Privacy Statement for Customers of Peckham Florist

Scope of this Policy

This Privacy Policy describes how Peckham Florist collects, uses, stores, shares, and protects your personal data when you place an order with us in Peckham or the surrounding districts. It is our priority to ensure that your privacy is respected and that all processing of your personal data is compliant with the General Data Protection Regulation (GDPR) and relevant UK data protection laws.

Who This Policy Applies To

This policy applies to all customers of Peckham Florist who place orders for flowers and related products, whether for delivery or collection, within Peckham and surrounding districts. By placing an order, either online, by telephone, or in person, you acknowledge that you have read and understood this policy.

What Personal Data We Collect

When you interact with Peckham Florist and place an order, we collect the following categories of personal data:

• Identification & Contact Details: Name, address, phone number, and delivery address (if different from your own)
• Payment Information: Necessary payment details (such as credit/debit card information or payment transaction ID) processed securely via our payment processor
• Order Details: Product selection, messages for cards, order notes or preferences, and delivery instructions
• Communication Data: Content of correspondence when you contact us for inquiries, customer service, or complaints
• Website Usage Data: Technical information (such as IP address, browser type, access times, and referring websites) collected via cookies, where relevant and with your consent

Purposes & Lawful Basis for Processing

Under the GDPR, we must have a lawful basis to process your personal data. We process your data for the following purposes and on the following bases:

• Order Fulfilment: To process and deliver your order, communicate with you regarding your order, and manage customer accounts. Lawful basis: Contract.
• Customer Service: To respond to enquiries, address complaints, and provide after-sales service. Lawful basis: Legitimate Interests.
• Legal Obligations: To comply with applicable laws and regulations, such as tax and accounting requirements. Lawful basis: Legal Obligation.
• Marketing (with Consent): To send you marketing communications if you have opted-in to receive them. Lawful basis: Consent.
• Website Functionality & Security: To maintain the security and proper functioning of our website. Lawful basis: Legitimate Interests or Consent (for certain cookies).

Data Sharing & Processors

Peckham Florist may share your personal information with trusted third parties (“processors”) that help us deliver our services. These include:

• Payment Service Providers: To securely process payments
• Delivery Partners: To fulfill and deliver your order to the specified address
• IT Service Providers: To host and support our website, order management system, or communications

All processing partners are contractually required to handle your data securely and in accordance with data protection laws. We only provide them with the information necessary to perform their services, and they may not use your data for any other purpose.

Data Retention – How Long We Keep Your Data

We retain your personal data for only as long as is necessary for the purposes for which it was collected, including fulfilling your order, providing you with customer support, and meeting legal, accounting, or reporting requirements. Our main retention periods are as follows:

• Order and Transaction Data: Kept for up to 7 years to fulfil accounting and legal obligations.
• Marketing Data: Retained until you withdraw your consent or opt out.
• Contact and Support Communications: Retained for up to 2 years after resolution of your enquiry.

Once retention periods expire, we securely delete or anonymise your data.

International Data Transfers

We primarily process your personal data within the United Kingdom. Should any data be transferred outside the UK or EU, we ensure appropriate safeguards are in place to protect your information as required by law.

Your Rights as a Data Subject

Under the GDPR, you have specific rights relating to your personal data. These include the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data in certain circumstances ("the right to be forgotten")
• Restriction: Request that we restrict the processing of your personal data in specific situations
• Objection: Object to processing based on legitimate interest or direct marketing
• Portability: Request transfer of your data to another service provider, where technically feasible
• Withdraw Consent: If you have provided consent for processing, you have the right to withdraw it at any time for future processing

To exercise these rights, please contact us using the contact details set out on our website or in your order confirmation documentation.

Your Data Security

We use administrative, technical, and physical measures to safeguard your personal data against unauthorised access, loss, misuse, or disclosure. These measures are regularly reviewed and updated in line with technological advancements and evolving security standards.

Children's Privacy

Our services are not aimed at children and we do not intentionally collect data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we can delete this information promptly.

Policy Updates

This Privacy Policy may be updated from time to time to reflect changes in legislation or our business practices. The latest version will always be made available in our store and on our website. We encourage you to review the policy periodically.

Contact Information

If you have any questions concerning this Privacy Policy or how we process your personal data, please contact Peckham Florist using the contact details provided on our website or as set out in your order documentation. We are committed to handling your privacy queries promptly and transparently.