Privacy policy

This English version is provided for information. In case of any discrepancy, the Romanian version prevails.

Protecting your data is important to us. Below you'll find, in plain words, what data we collect when you visit botanic-fs.ro or order from us, why we use it, who we pass it to and what rights you have. We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian law.

Who processes the data

The data controller is Botanic Floral Studio; the company details (name, tax ID, registered office) are shown on the Contact page. For any question about your data you can write to us at [email protected] or call us on 0735 782 818.

What data we collect

When you order we ask for your name, e-mail address, phone number and delivery address, and for personal pick-up only your contact details. If you send flowers to someone else, we also receive from you the recipient's name, address and phone number. We also keep the content of the order, the delivery day and time slot, the card messages, your notes and the payment method. For a company invoice we also use the company details (name, tax ID, registration number, registered office), which we may fill in automatically from the public ANAF database.

If you create an account, we keep your e-mail address, name and password – the latter only in encrypted, irreversible form. If you sign in with your Google account, we receive from Google your name, e-mail address and an account identifier; your Google password never reaches us. In your account you can save addresses and billing details, and if you write a review, it appears on the site with your first name and the initial of your surname.

For the newsletter we keep your e-mail address, the date you subscribed and the text of the consent you gave. For security reasons, your IP address is used temporarily to limit abuse (for example, too many sign-in attempts or form submissions).

Why we use the data and on what legal basis

We use the data primarily to prepare, deliver and confirm your order, to send you the e-mails related to it and to manage your account – the legal basis is the performance of the contract (art. 6 (1) (b) GDPR). We keep invoices and accounting records because the law requires us to (art. 6 (1) (c)).

We send the newsletter only if you have subscribed and confirmed the subscription by e-mail; you can withdraw your consent at any time, with one click on the unsubscribe link in any newsletter (art. 6 (1) (a)). The security of the site, fraud prevention and the internal notification of the team about new orders are based on our legitimate interest in operating safely and delivering on time (art. 6 (1) (f)).

If you have an account and leave products in your cart without placing the order, a few hours later we may send you a single reminder e-mail with the products left (at most one a week). The legal basis is our legitimate interest in reminding you of an order you started (art. 6 (1) (f)); you can object at any time, with one click on the link in the e-mail or on the “My details” page. For this we keep the contents of your cart in your account – that way you also find it on another device.

If you asked us on the “Coming soon” page to let you know when we open, we use your name and e-mail address only for that single announcement e-mail. The legal basis is your consent (art. 6 (1) (a)); we don't add you to the newsletter, and you can withdraw your consent at any time by writing to us.

When your bouquet is ready, we may photograph it and send you the photo by e-mail, so you can see what is on its way to the recipient. We only photograph the bouquet, not people or addresses. Only you (in the e-mail and on the order page) and the flower shop team can see the photo, and we delete it automatically after 60 days.

We don't take automated decisions with legal effects concerning you and we don't create marketing profiles about you.

Who we pass the data to

We don't sell or rent data to anyone. We pass it only to the partners without whom the shop couldn't work, and only to the extent necessary. The server the shop runs on is located in Romania. Traffic to the site passes through the Cloudflare network, which protects it against attacks. E-mails are sent through the Migadu service, from Switzerland.

We notify the flower shop team about new orders through an internal Telegram group, with the details needed for preparation and delivery. If you pay by card, the payment takes place directly on the secure NETOPIA Payments page: you enter your card details there and they never reach us. The NETOPIA logo in the footer of the page is loaded from the NETOPIA Payments server, so your browser's IP address also reaches them. If you choose to sign in with Google, Google learns that you have signed in to our shop. Backup copies of the database are encrypted before being stored on Google Drive, so Google can't read them.

The person delivering the bouquet receives the delivery details. Our accountant uses the billing details and, when the law requires it, the authorities (for example ANAF). The site is technically administered by its developer (bedev.ro), who has access to the server only for maintenance.

Transfers outside the European Union

Some partners also process data outside the European Economic Area. Switzerland (Migadu) has an adequacy decision of the European Commission. Cloudflare and Google are certified under the EU–US Data Privacy Framework and use the standard contractual clauses approved by the Commission. Telegram also operates servers outside the EU; that's why we pass it only the data strictly necessary for preparing and delivering the order.

How long we keep the data

We keep orders and invoices for as long as financial and accounting law requires (generally 10 years). Your account remains active until you ask for it to be deleted; orders already placed remain in the accounting records. The newsletter subscription lasts until you unsubscribe, and unconfirmed subscriptions are deleted after 7 days. We delete the name and address left on the “Coming soon” page after we have told you about the opening.

We record the e-mails sent in a log for 30 days, and we delete their content immediately after sending. Password reset links expire after 60 minutes. Backup copies are kept for 14 days on the server and for 30 days in encrypted form. We delete the notifications in the internal Telegram group after the order has been completed.

Cookies

We only use strictly necessary cookies: a session cookie for the cart, sign-in and form protection (at most 30 days), one for the language you chose (1 year) and one that remembers your choice about cookies (180 days). Cloudflare may set technical cookies for protection against bots. We don't use analytics or advertising cookies.

How we protect the data

All communication with the site is encrypted (HTTPS). Not even we can see passwords, card details never reach us, and only the people who need the order data to do their job have access to it.

Your rights

You have the right to find out what data we hold about you and to receive a copy of it, to correct it, to ask for it to be deleted or for its processing to be restricted, to object to processing based on legitimate interest, to receive the data in a portable format and to withdraw any consent you have given at any time. For all of these, write to us at [email protected] – we reply within one month at the latest. You can also change the data in your account yourself, and you can delete your account on the “My details” page.

If you believe we have not complied with the law, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (www.dataprotection.ro).

Minors

The shop is intended for people over 16. We do not knowingly collect data about children under this age.

Changes

We may update this policy when the way we work with data changes; the version in force is always the one on this page.

Last updated: 19 October 2026.