Privacy policy

1. Data controller

The personal-data controller is ATELIER VIVAFLOR S.R.L., CUI 45642590, Trade Register J12/778/2022 (EUID ROONRC.J12/778/2022), which operates the Cluj Flowers shop (clujflowers.com). Registered office: Str. Oltului nr. 38, bl. U1, sc. 2, et. 2, ap. 16, Cluj-Napoca, Cluj county, 400600, Romania. Working point: Aleea Padin nr. 25, Cluj-Napoca, 400565, Romania.

Data-protection contact: [email protected], phone +40 755 198 827.

2. Data we process

For an order we process: name, email, phone, delivery and billing address, order contents, card message, delivery date and window, and the data needed for payment.

If the recipient is someone else, we process their name, phone, and address so we can deliver.

If you create an account we process sign-in data. We do not store the full card number.

3. Purpose and legal basis

We process data to fulfil the order (contract), issue tax documents (legal duty), prevent payment fraud (legitimate interest), and answer your messages.

We do not use your data for email advertising without consent. We do not sell data to third parties for marketing.

4. Recipients and processors

Stripe — card payments (Stripe Payments Europe Limited / the Stripe group). Payment data goes to Stripe; we do not store the full card number.

Resend — transactional email (order confirmation and updates).

The shop’s hosting provider — the infrastructure that runs clujflowers.com and the database.

Umami — aggregate traffic statistics (pages viewed, cart and checkout steps), self-hosted by us, cookieless and without personal data: we do not collect names, emails, phone numbers or addresses, and IP addresses are not stored. That is why there is no cookie banner.

Public authorities where the law requires it. Couriers or team members who deliver the order, limited to the data needed for delivery.

5. Retention

We keep order and billing data for as long as Romanian accounting and tax law requires. Account data is kept while the account is active and for a reasonable period after closure, unless the law requires otherwise.

6. Your rights

You have the rights of access, rectification, erasure, restriction, objection, and portability under Regulation (EU) 2016/679 (GDPR).

Write to [email protected]. You may also complain to the Romanian data-protection authority (ANSPDCP), dataprotection.ro.