Privacy Policy and Information Notice
Churchtown Farm | Effective 24 April 2026
1. Who We Are
Churchtown Farm trading as Scilly Flowers is a partnership and is based at the following address:
Churchtown Farm, St Martin's, Isles of Scilly, TR25 0QL
For all data protection enquiries, please contact Ben Julian, Partner, at the address above or via email at [email protected].
2. About This Policy
This policy explains how Churchtown Farm collects, uses, and protects your personal data when you visit our website, place an order, or otherwise interact with us.
We may update this policy from time to time. The current version will always be available on this page, with the effective date shown above.
3. What Personal Data We Collect
We may collect and process the following types of personal data:
Personal details, such as your name
Contact information, including postal address, email address, and telephone number
Payment information necessary to process your order (we do not store full card details)
Order information, including delivery address and purchase history
Information about how you use our website, collected via cookies and similar technologies
Information you provide when contacting us, completing a survey, or entering a competition
4. Who We Process Data About
We process personal data relating to:
Customers and website visitors
Prospective customers and enquirers
Suppliers and business contacts
Survey respondents and competition entrants
Complainants and service reviews
5. How and Why We Process Your Data
UK GDPR requires us to have a lawful basis for each type of personal data processing we carry out. The table below sets out our main processing activities and the lawful basis for each.
Purpose
Processing and fulfilling your orders. Lawful Basis - Performance of a contract (Article 6(1)(b))
Maintaining financial and accounting records. Lawful Basis - Legal obligation (Article 6(1)(c))
Sending you marketing communications. Lawful Basis - Consent and legitimate interest (Articles 6(1)(a&f))
Improving our website and services. Lawful Basis - Legitimate interests (Article 6(1)(f))
Detecting and preventing fraud. Lawful Basis - Legitimate interests (Article 6(1)(f))
Understanding how our website is used. Lawful Basis - Legitimate interests (Article 6(1)(f))
Conducting market research. Lawful Basis - Legitimate interests (Article 6(1)(f))
Measuring the effectiveness of advertising campaigns. Lawful Basis - Legitimate interests (Article 6(1)(f))
Where we rely on legitimate interests as our lawful basis, we have assessed the impact on your rights and concluded that our processing does not override them. You have the right to object to processing on this basis: see Section 8.
Where we send you marketing communications. You may withdraw that consent at any time by clicking the unsubscribe link in any marketing email or by contacting us directly.
6. Who We Share Your Data With
We do not sell your personal data. We may share it with the following categories of third parties where necessary to deliver our services or meet our legal obligations:
Delivery and fulfilment partners – to despatch your orders to you
Payment processors – to handle transactions securely on our behalf
Email and CRM platforms – to manage customer communications
Google – we use Google Ads and Google Analytics. Data may be shared with Google for advertising measurement, remarketing, and website analytics. Google's privacy policy is available at business.safety.google/privacy/.
Microsoft – we use Microsoft Advertising to run paid search campaigns. Data may be shared with Microsoft for advertising measurement and remarketing purposes. Microsoft's privacy policy is available at privacy.microsoft.com.
Usercentrics – we use Usercentrics as our Cookie Management Platform to record and manage your cookie preferences. Usercentrics' privacy policy is available at usercentrics.com.
Regulatory authorities – including HMRC and the ICO, where required by law
All third parties acting as data processors are contractually required to process your data only in accordance with our instructions and applicable data protection law.
Some third parties may be based outside the UK. Where this is the case, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO, to protect your data to an equivalent standard.
7. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.
Type of Data
Order and customer records. Retention Period - 7 years, in line with HMRC requirements
Financial records. Retention Period - 7 years, in line with HMRC requirements
Marketing data. Retention Period - Until you withdraw consent or unsubscribe
Website analytics data. Retention Period - In accordance with platform settings (typically up to 26 months)
Supplier records. Retention Period - Duration of relationship plus a reasonable period thereafter
Enquiries and complaints. Retention Period - Up to 3 years after resolution
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of access – you may request a copy of the personal data we hold about you
Right to rectification – you may ask us to correct data that is inaccurate or incomplete
Right to erasure – in certain circumstances, you may ask us to delete your personal data
Right to restriction – you may ask us to limit how we process your data in certain circumstances
Right to data portability – you may request your data in a structured, commonly used, machine-readable format
Right to object – you may object to processing based on legitimate interests or carried out for direct marketing purposes
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, please contact Ben Julian, Partner, at [email protected]. We will respond within one calendar month of receiving your request.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113, if you believe we have not handled your personal data in accordance with the law.
9. Cookies
What Are Cookies?
Cookies are small text files stored on your device when you visit a website. They allow the site to recognise your device and remember information about your visit, such as your preferences and the items in your basket.
Under UK law (the Privacy and Electronic Communications Regulations, or PECR), strictly necessary cookies may be set without your consent. All other cookies require your permission before they are placed on your device.
How We Manage Consent
We use Usercentrics as our Cookie Management Platform. When you first visit our website, you will be presented with a cookie preference panel allowing you to accept or decline each category of cookie. You can change or withdraw your preferences at any time by clicking the Privacy Trigger icon (the green and white tick icon at the bottom right of our website).
Our Cookie Categories
Essential Cookies – these cookies are required for our website to function correctly. For example, they remember what you have added to your basket. These cookies cannot be disabled.
Functional Cookies – these cookies help us analyse how visitors use our website, including which pages are visited most frequently and how users navigate the site. We use this information to improve our website and tailor it to customer needs. The data collected is used for statistical analysis purposes only.
Marketing Cookies – these cookies are set by advertising platforms we use, including Google, Microsoft, and social media networks. They allow us to show you relevant advertising on those platforms and to measure the effectiveness of our campaigns.
10. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or the law. Any changes will be published on this page with an updated effective date. We encourage you to check this page periodically.