Leyton Florist Privacy Statement

Introduction

This Privacy Policy sets out how Leyton Florist gathers, handles, and protects personal information of customers ordering from Leyton Florist in Leyton and the surrounding districts. It explains what personal data we collect, our reasons for collecting it, how we use it, and the rights you have under the General Data Protection Regulation (GDPR). Leyton Florist is committed to respecting your privacy and to processing your personal data lawfully, fairly, and transparently.

Scope of this Policy

This Privacy Policy applies to all individuals placing orders directly with Leyton Florist for delivery or collection in Leyton and its surrounding districts. By using our services, you agree to the collection and use of your personal data in accordance with this policy.

What Personal Data We Collect

To fulfil orders and provide our services, Leyton Florist collects the following categories of personal data:

• Contact Information: Name, delivery address, billing address, and telephone number.
• Order Details: Products ordered, order notes, messages to recipients, preferred delivery date and time, and payment details (e.g. last four digits of card, payment confirmation status; payment is handled by our secure processor).
• Communication Data: Correspondence with us (e.g., queries, complaints, or feedback by phone or in writing).
• Technical Data: IP address and basic technical information as necessary for the operation and security of our website, where applicable.

Lawful Basis for Processing

We process your personal data under the following lawful grounds as defined by GDPR:

• Contractual Necessity: Most of the information we collect is necessary for us to process and deliver your order as requested. Without this data, we would be unable to fulfil our contract with you.
• Legal Obligation: We may process certain data to comply with our financial, tax, and legal obligations under UK law.
• Legitimate Interests: We may process data for legitimate business interests, such as improving our services, ensuring the security of our services, and handling queries or complaints. We always balance these interests against your rights.
• Consent: Where required, such as for direct marketing not related to your purchase, we will only process your personal data based on your explicit consent. You may withdraw consent at any time.

How We Use Your Data

Your data is used solely for the efficient fulfilment of your order and to provide you with a smooth customer experience. This includes:

• Processing your order and delivering flowers to the intended recipient.
• Confirming and updating you on order progress and status.
• Responding to enquiries, complaints, or requests for support.
• Fulfilling legal and financial obligations (e.g., tax reporting).
• Improving our services based on anonymised customer feedback and purchasing behavior.

Data Retention

We retain personal data only for as long as necessary to meet the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. In general:

• Contact and order data are kept for a period defined by local accounting and tax regulations, typically up to 6 years after your last order.
• Customer correspondence is retained for a period necessary to resolve issues or satisfy business needs, generally no longer than 2 years unless law requires otherwise.
• Technical access logs are kept for security and troubleshooting, not exceeding 12 months unless investigating a specific incident.
>

When data is no longer required, it is securely deleted or anonymised.

Data Processors

We may use trusted third-party companies ("Data Processors") to facilitate payment processing, order management, delivery logistics, or to provide IT support. These processors act solely on our instructions and are contractually bound to comply with GDPR, ensuring the secure and confidential processing of your data. Examples of activities handled by processors include:

• Processing card payments through secure payment service providers.
• Hosting our website and maintaining IT systems.
• Assisting with delivery logistics if required.
>

We do not sell or share your personal information with third parties for marketing purposes without your explicit consent.

International Transfers

Your personal data is stored and processed in the UK. If we ever need to transfer your data outside the UK or the European Economic Area (EEA), we will ensure that appropriate safeguards are in place to protect your privacy rights as required by GDPR.

Your Rights under GDPR

Under UK GDPR, you have the following rights in respect of your personal data:

• Right to Access: Request a copy of the personal data we hold on you.
• Right to Rectification: Request correction of any inaccurate or incomplete data.
• Right to Erasure: Request erasure of your personal data where there are no overriding legal grounds for continued processing.
• Right to Restrict Processing: Ask us to restrict processing in certain circumstances.
• Right to Data Portability: Request transfer of your data to another service provider, where technically feasible.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Where we process data on the basis of consent, you may withdraw consent at any time.

To exercise these rights, you can contact our management in writing. We may ask for proof of identity and will respond within one month, as required by law.

Security Measures

We implement appropriate technical and organisational measures to protect your personal information against accidental loss, theft, unauthorised disclosure, alteration, or access. This includes restricted access to data, employee training, and secure payment processing.

Updates to This Policy

We may periodically update this Privacy Policy in response to regulatory, legal, or business changes. The most recent version is always available upon request and applies from the date of publication.

Contact and Complaints

If you have questions about this Policy or believe your data rights have not been upheld, you can raise concerns with our management. If you remain dissatisfied, you are entitled to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

We thank you for placing your trust in Leyton Florist and for taking the time to understand your rights and our responsibilities under GDPR.