Privacy policy

1. Controller and contact

The controller is Agafin Agnieszka Finlayson (Rosalia Blooms), NIP 6462709730, ul. Kazimierza Morawskiego 5 lok. 127, 30-102 Kraków, Polska. For privacy questions, rights requests or account deletion, contact [email protected] or the postal address above. Telephone: +48 667 758 795.

2. Data we receive

We process details entered when buying, creating an account or contacting us: name, email, telephone, delivery and billing addresses, invoice details, products ordered, card messages, gift-recipient details, and payment and order-service history. We do not receive your full payment-card number or security code; you provide those to the payment provider.

The buyer supplies a flower or gift-card recipient's name, telephone, postal or email address and gift message. We use these to deliver and service that order, not to subscribe the recipient to a newsletter. We ask the buyer to share this notice with the recipient.

We also receive technical data needed to operate and protect the shop, such as IP address, browser information, security events and session identifiers. Analytics or advertising data is processed according to the choices explained in our cookie policy.

3. Purposes and legal bases

• Taking and fulfilling orders, accounts, payments and purchase-related contact: Article 6(1)(b) GDPR.
• Accounting records, tax and statutory complaint obligations: Article 6(1)(c) GDPR.
• Delivering a gift to the person named by the buyer, security, fraud prevention, handling enquiries and pursuing or defending claims: Article 6(1)(f) GDPR. Our interests are fulfilling orders correctly, operating securely and protecting rights.
• Newsletters and optional measurement or advertising requiring consent: Article 6(1)(a) GDPR and applicable electronic-communications rules.

The information needed for an order is necessary to fulfil it; without delivery and contact details we cannot deliver the chosen product. Marketing consent is optional and is not a condition of purchase. Withdraw consent at any time without affecting earlier lawful processing.

4. Recipients

People working for Rosalia Blooms and our hosting, infrastructure, technical support, accounting and delivery providers receive access only as needed. Stripe handles payments, Twilio SendGrid handles email, and Cloudflare provides file storage and delivery. The payment provider may also act as an independent controller for its own legal and payment-security duties. We disclose data to public authorities where the law requires it.

International providers may process data outside the European Economic Area. Transfers then rely on an applicable European Commission adequacy decision or standard contractual clauses and the required safeguards. Ask us for information about a particular transfer and a copy of the safeguards used.

We do not sell buyers' or gift recipients' personal data.

5. Retention

• Orders and invoices: for the period required by tax and accounting law, generally five years from the end of the year in which the tax payment deadline falls; relevant data may be needed longer until a dispute ends or a claim limitation period expires.
• Accounts: while maintained, then only as needed for mandatory records, settlement or protecting claims.
• Correspondence and complaints: until the matter is resolved, then for the relevant claim limitation period, usually three or six years depending on the claim.
• Newsletter: until consent is withdrawn or mailing ends. We retain evidence of consent and suppression information as necessary to demonstrate compliance and honour unsubscribe requests.
• Security and expired authentication data: as needed to protect the service and investigate incidents. Active sessions end at expiry or sign-out; deleting an account does not delete order records required by law.

6. Your rights

You can request access, a copy, correction, erasure or restriction and, where applicable, portability. You may object to processing based on legitimate interests; you can always object to direct marketing.

Write to [email protected]. We may request the information necessary to verify your identity safely, without asking for excessive data. We normally respond within one month under the GDPR. You can complain to the President of the Polish Personal Data Protection Office: uodo.gov.pl.

We do not make solely automated decisions producing legal or similarly significant effects on you. Technical payment and security checks do not change your statutory rights.