Privacy policy

Data controller

This Privacy Policy explains how we collect, use, share and protect your personal data when you visit etraflora.com, create an account or place an order, in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

The data controller responsible for your personal data is [Company legal name — to be provided], registered at [Registered address], EU VAT [EU VAT number]. You can contact us about privacy and data protection at [contact@etraflora.com]. Our data protection contact is [DPO contact].

What data we collect

Account data: the name, email address and password you provide when you register, plus any phone number, billing or company details you add to your profile.

Order and delivery data: the products you buy, order history, delivery and billing addresses, the recipient name and contact details, and any notes you add for the courier.

Payment data: payments are processed by Stripe. We receive confirmation of payment and limited transaction details (such as the last four digits and card brand). We never see or store your full card number — card data is handled directly by Stripe as a payment processor.

Communications: messages you send us through support forms or email, and your marketing preferences.

Cookies and technical data: device, browser and usage information collected through cookies and similar technologies, as described in our Cookie Policy.

Consent records: to demonstrate compliance, we keep an append-only log of the consents you give or withdraw (for example accepting the terms or opting into marketing), including the exact wording shown, its version, the date and time, your IP address, your browser user-agent and the page URL.

Why we use your data and our lawful bases

Performance of a contract (Art. 6(1)(b) GDPR): to create and manage your account, process and deliver your orders, take payment, handle returns and refunds, and provide customer support.

Legal obligation (Art. 6(1)(c) GDPR): to keep invoicing, accounting and tax records and to meet EU consumer-protection and food-safety requirements.

Consent (Art. 6(1)(a) GDPR and the ePrivacy Directive 2002/58/EC): to send you marketing emails or push notifications, and to set non-essential cookies (such as analytics). You can withdraw consent at any time, without affecting processing carried out before withdrawal.

Legitimate interests (Art. 6(1)(f) GDPR): to secure the shop and prevent fraud and abuse, to keep records that demonstrate compliance, and to understand and improve our services. Where we rely on legitimate interests, we balance them against your rights and you can object at any time.

Who we share data with

We do not sell your personal data. We share it only with processors and partners that help us run the shop, under written data-processing agreements that require them to protect it and use it only on our instructions.

Stripe — payment processing and fraud prevention.

Our delivery courier(s) — [Courier / carrier — to be provided], to ship and track your chilled parcel.

Our email and messaging provider — [Email service provider — to be provided], to send order confirmations and, with your consent, marketing messages.

Our hosting and infrastructure providers, and professional advisers, where strictly necessary.

We may also disclose data where required by law or to establish, exercise or defend legal claims.

International transfers

We aim to keep your personal data within the European Union / European Economic Area. Where a processor (for example Stripe) transfers data outside the EU/EEA, we ensure an adequate level of protection through an EU adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. You can request a copy of the relevant safeguards by contacting us at [contact@etraflora.com].

How long we keep your data

Account data: for as long as your account is active, and then deleted or anonymised after a reasonable inactivity period unless we must keep it longer.

Order, invoicing and accounting records: retained for the period required by EU and national tax and accounting law (typically up to 10 years).

Marketing consent and contact data: until you withdraw consent or unsubscribe, after which we stop using it for marketing.

Consent log records: kept for as long as needed to evidence compliance and to defend potential legal claims.

When data is no longer needed for these purposes, we securely delete or anonymise it.

Your rights

Under the GDPR you have the right to access your data, to have inaccurate data rectified, to have your data erased ("right to be forgotten"), to restrict or object to processing, to data portability (receive your data in a structured, machine-readable format), and to withdraw any consent you have given at any time.

You can manage much of this yourself in your account: visit the /account area to view and update your details, export a copy of your data and request deletion of your account.

To exercise any right or ask a question, contact us at [contact@etraflora.com] or [DPO contact]. We respond within one month, as required by the GDPR.

Complaints

If you believe we have not handled your personal data lawfully, we would like the chance to put it right — please contact us first. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. Our lead supervisory authority is [Lead supervisory authority — to be provided].

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified on this page, and where appropriate by email. Please check the date below for the latest version.