Yearly Flowers – yearlyflowers.com
Last updated: [date]
1. Who we are
This policy explains how Clino Ltd, trading as Yearly Flowers, collects and uses personal information when you visit yearlyflowers.com, buy a plan, or receive flowers from us.
- Controller: Clino Ltd t/a Yearly Flowers, a company registered in England and Wales (company number 16046677), registered office [REGISTERED OFFICE ADDRESS] [TO CONFIRM]
- ICO registration number: [PLACEHOLDER]
- Contact (including for privacy questions): contact@yearlyflowers.com
We are the “controller” of your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We also follow the Privacy and Electronic Communications Regulations (PECR) for cookies and marketing.
2. The information we collect
About buyers (you):
- name, email address, phone number and billing address;
- your order: products, plan length, occasions, delivery dates, order history and refunds;
- your communications with us (emails, complaints, change requests);
- your marketing preferences.
About recipients:
- name and delivery address;
- the occasion and its dates (for example a birthday or anniversary);
- any delivery notes (for example “leave with neighbour”).
Personalised messages:
- the context you give us (names, memories, tone) and the messages we write from it.
Please don’t include sensitive information in message context, such as details about someone’s health, religion, sexuality, ethnic origin or political views, unless it is truly needed for the message and you have the person’s agreement. Messages are printed and handled by our florist and couriers.
Payment information:
- payments are processed by Stripe [and PayPal]. We do not see or store your full card details. We receive confirmation of payment, the payment method type, the last four digits of the card and the billing details needed for the order.
Website, cookie and analytics information:
- IP address, browser and device type, pages visited, and how you use our site, collected by cookies and similar technologies (see section 10).
3. How we use it, and our lawful bases
| What we do | Lawful basis |
|---|---|
| Take your order, take payment, make your deliveries every year, handle changes, cancellations, refunds and complaints | Contract – we need it to carry out our contract with you |
| Use recipients’ names, addresses and occasion dates to deliver your gifts | Legitimate interests (see below) |
| Write and print personalised messages | Contract (for you) and legitimate interests (for anyone named in the message) |
| Send service emails (order confirmation, delivery reminders, the chance to update details before each delivery) | Contract |
| Send marketing emails about our products | Consent, or for existing customers, our legitimate interests in marketing similar products, as allowed by PECR (“soft opt-in”). You can opt out at any time. |
| Set non-essential cookies (for example analytics) | Consent |
| Keep tax and accounting records | Legal obligation (we must keep them for 6 years) |
| Keep our website secure, prevent fraud, and deal with legal claims | Legitimate interests |
Our legitimate interests in using recipients’ details. We need recipients’ names, addresses and occasion dates to deliver the gifts our customers have paid for. We have balanced this against recipients’ interests. We use only the minimum information needed, we use it only to deliver flowers (never to market to recipients), most people would reasonably expect a gift to reach them this way, and recipients can object at any time (see section 4). We think this is fair and does not override recipients’ rights.
4. If you are a recipient
Someone has chosen to send you flowers, so they gave us your name, address and an occasion date.
- On request, we will tell you who gave us your details and how we got them (normally, the person who bought the plan), and what we hold about you.
- We use your details only to deliver flowers and messages. We will not send you marketing or sell your details.
- You can ask us to stop and delete your details at any time by emailing contact@yearlyflowers.com. We will do this and contact the buyer to arrange a change of recipient or a refund. We will not pass on your new address or any other details to the buyer without your permission.
5. Who we share information with
We share personal information only where we need to, with:
- our florist or fulfilment supplier [NAME – TO CONFIRM], to prepare and send your flowers (recipient name, address, delivery date, product and message);
- couriers and Royal Mail, to deliver them (recipient name and address, and sometimes a phone number or email for delivery updates);
- Stripe [and PayPal], to process payments and prevent fraud;
- Hostinger, who host our website and store order data;
- our email provider [NAME – TO CONFIRM], to send and receive email;
- our accountants and professional advisers, for accounting, tax and legal purposes;
- authorities such as HMRC or the police, where the law requires it;
- a buyer or successor if our business, or the plans, move to another company (see our Terms and Conditions). Your information would continue to be protected in line with this policy.
