Privacy Policy

1. Who is responsible for your information?

The data controller is Wineflowers, VAT IT03698480757, Via Toniolo 2 – fraz. Felline, 73040 Alliste (LE), Italy.

For privacy enquiries: privacy.office@wineflowers.com. For orders and assistance: info@eflowersdelivery.com.

2. Information used to handle an order

Order details include the chosen product and options, price, requested delivery date, card message and notes to the shop. We also use the sender’s name, email and telephone number, and the recipient’s name, telephone number and delivery address. Please provide only information needed to arrange the gift and avoid including sensitive or unnecessary personal details in free-text fields.

When you give us another person’s details as the gift recipient, those details are used to organise delivery and related assistance. Please ensure you are entitled to provide them.

3. Purposes and legal bases

The website does not currently collect consent for newsletters or promotional communications and does not use customer contact details for these purposes.

• Orders and customer assistance: handling your purchase and enquiries, based on steps you request before a contract and performance of the contract.
• Recipient information: arranging and completing the requested gift delivery, based on the legitimate interests in providing that service, subject to the recipient’s rights.
• Accounting and other mandatory records: compliance with applicable legal obligations.
• Security and payment verification: protecting the service, investigating errors and preventing fraud, based on legitimate interests or applicable legal requirements.
• Optional tracking: see our Cookie Policy for information about cookies and consent.

4. Payments

Payment details are entered with Stripe or PayPal on the provider’s payment pages. Our order system records the order reference, payment amount, status and provider transaction identifiers used to verify the payment. The integration does not ask you to send card security codes or full card details to our customer support team.

See Stripe’s privacy information and PayPal’s privacy information for their processing. Payment confirmation emails and order references are used to handle your purchase.

5. Who may receive information?

Information needed to provide the service may be shared with the florist or gift supplier handling the order, delivery or courier services, payment providers, hosting and email services, technical support providers and professional advisers. Authorities may receive information where required by law. The relevant processing roles depend on the service and contractual arrangements.

The website uses Aruba for hosting, database and email services, Google Analytics for website usage statistics, CookieScript for the cookie consent interface, and Tawk.to for chat assistance. These services may process information according to their functions and configuration. Payment processing is provided by Stripe and PayPal as described above.

Depending on the service and applicable terms, providers may process information on our behalf or act as independent controllers for their own processing purposes. Payment providers process information under their own privacy terms. Information about the recipients relevant to your request is available by contacting our privacy address.

6. Browsing, cookies and support tools

Technical logs may contain information such as an IP address, request time, browser information and pages requested. Session data help maintain an order as you move between steps. Other services may involve cookies or similar technologies. Read our Cookie Policy for information about those tools and your choices.

7. Retention

Transaction records and accounting documents are retained for 11 years.

Information is kept for the time needed for the purpose for which it is used, taking into account applicable legal requirements and the handling of disputes or claims. Different rules apply to order records, accounting documents, support enquiries, security logs and optional cookie preferences.

• Support enquiries and correspondence: retained for 6 months from receipt. Correspondence forming part of transaction or accounting records follows the 11-year retention period stated above.
• Technical and security logs: retained for 6 months.

8. International transfers

Some of the third-party services used by this website involve processing personal information outside the European Economic Area (EEA), including in the United States. The destination and transfer mechanism depend on the provider, service and applicable terms.

• Google Analytics: Google describes reliance on the EU–U.S. Data Privacy Framework for covered transfers to the United States and on standard contractual clauses in other applicable circumstances. See Google’s international transfer information.
• Tawk.to: the provider states that processing takes place in the United States and describes reliance on the Data Privacy Framework and contractual or other approved mechanisms. See Tawk.to’s Privacy Policy.
• Stripe: Stripe describes the Data Privacy Framework and standard contractual clauses among its transfer mechanisms, depending on the circumstances. See Stripe’s Privacy Center.
• CookieScript: its policy provides for international transfers using mechanisms such as adequacy decisions and standard contractual clauses, where applicable. See CookieScript’s Privacy Policy.
• PayPal: payment information is processed under PayPal’s own privacy terms. Information about its processing and international arrangements is available in PayPal’s Privacy Statement.

Where applicable, an adequacy decision covers transfers to an approved destination or an eligible certified recipient. Standard contractual clauses provide contractual safeguards for other covered transfers. The availability of these mechanisms does not mean that every provider or transfer is automatically covered.

For information about transfers relevant to your personal information and the applicable safeguards, or to request a copy of those safeguards subject to appropriate redactions, contact privacy.office@wineflowers.com.

9. Your rights

Subject to the conditions of data protection law, you may request access, correction, erasure, restriction, portability or object to relevant processing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Some records must be retained to meet legal obligations or protect legal claims.

Send requests to privacy.office@wineflowers.com. We may ask for proportionate information to verify identity. You may also complain to the Italian Data Protection Authority or another competent supervisory authority.

10. Updates and contact

This notice may be updated when the service or relevant processing changes. For questions about an order, use our Contact page.