Hackney Wick Flowers Privacy Notice

Introduction

This Privacy Policy explains how Hackney Wick Flowers (“we”, “our”, or “us”) collects, uses, stores, and protects your personal data when you place or enquire about orders for floral arrangements from Hackney Wick and surrounding districts. We are committed to safeguarding your data and respecting your rights under the General Data Protection Regulation (GDPR) and all applicable legislation.

Scope of this Policy

This policy applies to all customers placing orders with Hackney Wick Flowers for delivery or collection within Hackney Wick and neighbouring districts. By placing an order with us, you agree to the practices described in this notice.

The Personal Data We Collect

When you interact with us (including when you place orders or contact us with queries), we may collect and process the following types of personal data:

• Name: To identify you and personalise your order.
• Contact details: Such as your address (for delivery), phone number and, if provided, alternative contact information.
• Order details: Information about the products you order, special instructions, and recipient details if you send flowers to someone else.
• Payment information: Necessary details to process your payment (processed securely and not stored by us locally).
• Correspondence: Any communications you send to us regarding your order, feedback, or queries.
• Website usage data: Logs and analytics relating to visits to our website, which may include IP addresses, device information, and cookies (should you consent).

Lawful Bases for Processing

Under the GDPR, we must have a valid basis to use your personal information. We process your data on the following grounds:

• Contractual Necessity: To take steps at your request prior to entering into a contract and to fulfil our contract with you, such as processing and delivering your order.
• Legal Obligation: To satisfy legal and regulatory obligations, for example, for record-keeping as required by tax authorities.
• Legitimate Interests: To effectively operate and improve our business and services, unless your interests or fundamental rights override our interests. This includes responding to your enquiries, ensuring our website’s functionality, and preventing fraud.
• Consent: In cases where we wish to send you marketing communications, we will only do so with your explicit permission. You may withdraw this consent at any time.

How We Use Your Information

We use the information we collect for the following purposes:

• To process and deliver your flower orders, including sending status updates.
• To communicate with you about your order or future orders.
• To respond to your questions, requests, or feedback.
• To carry out statistical analysis and better understand customer preferences (using anonymised or aggregated data wherever possible).
• To meet our legal, regulatory, and tax obligations.

Sharing Your Personal Data (Processors)

We may share your information with trusted third parties who provide services to us (“processors”), including:

• Payment service providers for secure payment processing.
• Delivery partners assisting with flower deliveries.
• Professional advisors (such as accountants or legal advisors) when required for compliance or legal matters.
• IT support and cloud hosting providers for website and data management.

All third-party processors are selected with great care and must commit to complying with GDPR standards and to keeping your data secure. We never sell, trade, or rent your personal information to unrelated third parties for their own marketing.

International Transfers

Your data is generally stored and processed within the United Kingdom or the European Economic Area (EEA). Should we need to transfer your data outside the EEA, we will ensure appropriate safeguards are in place to protect your information in accordance with the GDPR.

How Long We Keep Your Data (Retention)

We will retain your personal data only for as long as is necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Typically, we retain order and associated personal data for up to seven years, in line with tax and legal obligations. Where data is no longer required, it will be securely deleted or anonymised.

Your Data Protection Rights

Under the GDPR, you have rights regarding your personal information. These include:

• Right to Access: Request information about what personal data we hold and receive a copy.
• Right to Rectification: Request corrections to any inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data in certain circumstances ('the right to be forgotten').
• Right to Restrict Processing: Request us to temporarily limit what we do with your data.
• Right to Object: Object to our processing of your personal data where we rely on legitimate interests or direct marketing.
• Right to Data Portability: Request for your data to be provided in a structured format or to transmit it to another controller.
• Right to Withdraw Consent: Withdraw your consent at any time where we rely on it for processing your data.

If you would like to exercise any of your rights, please contact us via the available methods on our website. We will respond to your requests in accordance with GDPR guidelines.

Data Security

We are committed to ensuring that your information is secure. We implement appropriate technical and organisational measures designed to safeguard your personal data against accidental loss, misuse, unauthorised access, disclosure, alteration, or destruction.

Policy Updates

This Privacy Policy may be updated from time to time to reflect changes in legal or regulatory requirements, or how we process personal data. We encourage you to review this notice regularly to stay informed.

Contact and Complaints

If you have questions about this Privacy Policy or wish to make a complaint regarding your data, please contact us using the contact form or details provided on our website. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), if you believe your rights under GDPR have been infringed.