Crystal Palace Flowers: Your Privacy and Data Protection

Privacy Policy for Crystal Palace Flowers Customers

This Privacy Policy describes how Crystal Palace Flowers (“we”, “us”, or “our”) collects, uses, protects, and retains your personal data in accordance with the General Data Protection Regulation (GDPR). This policy applies to all customers placing flower orders with us from Crystal Palace and the surrounding districts. Please review this policy carefully to understand your rights and our responsibilities under data protection law.

What Personal Data We Collect

When you interact with Crystal Palace Flowers for ordering products, we collect and process different types of personal data, including:

• Identity Information: Full name
• Contact Details: Address, phone number (optional), and other provided contact information
• Order Details: Products purchased, delivery instructions, and order history
• Payment Information: Payment method details (e.g., card type) for order processing (note: actual card numbers are typically handled directly by secure payment providers and not stored by us)
• Recipient Details: Recipient’s name, delivery address, and optional phone number (where supplied for delivery purposes)
• Communications: Any correspondence with us, including customer service enquiries, feedback, or complaint communications
• Technical Data: When ordering via our website, your IP address and browser type may be collected through cookies or similar technologies (please see our Cookie Policy for more information)

Lawful Basis for Processing Your Data

Crystal Palace Flowers processes your personal data under the following lawful bases as outlined by the GDPR:

• Contractual Necessity: Processing your personal data is required in order to fulfil your flower orders, manage deliveries, and provide customer service.
• Legal Obligation: We may process certain data to comply with legal and regulatory requirements, such as tax or accounting laws.
• Legitimate Interests: We process limited data to improve our services, maintain security, and ensure an efficient ordering process. We ensure such processing does not override your rights or interests.
• Consent: Where legally required, we will request your explicit consent (e.g., for sending marketing communications). Consent may be withdrawn at any time.

How We Use Your Personal Data

We use the personal data we collect for several purposes, including:

• Processing and fulfilling your flower order(s)
• Delivering flowers to you or your specified recipient
• Contacting you regarding delivery, special instructions, or order queries
• Responding to your requests and handling customer support matters
• Managing our records for accounting, tax compliance, and legal reasons
• Improving our products and customer experience
• Sending you service-related notifications and, where consent is provided, selected marketing messages

How Long We Retain Your Data

We retain personal data only as long as necessary for the purposes stated in this policy, unless a longer retention period is required or permitted by law. Typically, your order and transaction data is kept for up to seven years to comply with legal and tax obligations. Recipient details are retained only as needed for delivery and are typically deleted once delivery is confirmed, unless otherwise required for financial or legal record-keeping.

Any communications or correspondence may be retained for a reasonable period for quality assurance and to handle any disputes.

Our Data Processors and Third Parties

We may share your personal data with trusted third-party service providers (“data processors”) in order to fulfil your order and deliver our services. Examples of such processors include:

• Payment processing providers who securely handle payment details
• Delivery partners or couriers involved in fulfilling your orders
• IT providers who help us operate our website and maintain secure data storage
• Bookkeepers or accountants required for financial and regulatory compliance

All data processors engaged by us are obligated to process your data securely, only on our instructions, and in accordance with the requirements of the GDPR.

We do not sell or rent your personal data. We do not transfer your information outside the European Economic Area unless permitted under data protection law and with appropriate safeguards in place.

Your Rights Under GDPR

As a customer of Crystal Palace Flowers, you have the following rights regarding your personal data:

• Right to Access: You can request to see a copy of the personal data we hold about you.
• Right to Rectification: You can ask that we correct or update any inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data when it is no longer required for processing or by law.
• Right to Restrict Processing: You can request us to restrict how we use your data in certain circumstances.
• Right to Data Portability: You can request us to transmit your data to another service provider.
• Right to Object: You have the right to object to processing where we rely on our legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where our processing is based on your consent, you can withdraw it at any time.

To exercise your rights, or for queries or concerns regarding your data, please reach out to us using our published contact details. We will verify your identity and address your requests as required by GDPR.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in legal requirements or our operations. You are advised to review this notice periodically. The latest revision date will appear at the end of this document.

Scope of This Policy

This Privacy Policy applies exclusively to customers placing orders with Crystal Palace Flowers, whether for themselves or as gifts, from Crystal Palace and the surrounding areas. It covers only data processing activities carried out by Crystal Palace Flowers relating to order placement and fulfilment. For further information on data protection or to request details about third-party processors, please contact us using our published contact methods.

Last reviewed: June 2024.