Privacy Policy

Who are we?

JOE'S BLOOMS LIMITED (“we,” “our,” “us”, “Joe's Blooms”), a company registered in England (Company Number: 13892230), recognise the need for appropriate protections and management of your personal data.

When we collect and use your personal data in the way set out in this Privacy Notice, we are the controller for the purpose of Data Protection Legislation (defined below) and are responsible for your personal data.

This Privacy Notice sets out the way in which your personal data will be used by us. This Privacy Notice applies whenever we collect your personal data. For the most part this Privacy Notice refers to the activities of Joe's Blooms but where your personal data is collected by, shared with and/or used by another organisation, this is explained within the notice.

Key Terms

For the purposes of this Privacy Notice, the terms controller, processor, data subject, personal data, and processing shall have the meaning given to them in the UK GDPR.

Data Protection Legislation means the Data Protection Act 2018 and the UK GDPR.

Personal Data is information that can be used to identify or contact a specific individual, such as a name, address, telephone number, email address, etc., and also online identifiers and location data such as IP addresses and mobile device IDs.

Special Category Data is personal data revealing your racial or ethnic origin; political affiliations and opinions; religious or philosophical beliefs; or trade union membership; and genetic data; biometric data; data related to your health or data concerning your sex life or sexual orientation; and criminal convictions or involvement in criminal proceedings.

UK GDPR means the UK General Data Protection Regulation as defined in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.

Websites means the whole of any part of the website controlled or operated by Joe's Blooms and located at Home | Joe's Blooms.

Contact Us

If you have any questions regarding this Privacy Notice you can contact us at:

Joe’s Blooms Limited
24 Crabtree Road
Camberley
Surrey
GU15 2SZ

If you are unhappy with how we handle your personal data you can contact us using the contact details noted above and / or notify the Information Commissioner’s Office (ICO) (please see: Make a complaint for more information). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Third party links

Please note that our websites and other digital platforms may contain links to third party websites/digital platforms which are provided for your convenience and to allow us to fulfil the objectives of a campaign or project.

Joe’s Blooms is only responsible for the privacy practices of our own websites and digital platforms. We recommend that you refer to the privacy notice of each website/digital platform you visit.

‍Changes to this Privacy Notice

We keep our Privacy Notice under regular review and the most current version can be found on our website or requested from us on the contact details given above.

Collecting Your Personal Data

‍We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Identity Data includes first name, last name or similar identifier (such as date of birth or ID).

Contact Data includes personal or business address (postcode), personal or business e-mail address and personal or business telephone numbers, social media account name, and contact preferences, date of birth, geographic location, photograph or image, and information about relationships including spouses, partners, or other family members. We may also make photo or video recordings of you where you attend our events.

Financial Data includes bank account and payment card details as well as gift aid registration details.

Technical Data includes internet protocol (IP) address, geographic location, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website. Where possible, we use aggregated data or anonymous information which does not identify individual visitors to our website.

Profile Data includes interactions and communications made by you, your interests, preferences, feedback and survey responses.

Usage Data includes information about how you use our website and services and includes information about your service preferences and survey responses (where applicable).

Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences.

Employment Data includes information about your employment qualifications, and experience.

And any other data you provide to Joe’s Blooms Limited.

We may from time to time collect Special Categories of Personal Data about you (this could include details about your race or ethnicity, primarily religious or philosophical beliefs, political opinions and beliefs, health, sex life, sexual orientation, political opinions, trade union membership).

We may collect your personal data in the following ways:

Direct interactions. You may give us your personal data directly by filling in our forms (online and offline), engaging with our social media accounts or by corresponding with us or by speaking with us in person, participate and/or attend one of our events, complete a survey or a questionnaire, request marketing or other communications to be sent to you.

Indirect interactions. We may also receive personal data about you indirectly from our systems, from publicly available sources and databases, and from third parties. For example:

From your use of our IT systems
Publicly available data such as census information
From third parties, for example, including but not limited to, consumer checks, Companies House
Any other third party service providers that we engage in the course of business

Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. Please see our cookie policy for further details.

Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:

analytics providers such as Google based outside the EU
social media platforms such as Twitter, Facebook, LinkedIn or Instagram in regards to your interactions with us through those platforms

We may occasionally supplement your data with other publicly available information to ensure our communications are relevant. We may store relevant information about you that you voluntarily share with us.

