Docklands Flowers GDPR Privacy Policy

Introduction

This Privacy Policy outlines how Docklands Flowers collects, processes, stores, and protects the personal data of customers who place orders with us from Docklands and the surrounding districts. Respect for your privacy and the security of your information are at the heart of our commitment. We comply fully with the General Data Protection Regulation (GDPR) and any associated UK data protection laws.

Who This Policy Applies To

This policy applies to all individuals placing orders, making inquiries, or otherwise engaging with Docklands Flowers products and services either online, over the phone, or in person, when located in Docklands and the surrounding districts.

What Data We Collect

When you interact with Docklands Flowers, we may collect and process the following types of personal data:

• Contact Information: Name, delivery and billing address, phone number, and any other contact details provided during your order or inquiry.
• Order Details: Details of products ordered, delivery instructions, recipient information (if different from the customer), payment status, and transaction records.
• Payment Information: Partial payment details (such as the last four digits of a card if applicable), but full card data is never stored by Docklands Flowers and is processed securely through our payment processors.
• Correspondence: Records of inquiries, complaints, or customer service interactions via any channel.
• Website Usage Data: Information about your visits to our website, such as IP address, browser type, and referring URLs. This is collected using cookies for purposes including analytics, security, and website functionality.

Lawful Basis for Data Processing

We rely on the following lawful bases to process your personal data in accordance with GDPR:

• Contractual Necessity: Processing is required to fulfill your order and to deliver goods and services per your request.
• Legal Obligations: We may process or retain some information where required by applicable law (for example, for tax or accounting purposes).
• Legitimate Interests: We may process personal data for our legitimate interests, such as improving our services and communicating relevant offers, provided that your rights and freedoms are not overridden.
• Consent: For certain types of marketing communications, we will obtain your explicit consent, which you may withdraw at any time.

How We Use Your Data

Your data is used only for the purposes for which it was collected. These purposes include:

• Processing and fulfilling your orders;
• Delivering flowers to you or your designated recipients;
• Communicating order updates, delivery status, and customer service responses;
• Carrying out financial transactions with you;
• Improving our products, services, and website experience;
• Meeting our legal, accounting, and tax obligations;
• Sending you promotional material with your consent or where legitimate interest applies.

Data Retention

We retain your personal data for as long as required to fulfill contractual obligations, comply with legal requirements, or where we have a legitimate business need to do so. Typically, order details and related information are retained for a period of up to six years to comply with legal and tax regulations. After this period, your data will be securely deleted or anonymized. If you have registered for marketing communications and later withdraw consent, your information will be promptly removed from our marketing lists.

Processors and Third-Party Services

Your data may be provided to trusted third-party service providers ("processors") who act on our behalf to deliver core business services. Examples of such processors include:

• Payment processing companies (who process payments securely on our behalf);
• Courier and delivery partners (to facilitate delivery of your flowers);
• IT and website hosting providers (for secure data storage and website operations);
• Analytics service providers (helping us understand and improve website performance).

All processors are contractually bound to comply with GDPR, process your data only as instructed by Docklands Flowers, and implement robust security measures. We do not sell or rent your data to any third party for marketing purposes.

International Transfers

In most circumstances, your personal data is processed within the UK or the European Economic Area (EEA). If data needs to be transferred outside of these areas, we ensure that adequate safeguards are in place to protect your privacy rights in accordance with GDPR requirements.

Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right to Access: You can request confirmation of what personal data we hold about you and receive a copy of that data.
• Right to Rectification: If any data we hold about you is inaccurate or incomplete, you are entitled to request correction.
• Right to Erasure: You may ask us to delete or remove your personal data in specific circumstances, such as where it is no longer required or where you withdraw consent (where applicable).
• Right to Restrict Processing: You can request that we restrict the processing of your data in certain situations (for example, where you contest its accuracy).
• Right to Object: You can object to our processing of your personal data where we rely on legitimate interests, and you may object to marketing at any time.
• Right to Data Portability: Where we process your data by automated means and based on consent or contract, you may request a copy in a commonly used electronic format.

If you wish to exercise any of these rights, please contact Docklands Flowers using the details on our website or in your order confirmation materials. We may need to verify your identity to process certain requests.

Security Measures

We implement technical and organisational safeguards to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These include the encryption of transactions, access controls, security audits, and staff training. Our website uses secure protocols for data transmission and payments are processed by PCI-DSS compliant third-party providers.

Changes to This Policy

We may update this Privacy Policy occasionally to reflect changes in our practices or legal requirements. The latest version will always be available on our website and will indicate the date it was last updated. Please review it periodically to stay informed about how your information is protected.

Contact and Concerns

If you have any questions about this Privacy Policy or would like to exercise your data rights, please use our published contact methods. Should you believe your data is not being handled in accordance with GDPR, you have the right to lodge a complaint with the appropriate data protection authority.