Privacy policy
PRIVACY POLICY
1. Data controller
The controller of personal data is:
Flower Shop Barcelona S.L.
Tax identification number (NIF): B22944862
Address: Carrer del Cabanyal 1, Local, 08018 Barcelona, Spain
Email: Flowershop.barcelona@gmail.com
Telephone: +34 603 68 29 69
This Policy explains how we process personal data when a person visits https://www.flowershopbarcelona.com, makes a purchase, creates an account, contacts us, receives an order as a recipient or interacts with our stores and services.
2. Personal data we may process
Depending on the interaction, we may process:
2.1. Identification and contact details
Name, surname, email, telephone, billing address, delivery address, company, tax or invoicing details where needed.
2.2. Gift-recipient information
Name, address, telephone, company, hotel, hospital, office, access information and other details needed to deliver the order.
Purchasers supplying recipient data should provide only what is necessary and ensure they have a legitimate reason to share it.
2.3. Order and commercial-relationship information
Products viewed or purchased, amount, date, delivery or collection, instructions, card messages, incidents, returns, refunds, communications and order preferences.
2.4. Payment information
Payment method, status, amount, transaction identifiers and information needed for fraud prevention and reconciliation. Complete card details are normally processed by Shopify Payments or other payment providers and are not fully accessible to Flower Shop Barcelona.
2.5. Account information
Encrypted or platform-managed credentials, history, saved addresses, preferences and settings where customer accounts are used.
2.6. Communications and support
Emails, forms, calls, messages, complaints, photographs supplied for an incident and other information voluntarily provided.
2.7. Technical and usage data
IP address, device or browser identifiers, language, approximate area, pages viewed, interactions, referral source, cart, session and security logs.
2.8. Marketing data and preferences
Consents, subscriptions, communication openings or interactions, product and advertising preferences where these functions are enabled and legally applicable.
2.9. Reviews and public content
Displayed name, rating, text, photograph or video submitted for a review where the user chooses to publish it.
We do not request special-category data. Please do not include health, religious or other sensitive information in cards, instructions or communications unless strictly necessary and supported by an appropriate legal basis.
3. Sources of data
We may obtain data:
directly from the customer or user;
from a purchaser providing recipient details;
automatically through Shopify, cookies and similar technologies;
from payment, delivery, fraud-prevention, customer-service, review or marketing providers;
from social networks where the user interacts with our profile or integration;
from public sources or business partners only where there is a lawful basis.
4. Purposes and legal bases
| Purpose | Data used | Main legal basis |
|---|---|---|
| Process, charge, prepare and deliver orders | Identification, contact, order, payment, recipient | Performance of the contract with the purchaser |
| Deliver a gift to someone other than the purchaser | Minimum recipient details | Legitimate interest in fulfilling the requested order and, where applicable, steps connected with the contract |
| Manage collection, amendments, returns, refunds and complaints | Order, communications, photographs, payment | Contract performance and legal obligations |
| Issue invoices and retain records | Identification, billing, transaction | Legal obligation |
| Customer service | Contact, communications, order | Contract, pre-contract steps and legitimate interest in answering enquiries |
| Security, fraud prevention and store protection | Technical, account, payment, activity | Legitimate interest and, where relevant, legal obligation |
| Create and manage accounts | Identification, contact, credentials, history | Performance of the requested service |
| Send requested marketing | Contact and preferences | Consent |
| Send information about similar products to existing customers where permitted | Contact and basic history | Legitimate interest, with simple and free objection |
| Non-essential analytics, personalisation and cookie-based advertising | Technical and usage | Consent through cookie settings |
| Publish reviews or photographs | Content and displayed name | Consent and/or performance of the publication request |
| Defend claims and comply with authorities | Relevant information | Legal obligation and legitimate interest in defending rights |
Where legitimate interest is used, we consider necessity, impact and reasonable expectations. Individuals may object where provided by law.
5. Required information
Required fields enable payment, preparation, documentation and delivery. If essential information is not supplied, we may be unable to accept or fulfil the order.
Optional data is identified where appropriate. Marketing and non-essential cookies are not required to buy.
6. Recipients of personal data
We may disclose or permit access, where necessary, to:
Shopify, which hosts and provides the commerce platform;
payment providers and financial institutions;
external delivery providers receiving the details needed to deliver;
hosting, technical support, security, backup and fraud-prevention providers;
email, messaging, customer-service, review, translation or order-management providers;
analytics, advertising or social-media providers only according to cookie choices and the applicable legal basis;
professional advisers, insurers, auditors and administrative providers;
public authorities, courts and law-enforcement bodies where legally required;
prospective purchasers and advisers in a corporate restructuring, merger or transfer with appropriate safeguards.