We use your personal data on the following legal bases:

Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
Where we have a contract with you or are taking steps to enter into a contract with you including employment contract and relationship
Where you have given your consent to the use of your data
Where it is necessary for the establishment, exercise or defence of legal claims

If we are processing Special Category Data we may also rely on the following conditions in addition to the legal bases above:

Where you have given your consent to the use of your data
Where we are required to process your data in the public interest for the purposes of safeguarding of individuals at risk or regulatory requirements relating to unlawful acts and dishonesty
Where we are required to process your data in the public interest for the purposes of equal opportunities or treatment
Where it is necessary for the purposes of exercising our rights (or your rights) in the field of employment, social security, social protection law, or a collective agreement in so far as it is authorised by law

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.


Purpose / Activity	Type of data	Lawful Basis
Website Users / Customers To provide you with the best experience on our website, to answer your queries and ensure our services meet the needs of our customers. To tailor our website so that you see content relevant to you, to collect statistics, reports, responses to surveys and questionnaires and to analyse traffic patterns and related site information. To provide you with the services and/or information that you have requested.	(a) Identity (b) Contact (c ) Technical (d) Usage (e) Aggregated (f) Financial (g) Other data We aggregate this data and it does not identify any website users (except where you contact us with a question/query). We use this for our research analysis, testing, monitoring, risk management and administrative purposes and may disclose Aggregated data to third parties for advertising, marketing and promotional purposes.	We rely on our legitimate interests in operating and managing our website and online services and answering any queries you have and providing goods and/or services to you. Your consent is sought for use of cookies when you access our website.
Applicants To review your application or CV. To inform you of job opportunities. To provide you with our support, share news updates, and keep you up to date on our work. To review your suitability for the role for which you have applied and comply with any regulatory or legal requirement. To train you and provide you with support as a member of staff. Maintain records of staff and managing our employment relationship.	(a) Identity (b) Contact (c ) Employment (d) Health (e) Special Category Data (f) Profile Data (g) Other Data	We use (a) to (e) on the basis of contract and we are legally obliged to process information about your right to work in the UK and we may ask for a copy of your ID as evidence of your right to work if we interview you after you apply to any of our job advertisements. We are legally obliged to make reasonable adjustments for you if you have a disability. For (d) we are requesting information in relation to your health to ensure you can attend an interview, our events and that we have made any necessary adjustments to accommodate you – when we are collecting this information we will ask for your consent. Once you start working with us we rely on legitimate interests and contract to process your information – this enables us to send you information. We may ask for your opinions or thoughts on matters via surveys and/or questionnaires.
Consultants/Service Providers/Suppliers To engage with you to provide goods and/or services to us.	(a) Identity (b) Contact (c ) Financial	Based on the contract we have with you to provide goods and/or services to us.
Research To communicate with current and prospective customers, understand their views and opinions conducted via face-to-face focus groups, surveys online and by telephone.	(a) Identity (b) Contact (c ) Marketing and Communications (d) Special Category Data (e) Profile Data (f) Other Data	We rely on our contract with you or on our legitimate interests for (a), (b), (c) and (d) in maintaining records, and managing our sales. We use (d) on the basis of your consent - as this is a special category of personal data.

Where we are relying on contractual obligation and/or legal obligation as a legal basis for collecting and processing your personal data, we will not be able to offer our services to you if you choose not to provide us with this information or not be able to perform the contract we have entered into with you.
‍
‍Marketing
‍We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We have established the following personal data control mechanisms.

We may use your contact details and any enquiry information to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services may be relevant for you (we call this marketing).

You will receive marketing communications from us only if you have provided your consent, requested information from us, and have not opted out of receiving marketing information. At the time of sign-up, we will ask for your explicit consent to send you marketing communications. You can withdraw your consent and stop receiving marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us directly.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a job position or contacted us to enquire about our services or other transactions.

‍Research and profiling
‍We carry out research and analysis on customers, to determine the success of our marketing, better understand behaviour and responses and identify patterns and trends. This helps inform our approach towards marketing and make Joe’s Blooms a stronger and more effective organisation. Understanding our customers, their interests and what they care about also helps us provide a better experience (e.g. through more relevant communications).

In order to better target our communications, we may use data from publicly available third-party sources to assess your interest in our services and whether you may be inclined to use our services. We or our trusted partners also may use profiling and screening techniques to ensure that the communications we send are relevant to you. This allows us to provide an improved experience for our customers.

When building a profile of our customers we may analyse geographic and demographic information, media coverage, previous research responses, lifestyle, information associated with your postcode, estimate of age, as well as your online behaviour to better understand your interests so we can contact you with relevant messages. An example of this would be looking at your location so we can share information about relevant developments related to Biodiversity Net gain.

