St James's Florist Privacy Policy

Introduction

St James's Florist takes your privacy seriously and is committed to complying with the principles set out in the General Data Protection Regulation (GDPR) and relevant UK legislation. This Privacy Policy explains how we collect, use, and protect the personal data you provide when ordering flowers or related products and services from St James's Florist. This policy applies to all customers placing orders from St James's and surrounding districts. Please read this policy carefully to understand your rights and how we manage your data.

What Data We Collect

When you place an order or interact with St James's Florist, we may collect, use, store, and process the following types of personal data:

• Contact Information: Name, delivery address, billing address, phone number (optional), and other identifying details necessary for order fulfilment.
• Order Details: Products ordered, any special instructions, recipient's details (including name, delivery address, message card text, and phone number if provided).
• Payment Information: Transaction details necessary to process payment (please note: payment card data is processed by our third-party secure payment processors and is not stored by St James's Florist).
• Communication Records: Details of your communications with us, such as emails or notes from phone calls regarding your order or our services.
• Technical Data: Information about how you interact with our website, including IP address, browser type, and device information (collected through cookies and similar technologies, where applicable and with consent).

The Lawful Bases for Data Processing

The GDPR requires that we have a lawful basis to process your personal data. St James's Florist relies on the following bases:

• Contractual Necessity: The majority of our data processing is necessary to fulfil our contract with you when you place an order. This includes processing your contact details, fulfilling delivery, and communicating with you regarding your order.
• Legal Obligation: We may process your data to comply with legal obligations such as record-keeping for taxation, fraud prevention, or other regulatory requirements.
• Legitimate Interests: Processing for our legitimate business interests, such as improving our services, handling queries, or managing our relationship with you. We will only rely on this basis where such interests are not overridden by your interests or fundamental rights.
• Consent: Where we send you direct marketing communications by email, SMS, or other means, we will only do so with your explicit consent. You have the right to withdraw your consent at any time.

How We Use Your Data

Your personal data is used for the following purposes:

• Processing and delivering customer orders
• Communicating with you about your order and responding to enquiries
• Managing payments and refunds
• Improving our services and website experience
• Sending relevant marketing communications (where consent has been provided)
• Legal, regulatory, or accounting purposes

Data Retention

St James's Florist will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Order-related data (such as contact details and order information) will typically be retained for up to 6 years for accounting, tax, and warranty purposes, in line with UK statutory retention periods.
• Email communications, queries, and customer service interactions are usually retained for up to 3 years after resolution to monitor quality and service consistency.
• If you have subscribed to marketing communications, your contact details will be retained until you withdraw your consent or request erasure.
• Where retention is based on your consent, data will be deleted upon withdrawal of that consent.

Data Sharing and Processors

We may share your personal data with carefully chosen third-party service providers who act as data processors on our behalf in order to deliver our services efficiently. These processors include:

• Payment service providers, who process your transactions securely.
• Delivery and courier partners, to ensure successful delivery of your floral orders.
• IT and website hosting companies, who assist in maintaining secure systems and services.

All processors are required to comply with strict data protection obligations as required by applicable law and our contractual agreements. Your data is never sold or shared for unrelated third-party marketing. In specific cases, data may be disclosed if required by law or to protect the rights and safety of St James's Florist, our staff, or customers.

Your Rights

As a customer of St James's Florist, you have the following rights in relation to your personal data, as provided by applicable data protection law:

• Right to Access: You are entitled to request a copy of the personal data we hold about you and details of how and why that data is processed.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete data about you.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion or removal of your personal data where there is no longer a legal basis for us to retain it.
• Right to Restriction: You may request us to restrict the processing of your data under certain circumstances.
• Right to Data Portability: You can request that your data be provided to you or another controller in a commonly used, machine-readable format.
• Right to Object: You have the right to object to some forms of processing, including direct marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.

Security Measures

We take appropriate technical and organisational security measures to protect your data from loss, misuse, or unauthorised access, alteration, or disclosure. These include secure storage, access controls, encryption where appropriate, and staff training on GDPR principles. While we strive to protect your data, the internet is never entirely secure, so we cannot guarantee absolute security of your information transmitted online.

International Data Transfers

St James's Florist stores and processes your data within the United Kingdom or the European Economic Area (EEA) wherever possible. Should it ever be necessary to transfer your data outside the EEA, we will ensure appropriate safeguards are in place to protect your privacy rights as required by law.

Updates to This Policy

This Privacy Policy may be updated periodically to reflect changes in our practices, legal requirements, or the services we provide. Any significant changes will be communicated appropriately, and the latest version will always be available upon request.

Contact and Further Information

If you have any questions regarding this Privacy Policy or your personal data rights, please contact us in writing, or by visiting our premises. We will respond to your requests in accordance with data protection legislation. If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) or your local supervisory authority.