Privacy policy

Main Privacy policy

This Privacy Policy (hereinafter referred to as the “Policy”) sets out the rules for the collection, processing and protection of personal data of Users (Customers and Recipients) of the online store available at: https://loueflowers.com (hereinafter referred to as the “Website”).

We respect your right to privacy and guarantee a high level of protection of your data in accordance with the applicable laws of the Republic of Poland and the European Union.

1. Personal Data Controller

1.1. The controller of your personal data (Administrator Danych Osobowych, hereinafter referred to as the “Controller”) is NR1 SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, a company registered under the laws of the Republic of Poland, NIP: 5243058315, REGON: 543463231, registered office: ul. Wolińska 4, 03-699 Warszawa.

1.2. For all matters concerning the protection of personal data, you may contact the Controller by email at [email protected] or by sending correspondence to the postal address indicated above.

1.3. Personal data is processed in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter referred to as the “GDPR” or “RODO”), as well as the Polish Act on Personal Data Protection.

2. What Data We Collect (Scope of Data)

When using the Website and placing and fulfilling Orders, we may process the following categories of data:

2.1. Customer Data:

first and last name;
contact telephone number;
email address;
delivery / billing address (where necessary);
order history and communications.

2.2. Recipient Data (if different from the Customer):

first and/or last name (or pseudonym);
contact telephone number;
exact delivery address;
username (profile link) on a social network (e.g. Instagram) — where the Customer does not know the Recipient’s address or telephone number and instructs the Controller to contact the Recipient through a social network.

2.3. Financial Data

We do not collect or store your bank card numbers. All online payments are securely processed directly by the Stripe payment gateway. We only receive information regarding the status of the transaction (successful/unsuccessful) and basic payment details necessary for accounting purposes.

3. Purposes and Legal Bases for Data Processing

We process your personal data only where there is a lawful basis for doing so. Your data is used for the following purposes:

3.1. Conclusion and performance of the contract:

accepting and processing Orders;
arranging delivery (independently or through a courier);
contacting the Customer/Recipient regarding the status of an Order or clarification of delivery details (including through social networks where this was provided for in the Order);
servicing the customer account (if the Customer has registered).

3.2. Compliance with legal obligations:

issuing invoices and maintaining accounting and tax records in accordance with the laws of the Republic of Poland;
handling and processing official complaints and returns.

3.3. Pursuing the legitimate interests of the Controller:

protection against potential claims and debt recovery;
responding to your enquiries and messages sent by email or through social networks;
analysing the quality of customer service (internal statistics).

4. Specific Processing of Recipient Data (Persons Receiving Flowers)

4.1. In most cases, the Controller receives Recipient data not directly from the Recipient, but from Customers who place an Order on their behalf (as a gift).

4.2. The Controller undertakes to use Recipient data exclusively for the purpose of properly delivering the Order and, where necessary, contacting the Recipient to clarify the delivery time/location (in accordance with Article 14 of the GDPR/RODO). Such data is not used for marketing purposes.

5. Disclosure of Data to Third Parties (Data Recipients)

To ensure a high quality of services and perform the contract, we may disclose your data to trusted partners (sub-processors). Data is disclosed only to the minimum extent necessary:

courier services and drivers — for the physical delivery of bouquets to the specified address;
payment systems (Stripe) — for processing transactions and authorising payments;
companies providing hosting and IT support services — to ensure the operation of the Website;
accounting and legal firms — for maintaining the company’s tax records;
social networks (e.g. Meta Platforms Ireland Limited) — when communicating with the Recipient via Instagram, the social network platform acts as an independent controller of certain data in accordance with its own policies.

Transfers outside the EEA: Since we use services provided by global companies (e.g. Stripe), your data may be transferred outside the European Economic Area (EEA). In such cases, we ensure that such transfers are carried out on the basis of Standard Contractual Clauses approved by the European Commission, providing an appropriate level of protection for your data.

6. Data Retention Period

We do not retain data for longer than necessary:

data related to the performance of the contract (Order): retained for the duration of the contract and, after its completion, until the expiry of the limitation periods applicable to civil claims (generally 3 years for businesses and 6 years for consumers);
data required for tax/accounting purposes: retained for 5 years from the end of the calendar year in which the tax payment deadline occurred (in accordance with Polish tax legislation);
customer account data: retained until the Customer deletes the account or withdraws consent to processing.

7. Your Rights (Data Subject Rights under GDPR/RODO)

Every User whose data we process has the following rights:

Right of access (Prawo dostępu): the right to know what personal data we process and to obtain a copy thereof.
Right to rectification (Prawo do sprostowania): the right to request correction of inaccurate data or completion of incomplete data.
Right to erasure / right to be forgotten (Prawo do bycia zapomnianym): the right to request complete deletion of data where it is no longer necessary for the purposes for which it was collected or where you have withdrawn your consent (and there are no other legal grounds for processing).
Right to restriction of processing (Prawo do ograniczenia przetwarzania).
Right to data portability (Prawo do przenoszenia danych).
Right to object (Prawo do sprzeciwu): the right to object to processing carried out on the basis of our legitimate interest (e.g. marketing).
Right to withdraw consent: where data is processed on the basis of consent, such consent may be withdrawn at any time (without affecting the lawfulness of processing carried out before the withdrawal).

To exercise these rights, please send your request to: [email protected].

If you believe that we have violated the rules governing the processing of personal data, you have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office of Poland (Prezes Urzędu Ochrony Danych Osobowych — PUODO), at: ul. Stawki 2, 00-193 Warszawa.

8. Cookies

8.1. Our Website uses cookies — small text files stored on your device.

8.2. We use technical (necessary) cookies to ensure the proper functioning of the Website (e.g. saving products in the shopping cart, processing payments and maintaining sessions). These cookies do not collect personal information and cannot be disabled in our systems.

8.3. At present, the Controller does not use third-party analytics or marketing cookies. If such tools are introduced in the future (e.g. Google Analytics or Facebook Pixel), the Website will request your prior voluntary consent (Cookie Banner) before placing them on your device.

9. Final Provisions

9.1. The Controller applies all necessary technical and organisational security measures (including SSL encryption) to protect personal data against unauthorised access, loss or alteration.

9.2. We reserve the right to amend this Policy in connection with changes in legislation or the development of the Website’s functionality. The current version is always available on this page.

30 September 2026