Our service providers act on our instructions under written contracts and must keep your information secure. Some (such as Stripe and PayPal) also act as independent controllers for things like fraud prevention and their own legal obligations, under their own privacy policies.
We never sell your personal information.
6. International transfers
Some of our providers process data outside the UK (for example Stripe and PayPal in the United States, and hosting providers in the European Economic Area). When this happens, we make sure the information is protected by one of the safeguards allowed by UK law:
- the country has been found by the UK to have adequate data protection (for example EEA countries, or US companies certified under the UK Extension to the EU-US Data Privacy Framework); or
- the transfer is covered by the UK’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
You can ask us for more details about these safeguards.
7. How long we keep it
| Information | How long |
|---|---|
| Buyer details and order records | For the length of your plan, then 6 years (for financial and tax records, and in case of legal claims) |
| Recipient details and personalised message content | For the length of your plan, then deleted within 12 months of the plan ending or being cancelled |
| Marketing preferences | Until you opt out, then a record of the opt-out so we don’t contact you again |
| Website and analytics data | In line with our cookie policy |
| Emails and complaints | Up to 6 years after the issue is resolved |
If a recipient asks us to delete their details, we do so promptly (see section 4).
8. Your rights
You have the right to:
- access the personal information we hold about you;
- rectification – have inaccurate information corrected;
- erasure – have information deleted in some circumstances;
- restriction – limit how we use it in some circumstances;
- object to our use of it, including where we rely on legitimate interests, and always to direct marketing;
- data portability – receive information you gave us in a common format, or have it sent to another organisation;
- withdraw consent at any time, where we rely on consent (this doesn’t affect anything we did before you withdrew it).
To use any of these rights, email contact@yearlyflowers.com. We may need to check your identity. We will respond within one month. If your request is complex, we may extend this by up to two further months, and we will tell you if we do. There is usually no charge.
Complaints. If you are unhappy with how we use your information, please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk, 0303 123 1113.
9. Marketing
We will only send marketing emails if you have agreed, or if you are an existing customer and did not opt out of hearing about similar products. Every marketing email has an unsubscribe link. We never send marketing to recipients.
10. Cookies
We use cookies and similar technologies on our website.
- Essential cookies make the site and checkout work (for example your basket and keeping payments secure). These do not need consent.
- Non-essential cookies (such as analytics [and advertising]) are set only if you agree through our cookie banner.
You can change your choices at any time using the Cookie settings link at the bottom of every page. For full details of the cookies we use, see our Cookie Policy [TO CREATE].
11. Automated decisions
We do not make decisions about you using solely automated processing, including profiling, that have legal or similarly significant effects. (Our payment providers may use automated fraud checks. See their privacy policies.)
12. Security
We take appropriate technical and organisational measures to protect personal information, including:
- encrypted (HTTPS) connections on our website;
- card payments handled by PCI-DSS compliant providers, so we never hold card details;
- access to order data restricted to people who need it, protected with strong passwords and two-factor authentication;
- keeping our website software and plugins up to date;
- contracts with our suppliers that require them to keep data secure.
No system is completely secure. If a data breach is likely to put your rights at high risk, we will tell you and, where required, the ICO.
13. Children
Our website is not aimed at children. You must be 18 or over to buy from us. We do not knowingly collect information from anyone under 18 except as a gift recipient, where a buyer gives us the recipient’s name and address.
14. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new “Last updated” date. If we make important changes, we will tell existing customers by email.
15. Contact us
Clino Ltd t/a Yearly Flowers
[REGISTERED OFFICE ADDRESS] [TO CONFIRM]
Email: contact@yearlyflowers.com