Your Data and Kingston Flowers: Our GDPR Privacy Policy

Scope of this Privacy Policy

This Privacy Policy sets out how Kingston Flowers collects, uses, stores, and protects personal data for customers placing orders from Kingston and surrounding districts. By engaging with our services, you acknowledge and accept the practices described herein. This policy is designed in compliance with the UK General Data Protection Regulation (GDPR) and provides information about your rights regarding your personal data.

Personal Data We Collect

When you place an order or interact with Kingston Flowers, we may collect the following types of personal data:

• Identification Data: Your full name, delivery recipient’s name.
• Contact Information: Address, delivery address, telephone number, and any other contact details provided for the delivery process.
• Order Details: Information about the products you order and customized messages or preferences.
• Payment Data: Payment transaction details (processed by secure third-party payment providers; Kingston Flowers does not store card details).
• Correspondence: Communications between you and Kingston Flowers, including any feedback or complaint information.
• Technical Data: Your IP address, browser type, and device information collected through our website (where applicable) to enhance user experience and maintain site security.

Lawful Basis for Processing Your Data

Kingston Flowers processes your personal data under several lawful bases, as required under the GDPR:

• Performance of a Contract: When you place an order, processing your data is necessary to fulfil your purchase and complete the delivery.
• Legal Obligations: We may process data to meet legal requirements, such as maintaining sales records for tax purposes.
• Legitimate Interests: We may process data for our legitimate business interests, such as improving our services, responding to enquiries, and ensuring the security of our systems — provided these interests do not override your fundamental rights.
• Consent: In certain cases, such as for direct marketing when required, we seek your explicit consent before processing your data in this manner. You can withdraw your consent at any time.

How We Use Your Data

Your data is used predominantly to:

• Process and deliver your orders, including communicating about delivery or any changes.
• Contact you regarding questions, updates, or feedback about your order.
• Respond to your customer service requests and manage complaints.
• Meet our legal and regulatory obligations.
• Improve our products and customer experience (using aggregated or anonymised data).
• Send service-related updates and, where permitted, marketing communications (you can opt out at any time).

Data Retention

Kingston Flowers only retains your personal data for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, accounting, or reporting requirements. Typically, order-related data will be retained for up to six years after the transaction, unless a longer retention period is required by law. Where your data is no longer required, it will be securely deleted or anonymised.

Data Processors and Third-Party Sharing

To operate efficiently, we may share your data with trusted service providers (data processors) who support us in delivering our services. Such processors may include:

• Payment processing companies for secure transactional services.
• Courier and delivery services to ensure your order reaches the intended recipient.
• Technical support and IT service providers who help maintain our digital infrastructure.

All such third parties process your data under written instructions or agreements that ensure your privacy is safeguarded, and that your data is not used for purposes beyond those specified by Kingston Flowers. We do not sell or rent your personal information to third parties for their marketing purposes.

Your Data Protection Rights

As a data subject under the GDPR, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of any inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data where there is no compelling reason for us to keep it ("right to be forgotten").
• Right to Restrict Processing: Request that we restrict the processing of your data in certain circumstances.
• Right to Data Portability: Obtain and reuse your personal data for your own purposes across different services.
• Right to Object: Object to certain types of processing, such as direct marketing.
• Right to Withdraw Consent: Where you have provided consent for specific processing activities, you may withdraw this consent at any time.

To exercise these rights, please contact Kingston Flowers using the contact methods detailed on our website. We will aim to respond to all legitimate requests within one month.

Security of Your Data

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, accidental loss, alteration, or disclosure. Access to your personal data is limited to those employees and third parties who have a legitimate business need to know. Data transfer and processing agreements with third-party processors are regularly reviewed to ensure ongoing data security and GDPR compliance.

International Data Transfers

As a local florist, Kingston Flowers endeavours to process and store your data within the United Kingdom. Should there ever be a need to transfer your personal data outside the UK (for example, for technical support reasons), we will ensure that such transfers are compliant with applicable data protection laws and that your information receives an adequate level of protection.

Changes to this Privacy Policy

Kingston Flowers reserves the right to amend this Privacy Policy when required, to reflect changes in legislation or our data processing practices. Updates will be posted on our website, and we encourage you to review this page periodically to remain informed about how we protect your information.

How to Contact Us

If you have any questions, concerns, or requests regarding your personal data or this Privacy Policy, please use the contact information provided on our website to get in touch. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) or your local data protection authority.