GDPR Privacy Statement for Soho Flowers Customers

Introduction

At Soho Flowers, we value your privacy and are fully committed to safeguarding your personal information. This Privacy Policy explains how we collect, process, use, retain, and protect your data when you place orders with Soho Flowers, whether you are a resident or customer ordering from Soho or surrounding districts. This policy also details your rights under the General Data Protection Regulation ("GDPR"). Please read it carefully to understand our practices regarding your information.

Scope of This Policy

This Privacy Policy applies to all individuals and customers who place orders with Soho Flowers, in Soho and neighbouring areas. By ordering our products, you acknowledge and accept the practices described in this policy. This policy does not apply to third-party websites or services that may be linked from our platforms.

What Personal Data We Collect

We collect the following categories of personal data, depending on how you interact with us:

• Identity Data: Your full name or the recipient’s name if you are ordering for someone else.
• Contact Data: Billing and delivery addresses, email address, and telephone number.
• Order Information: Items ordered, order notes, and gift messages.
• Payment Data: Payment card details (processed securely by payment providers, not stored by Soho Flowers).
• Technical and Usage Data: IP address, browser type, device information, and information about how you use our website.
• Correspondence: Communications with us, including queries, feedback, or complaints.

We do not intentionally collect or process any special categories of personal data (such as health or biometric data) concerning our customers.

Lawful Basis for Processing

We only process your personal data where we have a valid legal basis under GDPR. The main lawful bases we rely upon are:

• Performance of a Contract: To process and deliver your orders, confirm your details, and provide after-sales service.
• Legal Obligations: To comply with laws such as tax and accounting regulations.
• Legitimate Interests: To enhance and improve our services, prevent fraud, and better understand customer preferences. We ensure such interests do not override your fundamental privacy rights.
• Consent: Where required, such as for marketing communications, we will ask for your explicit consent. You may withdraw consent at any time.

How We Use Your Data

Your personal data is used to:

• Fulfil your orders, including arranging delivery and processing your payment securely.
• Communicate with you regarding your order status, delivery, or customer care.
• Improve our products and services, including website usability and customer service responsiveness.
• Comply with applicable legal and regulatory requirements.
• If you consent, send you marketing communications about new products or special offers.

Disclosure of Information to Third Parties (Processors)

We may share your data with selected third parties who act solely on our instructions. These include:

• Payment Service Providers: To securely process online transactions. Your payment details are managed directly by these providers and are not retained by Soho Flowers.
• Delivery Partners and Couriers: To ensure accurate and timely delivery of your orders.
• Information Technology and Web Hosting Providers: To maintain the functionality and security of our website and systems.
• Professional Advisors: Such as accountants or legal consultants, where necessary for compliance and business operations.

All third-party processors are contractually obliged to safeguard your data and only use it for the specified purposes. We do not sell or rent your personal data to anyone.

Data Retention

Soho Flowers retains your personal data only for as long as is necessary for the purposes outlined in this Privacy Policy. Generally, we keep order and customer details for up to seven years to comply with statutory and contractual obligations (such as tax or accounting regulations). After this period, your data is securely deleted or anonymised. If you unsubscribe from marketing communications, we will update our records promptly to reflect your preference.

Data Security

We are committed to protecting your personal information. We implement appropriate technical and organisational measures to prevent unauthorized access, disclosure, alteration, or destruction of your data. Access to your personal data is restricted to only those employees, agents, or contractors who require it to fulfil their duties.

User Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data that we hold about you.
• Right to Rectification: Request correction of incomplete or inaccurate data.
• Right to Erasure: Ask us to delete your data where we no longer have a lawful reason to process it.
• Right to Restriction: Request restriction of how we process your data in specific circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used format and transfer it to another provider.
• Right to Object: Object to processing based on our legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: If processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

If you wish to exercise any of these rights, please contact us using the contact details provided on our website or ordering channels. We may need to confirm your identity before fulfilling your request, to safeguard your information.

International Transfers

We primarily process your data within the UK and European Economic Area (EEA). If we must transfer your data outside these areas (for example, if a processor operates internationally), we will ensure it is protected by appropriate safeguards, such as by incorporating the European Commission's standard contractual clauses.

Updates to This Policy

We may revise this Privacy Policy occasionally to reflect changes in regulation, technology, or our business practices. Any updates will be posted on our official website with an updated effective date. We encourage you to review this policy periodically.

Contact and Complaints

If you have any questions, concerns, or complaints related to the processing of your personal data or this policy, please contact us using the information provided on our website. You also have the right to lodge a complaint with the UK Information Commissioner's Office if you believe we are not meeting our legal obligations regarding your personal information.