Privacy Policy for Lambeth Flowers Customers

Introduction

This Privacy Policy describes how Lambeth Flowers ('we', 'us', or 'our') handles personal data of customers placing orders from Lambeth and the surrounding districts. We are committed to protecting your privacy and complying with the General Data Protection Regulation ('GDPR') and related data protection laws. This policy explains what data we collect, the lawful basis for using it, how long we retain it, who processes it for us, and your rights over your information.

Scope of This Policy

This policy applies to all customers who place orders with Lambeth Flowers, whether online, by telephone, or in person, from Lambeth and neighboring districts. It covers customers purchasing flowers and related products, as well as anyone whose personal information is given to us as part of an order (such as delivery recipients).

Personal Data We Collect

When you interact with Lambeth Flowers, we collect the following types of personal information:

• Contact Details: Name, address, delivery address, telephone number.
• Order Information: Details of products ordered, delivery instructions, messages to include with flowers, and payment details (only transaction information, not payment card numbers).
• Communications: Any correspondence with us, such as emails, customer service queries, and feedback.
• Technical Data: IP address, browser type, and device type if you place an order via our website, for security and analytics purposes.
• Consent Preferences: Your preferences for receiving promotional communications (if any).

How We Use Your Personal Data

Lambeth Flowers uses your personal data for the following purposes:

• To process and deliver your orders, including verifying your identity, fulfilling delivery, and handling payment.
• To communicate with you about your order or respond to your queries.
• To comply with legal and regulatory obligations.
• To improve our products, services, and customer experience.
• If you have opted in, to send you offers and updates about Lambeth Flowers.

Lawful Basis for Processing

We process your data under the following GDPR lawful bases:

• Performance of a Contract: Most of the data we collect is necessary for entering into and fulfilling orders with you.
• Legitimate Interests: We may use your data for administrative purposes, service improvement, or fraud prevention, provided that our interests are balanced with your rights.
• Legal Obligation: In some cases, we need to process certain data to meet legal or tax requirements.
• Consent: For direct marketing, we rely on your explicit consent, which you may withdraw at any time.

Data Retention

Lambeth Flowers retains your personal data only as long as necessary to fulfil the purposes described in this policy and to comply with legal obligations. In general, we keep order records for up to seven years to meet accounting and tax requirements. Communication records are typically kept for no longer than two years unless they form part of ongoing customer service issues. Data used only for marketing purposes is held until you revoke consent or ask for removal.

Data Processors and Sharing

To provide our services, we may share your data with trusted third-party processors who work on our behalf, including:

• Payment processing companies (for secure payment and fraud prevention)
• IT service providers (such as website or order management platforms)
• Couriers or delivery service providers (to deliver your flowers and gifts)
• Accountants or auditors (for legal and compliance purposes)

All our processors are required to handle your data securely and in accordance with GDPR. We never sell your personal data to third parties for marketing purposes. Where legally required, we may share data with public authorities or law enforcement agencies.

Your Rights Under GDPR

You have the following rights in relation to your personal data under GDPR:

• Right to Access: You can request a copy of the personal information we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete data.
• Right to Erasure: In certain situations, you may ask us to delete your data.
• Right to Restrict Processing: You can ask us to limit how we use your information.
• Right to Data Portability: Where applicable, you can ask us to transfer certain data to another provider.
• Right to Object: You can object to processing where we rely on legitimate interests or use your data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time.

To exercise your rights, you may contact us using the details provided on our website. Please note that we may need to verify your identity before processing your request.

Security of Your Data

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. These include secure storage, restricted access, and regular staff training on data privacy. While we work hard to safeguard your data, please note that no system can guarantee absolute security.

Updates to This Policy

We may review or update this policy from time to time, particularly to reflect changes in the law or our business practices. Any significant changes will be communicated clearly to our customers. Please review this policy periodically to stay informed.

Contacting Us

If you have questions or concerns about how Lambeth Flowers handles your personal data—or if you wish to exercise your GDPR rights—you can find our contact details on our website. We are committed to addressing your concerns promptly and respectfully.