Privacy Policy for Customers Ordering from Chelsea Flowers

Introduction

Chelsea Flowers values the privacy and data protection of all customers who place orders from Chelsea and the surrounding districts. This policy explains what personal data we collect, why and how we use it, with whom it may be shared, how long we retain it, your rights under the UK General Data Protection Regulation (GDPR), and how you may exercise those rights. Our privacy practices reflect our commitment to compliance with data protection regulations and to safeguarding your information.

Scope of the Policy

This privacy policy applies to all customer personal data collected when an individual purchases goods or services from Chelsea Flowers, either directly through our shop, by telephone, or via our official online ordering system, within Chelsea and its surrounding districts. This policy does not apply to third-party websites or platforms that may be linked to from our services.

Personal Data We Collect

When you place an order with Chelsea Flowers, we may collect the following personal data, as applicable:

• Identity Data: Your name, and, if required, titles for both sender and recipient.
• Contact Data: Delivery address, billing address, telephone number, and, if provided, an email address.
• Order Details: Description of products or services ordered, order notes, delivery instructions, and gift card messages.
• Payment Data: Information required to process your payments such as partial payment card details (the full details are processed by our third-party payment processor and are not stored by us).
• Technical Data: Device identifiers, IP addresses, and browser type, collected automatically if you use our website to assist with troubleshooting and fraud prevention.

We do not intentionally collect or process special categories of personal data (also known as sensitive data) such as health information or data concerning children.

Lawful Basis for Processing

According to GDPR requirements, Chelsea Flowers will only process your personal data where there is a valid lawful basis. The primary legal grounds we rely upon include:

• Contractual necessity: To process and deliver your order, communicate order status, send invoices, and provide necessary customer support.
• Legitimate interests: To improve our services, respond to inquiries, keep records of sales for business purposes, detect and prevent fraud, and ensure network security.
• Legal obligation: To meet accounting, tax, or regulatory requirements.
• Consent: Where optional, such as for sending marketing communications, we will always ask for your explicit consent, which may be withdrawn at any time.

How We Use Your Data

We use your data primarily to fulfil your orders, process payments, deliver flowers and related goods, and communicate with you about your purchase. Additionally, we may use the data:

• To send notifications, confirmations, and updates regarding orders and deliveries.
• For internal record-keeping and reporting.
• To respond to customer inquiries, feedback, or complaints.
• Where you have consented, to provide promotional offers or newsletter updates.
• To maintain the security of our website and systems.

Processors and Data Sharing

To provide our services efficiently, Chelsea Flowers may share your personal data with trusted third-party processors. These include:

• Payment processors: For secure payment transactions.
• IT service providers: For order management systems, website hosting, and customer databases.
• Delivery partners: For transporting your orders to the intended recipient.

All third-party processors are contractually bound to comply with GDPR requirements. They may only process personal data on our instructions and must demonstrate appropriate security measures.

We do not sell or rent your data to third parties. Personal data may also be disclosed if legally required or in response to lawful requests by public authorities.

Data Retention

Chelsea Flowers retains personal data only as long as necessary to fulfil the purposes for which it was collected, including to meet any legal, accounting, or regulatory obligations. Typically, we retain customer order data and related information for six years after your last order, unless a longer retention period is required by law or necessary to resolve disputes or enforce agreements.

Where your personal data is no longer required, it will be securely deleted or anonymised so that it can no longer be associated with you.

Your Rights Under GDPR

As a customer, you have the following data protection rights:

• Right to Access: You may request details of personal data we hold about you.
• Right to Rectification: You can request correction of any inaccurate or incomplete data.
• Right to Erasure: You can ask us to delete your personal data in certain circumstances.
• Right to Restrict Processing: You have the right to limit how we process your data under some circumstances.
• Right to Data Portability: You may ask for a copy of your data in a machine-readable form.
• Right to Object: You may object to our processing of your data if relying on legitimate interests.
• Right to Withdraw Consent: Where you have given consent, you may withdraw it at any time.

To exercise these rights, you may contact us using the details on our website or in writing at our business premises. In some cases, we may need to confirm your identity to action these rights.

Data Security

We implement appropriate organisational and technical measures to protect the confidentiality, integrity, and availability of your data. These include access controls, encryption, staff training, and regular review of our security practices to prevent data breaches or unauthorised access.

International Data Transfers

Your personal data is stored within the UK or the European Economic Area (EEA). If on rare occasions data is transferred outside this area, we ensure adequate protections are in place as required by law, such as contractual clauses or adequacy decisions.

Policy Updates

This privacy policy may be updated periodically to reflect changes in our practices or for legal compliance. Any significant changes will be notified to customers where appropriate.

Further Information

If you have questions or concerns about how we use your data, please contact us. We will always work to respond promptly and resolve any issues you raise concerning your data privacy rights.