We may profile customers in terms of financial and practical support. For example, we may keep track of the amount, frequency and value of each person’s support with Joe’s Blooms. This information helps us to ensure communications are relevant and timely.

We may aggregate and anonymise personal data so that it can no longer be linked to any particular person. This information can be used for a variety of purposes, such as to identify trends or patterns within our existing customer base. This information helps inform our actions and improve our services and materials.

How Do We Keep Your Personal Information Up-To-Date?
Please contact us at the contact details above as soon as possible after there is any change to your personal details, including your contact details.

‍Do We Share Your Personal Data?
‍Unless stated otherwise, your personal data will be kept secure within Joe’s Blooms using appropriate technical controls to protect your details. We will not sell, trade or lease your personal data to others. As an exception to the above, please note that your personal data will be made publicly available where this is required by law.

The following third parties may have access to your personal data and, in some circumstances, your special category data (if applicable):

Any other person who is authorised to act on your behalf
Staff working on behalf of Joe’s Blooms
Social media providers
IT, software and communications service providers and other technology providers, document processing service providers, document and information storage providers some of whom may store personal data in cloud based data centres. We engage several IT service providers
Our server provider, who provide our subscriptions and hosting services, who is currently Google Workspace whose servers are located in the EEA and in non-EEA locations
Regulators, government departments, law enforcement authorities, tax authorities, police, regulatory bodies or legal advisors and insurance companies
Our digital marketing partners who may process data in the EEA and outside the EEA, including in the USA and/or Canada
Our third party payment processing provider who assists us in providing payment services
Any relevant dispute resolution body or the courts
Persons in connection with any sale, merger, acquisition, disposal, reorganisation or similar change in our business
Third parties providing a reference about you, where you have agreed that we can request this or have asked us to request it

Please note this above list is non-exhaustive and there may be other examples where we need to share personal data with other parties in order to provide our services.

‍How we protect your information
We have in place administrative, technical and physical measures designed to guard against and minimise the risk of loss, misuse or unauthorised processing or disclosure of the personal data that we hold.

As a condition of employment, our employees are legally obliged to respect the confidentiality of your data as are any companies acting as approved data processors for Joe’s Blooms.

‍Cookies
‍In common with many other website operators, we use standard technology called “cookies” on our websites.

International transfers
Many of our external third parties, processors and sub-processors are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK or EEA. If you live or work outside of the UK or the EEA, we may need to transfer your personal data outside of the UK or the EEA to correspond with you. We also may transfer data outside the UK or the EEA where our service providers host, process, or store data outside the UK or the EEA. Where we do this, we will ensure that the transfer is to a country covered by an adequacy decision of the European Commission or the Secretary of State and/or the ICO or is otherwise made in circumstances where we have put appropriate safeguards in place to protect your data in accordance with the Data Protection Legislation (e.g. using standard contractual clauses, etc.).

‍Data Retention
‍We will not hold your personal information for any longer than is necessary for the uses outlined in the Notice, unless we are required to keep your personal data longer to comply with the law and any regulatory requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data are available in our Retention Policy which is available upon request.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

‍Data Subject Rights
You have certain rights under the Data Protection Legislation which can be exercised by contacting us at:
‍
Joe’s Blooms Ltd

24 Crabtree Road
Camberley

Surrey

GU15 2SZ

Email info@joesblooms.com

including:

The right to access the personal data held about the you by making a subject access request in accordance with the Data Protection Legislation. We may charge a reasonable fee when a request is manifestly unfounded or excessive
The right to have your personal data rectified if it is inaccurate or incomplete
The right to request to have your personal data deleted in certain specific circumstances as set out in the Data Protection Legislation
The right to request to restrict the processing of your personal data in certain specific circumstances as set out in the Data Protection Legislation
The right to ask us not to process your personal data for marketing purposes or for purposes based on our legitimate interests in certain specific circumstances as set out in the Data Protection Legislation
The right to ask us to not undergo automated decision making
Where you have provided consent, the right to withdraw such consent at any time

Further details about your rights can be found on the ICO’s website at Home.

There are some exemptions to the above rights that are permitted under the Data Protection Legislation. If you have any queries as to what these are then please get in touch.

Please note that if you choose to exercise your rights to have personal data restricted or deleted, then we may not be able to provide you with a full service.

We may need you to provide identification in order to comply with your request to exercise your rights. Once we have received your information request, and your identification, we will respond within the required timescales unless a permitted exemption applies.