We do not sell customer personal data to third parties for money.
Processors acting for Flower Shop Barcelona must comply with our instructions, contract and applicable law. Some providers may act as independent controllers for particular functions, especially payments, social networks or their own services.
7. Shopify
The store uses Shopify. Shopify processes data to provide the platform, host the store and deliver payment, security, analytics and other enabled services.
Shopify’s Consumer Privacy Policy is available at:
Shopify privacy controls and requests are available at:
For some activities Shopify acts as Flower Shop Barcelona’s processor; for others, it may act as an independent controller under its own policies.
8. Delivery providers and recipient data
To make a delivery, we share only reasonably necessary data with the selected provider, such as name, address, telephone, window and access instructions.
Providers must not use those details for purposes incompatible with delivery unless a legal obligation or their independent-controller status permits it.
A person receiving flowers without placing the order may contact us to ask how their data was obtained and exercise rights. We will not use recipient details for marketing merely because they received a gift.
9. International transfers
Shopify and some providers may process data outside the European Economic Area.
Where an international transfer occurs, a recognised mechanism will be used, such as:
a European Commission adequacy decision;
European Commission standard contractual clauses;
binding corporate rules;
another valid safeguard or statutory exception.
Shopify’s information on transfers and privacy is available through the policies above. Contact us for information about safeguards used by other providers.
10. Retention
We keep data only for as long as needed for the relevant purpose and to comply with legal obligations or defend claims.
In general:
order, invoicing and accounting records are retained for statutory commercial and tax periods;
account data is kept while the account remains active and afterwards as needed for obligations or claims;
enquiries and incidents are retained until resolution and during applicable liability periods;
marketing data is kept until withdrawal or objection, without prejudice to a minimal suppression record;
cookie choices are retained for the period stated in the Cookie Policy;
consent evidence is retained as needed to demonstrate compliance.
When no longer needed, data is deleted, anonymised or blocked as required by law.
11. Marketing communications
We send marketing by email, SMS or other channels only where there is a valid legal basis.
Consent may be withdrawn or marketing stopped at any time through the link in the communication or by emailing Flowershop.barcelona@gmail.com.
Withdrawal does not affect necessary messages about orders, payments, deliveries, security or support.
12. Cookies and similar technologies
The website uses cookies and similar technologies. Strictly necessary cookies enable requested functions such as cart, security, login and payment.
Non-essential analytics, personalisation or advertising cookies are used according to the choice made in the banner or preference panel.
Full information:
Preferences can be changed at any time through the “Cookie preferences” link in the footer or Shopify-enabled panel.
13. Automated decisions
Payment, security or fraud-prevention providers may use automated systems to identify risky transactions. These may recommend blocking or reviewing a payment.
Flower Shop Barcelona does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects unless necessary for the contract, authorised by law or based on explicit consent, with the required safeguards.
14. Children
The store is not specifically directed to children under 14 and we do not knowingly collect their data without legally required authorisation.
Purchases must be made by people aged 18 or over. A parent or guardian who believes a child supplied data improperly may request review or deletion.
15. Security
We apply reasonable technical and organisational measures against unauthorised access, loss, alteration or disclosure.
No system is completely infallible. Users should protect passwords, avoid reuse and not send sensitive data over insecure channels.
16. Individual rights
Where provided by law, individuals may request:
access;
rectification;
erasure;
restriction;
objection, including to direct marketing;
portability;
withdrawal of consent at any time;
protection from certain solely automated decisions.
To exercise rights, email Flowershop.barcelona@gmail.com with “Data protection” in the subject and describe the request. We may request reasonable information to verify identity.
Exercise is free except for manifestly unfounded or excessive requests as permitted by law.
For data Shopify processes as an independent controller, **https://privacy.shopify.com/es-ES** may also be used.
17. Supervisory complaint
Individuals who believe processing breaches data-protection law may complain to the Spanish Data Protection Agency:
We recommend contacting Flower Shop Barcelona first so we can try to resolve the issue.
18. Third-party links and services
The website may link to social networks, maps or other services. When leaving our store or using an external integration, the third party’s policies may apply. Users should review them.
19. Policy changes
We may update this Policy for legal, technical or service changes. The updated version and date will be published. Where a change is material, notice will be given as legally required.
20. Contact
Controller: Flower Shop Barcelona S.L.
NIF: B22944862
Address: Carrer del Cabanyal 1, Local, 08018 Barcelona, Spain
Email: Flowershop.barcelona@gmail.com
Telephone: +34 603 68 29 69