Privacy Policy for Dartmouth Park Flowers Customers

Our Commitment to Your Privacy

At Dartmouth Park Flowers, we are dedicated to maintaining the privacy of our customers placing orders from Dartmouth Park and the surrounding districts. This Privacy Policy explains what personal data we collect, how and why it is processed, how long we retain it, the third-party processors we work with, and your legal rights under the UK's General Data Protection Regulation (GDPR). By placing an order with us, you acknowledge and consent to the practices outlined below.

What Data We Collect

When you place an order with Dartmouth Park Flowers, we collect and process the following types of information:

• Identity Data: Your full name.
• Contact Data: Billing address, delivery address, and contact details (such as phone number).
• Order Details: Product orders, delivery instructions, any personal messages attached to orders, and payment method (note: we never store card numbers).
• Transaction Data: Details of orders, payments made, and order fulfilment activity.
• Communications: Any correspondence you have with us, including queries, feedback, or complaints.

We do not knowingly collect personal information from children under the age of 16. If you believe a child has provided us with personal data, please contact us so we can remove the information.

Lawful Basis for Processing Your Data

We only process your personal data when we have a lawful basis under GDPR. Our legal grounds are:

• Contractual Necessity: Processing is necessary to fulfil your order, including confirming, preparing, and delivering your flowers.
• Legitimate Interests: For quality assurance, fraud prevention, record-keeping, and data analysis to enhance our services. We ensure our interests do not override your rights.
• Legal Obligation: Compliance with accounting, tax, and regulatory requirements.
• Consent: If we ever send you marketing communications, we will ask for your specific consent, which you may withdraw at any time.

How We Use Your Personal Data

Your personal data is used only for the following purposes:

• Processing your flower orders and payments.
• Communicating with you about your order status, delivery, or any issues arising.
• Improving our order process, products, and customer service.
• Managing refunds, complaints, or returns if necessary.
• Fulfilling obligations under applicable laws and regulations.

Data Retention Policy

Dartmouth Park Flowers retains your personal data only as long as is necessary for the purposes described above. Generally, we keep order and transaction records for up to six years to comply with tax and accounting requirements. After this period, your data will be securely deleted or anonymised. Any information given for marketing purposes will be retained until you withdraw your consent.

Processors and Data Sharing

We use carefully selected and GDPR-compliant third-party service providers ("processors") to support our business operations. These include:

• Payment processors: To securely process your payments. We never have access to your full card details.
• Delivery partners: For the fulfilment and delivery of your order within Dartmouth Park and nearby districts.
• IT service providers: To securely host our website and maintain business systems.
• Professional advisors: Such as accountants or legal consultants, if required by law or to safeguard our legal rights.

All third-party partners are required by contract to protect your data, only process it for specified purposes, and not to use it for their own benefit. Your personal information will never be sold, shared, or disclosed for marketing by third parties.

Your GDPR Rights

As a data subject under GDPR, you have the following rights:

• Access: You may request a copy of your personal data held by us.
• Rectification: You can ask us to correct inaccurate or incomplete personal data.
• Erasure: You can request deletion of your personal data where there is no valid reason for us to retain it.
• Restriction: You may ask us to restrict the processing of your data in certain circumstances.
• Objection: You may object to how we process your data on grounds relating to your specific situation.
• Portability: You can ask us to transfer your data to another provider, where technically feasible.
• Withdraw Consent: If processing is based on consent, you can withdraw this at any time.
• Make a Complaint: You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data are not handled in accordance with GDPR.

Security of Your Data

Your privacy is essential to us. We implement appropriate technical and organisational measures to protect your personal data from loss, misuse, unauthorised access, or disclosure. However, while we strive to protect your information, no internet transmission is fully secure, and we cannot guarantee absolute security.

International Transfers

We do not routinely transfer your personal data outside of the United Kingdom and European Economic Area. If such a transfer becomes necessary, we will ensure appropriate safeguards are in place, as required under GDPR.

Policy Updates

This Privacy Policy may be updated from time to time to reflect changes in legal requirements or our data practices. The most current version will always be available with any significant changes communicated where appropriate.

Contact and Further Information

If you have questions, wish to exercise your data protection rights, or require additional information regarding this policy, please contact us using the details provided on our website or in your order confirmation correspondence.