← Back to home

Privacy policy

1. Data controller

Cheng Lin Xuefen (trading as Floristería Cloris) — Tax ID (NIF): 51487445-J — Address: Calle San Germán, 66, 28020 Madrid, Spain — Email: contact@cloris.es.

2. Purposes and legal basis

  • Handling orders and enquiries (web form, email, WhatsApp and phone): confirming, preparing and delivering them, assisting you and emailing you the order summary and, if we change the delivery date, a notice with the new one. Legal basis: performance of the contract or pre-contractual steps (GDPR Art. 6.1.b).
  • Legal obligations (invoicing, tax): GDPR Art. 6.1.c.
  • Web analytics: we measure visits with our own table, which uses a pseudonymous identifier, and with Google Analytics 4, and only if you accept analytics cookies in the banner (consent, GDPR Art. 6.1.a and Art. 22.2 LSSI). Without your acceptance nothing is loaded or stored. You can withdraw consent at any time with “Cookie settings” at the bottom of every page; see the cookie policy and the “Site analytics” section for details.
  • Sending offers and news by email: only if you tick the optional box in the order; legal basis is your consent (GDPR Art. 6.1.a and Art. 21 LSSI). You can withdraw it at any time by writing to contact@cloris.es or through the unsubscribe link in each email.
  • Thank-you email after delivery, with a link to leave a review on Google: sent only once to the person who placed the order. Legal basis: our legitimate interest in hearing your opinion about an order you have just received (GDPR Art. 6.1.f); we offer nothing in return. You can object by replying to that email or writing to contact@cloris.es, and we will not send it to you again.

3. Retention

We keep data only as long as each purpose requires and, after that, for the periods required by law, blocked:

  • Orders (including the details of the person receiving the bouquet) and their invoicing: 6 years from the order, for commercial and tax obligations (Art. 30 of the Spanish Commercial Code).
  • Enquiries through the form, email or WhatsApp that do not lead to an order: 1 year.
  • Offers by email: until you withdraw your consent.
  • Website visits (our own table): 12 months. Google Analytics: the period set in the tool, 14 months at most.
  • Gift page: as stated in its own section.

4. Recipients

We do not sell your data or disclose it to third parties except where required by law. To provide the service we use the following providers and partners, which process data on our behalf as processors (GDPR Art. 28) under the safeguards of their data processing agreement, unless stated otherwise:

  • Supabase Inc. (USA): database of orders, admin panel accounts and gift-page files. The data is hosted in its London region (United Kingdom, a country with a European Commission adequacy decision). As the provider is based in the USA, access from there relies on the European Commission's standard contractual clauses included in its data processing agreement (supabase.com/legal/dpa).
  • Vercel Inc. (USA): hosting of the website running this shop; its server functions run in London (United Kingdom, a country with a European Commission adequacy decision). Transfers to the USA rely on the standard contractual clauses in its data processing agreement (vercel.com/legal/dpa).
  • Resend, Inc. (USA): sending the shop's emails. To the person who places the order: the order receipt (with the summary, the delivery or pickup date and address, and the amounts), the notice if we change the delivery date and the thank-you email with a review link and, if you order the gift page, the order thank-you email and the gift-page link. To the shop: the message you send through the contact form and an internal new-order notice without customer data. Transfer covered by standard contractual clauses (resend.com/legal/dpa).
  • WhatsApp Ireland Limited (Ireland, EU): the channel we use to confirm and handle orders and enquiries if you message us or we message you on WhatsApp. WhatsApp also processes that data as a controller under its own privacy policy (whatsapp.com/legal/privacy-policy-eea); its transfers to the USA rely on the EU-US Data Privacy Framework.
  • External couriers who make home deliveries: they receive only what is needed to deliver the bouquet (the name and phone number of the person receiving it, the address, the date and the time slot).
  • Google Ireland Ltd. (Ireland, EU): Google Analytics 4, only if you accept analytics cookies, and Google Maps Platform, to calculate the distance and delivery cost for your address and to show the shop map. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses (policies.google.com/privacy).
  • Cloudflare, Inc. (USA): DNS management for the domain and anti-spam check (Turnstile) on forms, which processes your IP and technical browser data (cloudflare.com/privacypolicy).
  • Hostinger International Ltd. (Cyprus, EU): the contact@cloris.es mailbox (hostinger.com/legal).
  • GoDaddy (USA): registrar of the cloris.es domain; it does not process the shop's customer data.

We may also disclose data to public authorities where required by law (for example, the tax agency).

5. Rights

You may exercise access, rectification, erasure, objection, restriction and portability by writing to contact@cloris.es, proving your identity. You may complain to the Spanish Data Protection Agency (www.aepd.es).

6. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration.

If you receive a bouquet from Cloris

If someone sends you a bouquet, that person has given us your name, the delivery address and your phone number, and perhaps a message for you. We use them only to deliver the order and to contact you if needed (for example, if you are not in). Legal basis: our legitimate interest, and that of the sender, in getting the gift to you (GDPR Art. 6.1.f).

The courier making the delivery sees them, and they are kept with the order for the period stated in the retention section. You have the same rights explained in this policy: write to contact@cloris.es.

Digital gift page (digital pack)

If you order the gift page, we process the photos and texts you upload, and the image of the people who appear in them, to create your page and show it to anyone with the link or QR code. Legal basis: the contract with you (GDPR Art. 6.1.b) and, for the people appearing in the photos, our legitimate interest in providing the service you ask for (Art. 6.1.f), with these safeguards: a private page that search engines do not index, photos reachable only through temporary links, review before printing and automatic deletion. You are responsible for having their permission.

Retention: 90 days from the page's creation; after that we delete photos and texts within 30 days at most (in practice, in the next daily run of the automatic deletion). If the order is deleted, its photos are deleted too. Backups kept by the database provider are overwritten in its normal rotation cycle. We count how many times the page is opened, without recording who opens it.

Providers involved: Supabase (database and files), Vercel (web server) and Resend (sending the email with the link). Anyone appearing on a page can ask us to remove it using the “Report content” link on the page itself or by writing to contact@cloris.es.

Instagram

Cloris has an Instagram profile (@cloris.flowers). If you follow it, comment or message us there, we process that data to reply to you and to publish our content. Legal basis: our legitimate interest in communicating with people interested in the shop (GDPR Art. 6.1.f).

Instagram (Meta Platforms Ireland Ltd.) gives us aggregated statistics about the profile. For those we are joint controllers with Meta (CJEU judgment C-210/16) under Meta's addendum (facebook.com/legal/terms/page_controller_addendum); you can also exercise your rights over that data with Meta. Everything else Instagram does with your data is governed by its own privacy policy.

Site analytics

We record visits to the website in an internal table hosted on Supabase. We store only: the visited path, a random identifier kept in your browser, the referrer origin (no full URL) and the date and time. We do not store your IP or user agent. That identifier does not reveal who you are, but it tells your browser apart from others: it is pseudonymous data, not anonymous. This data is used to understand which pages are useful and is kept for a maximum of 12 months.