments, and account records.
• Respond to your queries, feedback, or complaints.
• Improve our products and services based on customer feedback and purchase history.
• Send essential communications regarding your order or updates to this Privacy Policy.
• Meet legal and regulatory requirements.

Sharing and Processors

Flowers Epsom employs selected and trusted third-party service providers (data processors) to support our operations. Some categories of processors we may share your personal data with include:

• Delivery Partners: To ensure your flowers and gifts are delivered to the correct address.
• Payment Processors: To securely handle your payment transactions; we do not store your card details directly.
• IT System Providers: For secure storage, management, and backup of data;
• Analytics and Marketing Support: To improve our services, but only with data anonymized or where the law permits.

All processors are contractually required to handle your data in compliance with GDPR, adhere to instructions provided by Flowers Epsom, and keep it secure and confidential. We do not sell or rent your personal information to any third parties.

International Data Transfers

Your personal information is generally stored and processed within the United Kingdom or the European Economic Area (EEA). If we engage processors or partners based outside the EEA, we ensure appropriate safeguards are in place—such as Standard Contractual Clauses—to protect your data in accordance with GDPR requirements.

Retention of Your Data

We only retain your personal data for as long as is necessary for the purposes outlined in this policy, including to fulfil orders, comply with our legal obligations, and resolve disputes. Retention periods are determined in line with the following principles:

• Order and transaction data is generally retained for at least six years, as required by tax and accounting regulations.
• General enquiry and correspondence data is kept for up to two years, unless otherwise required for our defense or the establishment of legal claims.
• Where processing is based solely on your consent and you withdraw consent, your data will be deleted promptly, unless another lawful basis requires retention.

Your Rights Under GDPR

You have a number of rights concerning the personal data we hold about you. These include the right to:

• Access: Request a copy of your personal data.
• Rectification: Have inaccurate or incomplete information corrected.
• Erasure: Ask for your personal data to be deleted, provided there is no overriding legal basis for retaining it.
• Restriction: Seek to limit the way your information is used pending correction or dispute resolution.
• Data Portability: Receive personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller, where technically feasible.
• Object: Oppose processing based on legitimate interests or direct marketing.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Security Measures

We take the protection of your data seriously. Suitable physical, electronic, and administrative security measures are in place to safeguard your information and prevent unauthorized access, alteration, or disclosure. Access to your data is limited to those employees, agents, contractors, and processors who need it to fulfill their duties.

Policy Changes

We keep our privacy practices under regular review. Any significant changes to this policy will be highlighted at the point of order and through updates to our website. We encourage you to review this policy frequently to stay informed about how we are handling your information.

Further Information

If you have any questions about this Privacy Policy or how Flowers Epsom handles your personal data, you can contact us using the details provided on our website or by visiting the store directly. For unresolved concerns, you also have the right to lodge a complaint with the UK’s Information Commissioner’s Office (ICO).