Privacy policy

1. Who We Are

August Flowers operates augustflowers.nl and provides fresh flowers, bouquets and floral arrangements for delivery and collection. We are the controller of personal data processed for our store’s own purposes, including handling orders, arranging our own deliveries, providing customer support and managing our mailing list.

Contact: August Flowers, Kabelweg 22, 1014 BB Amsterdam, Netherlands.

Email: augustflowers.amsterdam@gmail.com

Phone / WhatsApp: +31 6 47220457

Our online store is hosted by Shopify. This policy explains how we process personal data about customers, gift recipients, website visitors and people who contact us. Reading this policy or using the website does not, by itself, constitute consent to marketing or tracking.

2. Personal Data We Process

Depending on your interaction with us, we process:

  • Customer details: name, email address, telephone number, billing address and delivery address.

  • Gift recipient details supplied by the purchaser: name, address, telephone number and, where provided, email address, delivery instructions and access information.

  • Order details: products, size, preferences, delivery or collection date and time, gift-card message, sender’s name, payment status, transaction references, refunds and order history.

  • Payment-related information: payment method, amount and information made available by the payment provider, such as limited card or transaction details. Payment credentials are processed through Shopify Payments and the payment service selected at checkout. We do not receive full payment card numbers or card security codes through the standard Shopify checkout.

  • Account information, if you use an account: contact details, order history and preferences associated with the account.

  • Communications: enquiries, custom bouquet requests, reference images, customer support messages and photographs supplied with a quality complaint.

  • Technical and usage data: IP address, device and browser information, cookie identifiers, pages viewed, interactions and consent preferences, as collected through the technologies operating on our website.

  • Marketing data: subscription and consent records, preferences, unsubscribe requests and campaign interaction data where tracking is enabled and lawfully permitted.

Please provide only information needed for your order. Avoid including sensitive personal information, such as medical details, in card messages, delivery instructions or enquiries.

3. Where Data Comes From

We receive data directly from customers, subscribers and people who contact us, including through our website, email, telephone, WhatsApp and Instagram. We also receive technical data through our website and information from Shopify, payment providers and connected services supporting transactions, marketing, analytics and security.

If you receive a bouquet ordered by someone else, the purchaser normally supplies your recipient details and any card message. We use these details to arrange and complete the gift delivery and deal with related issues. Receiving a gift does not enrol you in our marketing list.

4. Purposes and Legal Bases

We rely on the following bases under the GDPR:

  • Contract and steps taken at your request before entering a contract: preparing quotes, processing your order and payment, preparing your flowers, arranging delivery or collection and handling order-related support.

  • Legitimate interests: using recipient details to fulfil a purchaser’s gift order; coordinating delivery; maintaining proportionate security and fraud prevention; handling enquiries and complaints; and establishing or defending legal claims. Our interests are providing a reliable service and protecting our business and customers. We assess these interests against individuals’ rights and use only data reasonably necessary for the purpose.

  • Legal obligation: maintaining required financial records and complying with binding legal requirements and lawful requests from competent authorities.

  • Consent: sending subscribed marketing emails and using advertising cookies, advertising pixels and other tracking technologies where consent is required. Optional analytics requiring consent also rely on consent.

Where a necessary cookie or an analytics technology qualifies for a consent exemption under applicable law, we use it only within that exemption and rely on an appropriate GDPR basis, such as our legitimate interest in operating and understanding our website.

Necessary order details must be provided for us to accept and fulfil an order. If those details are missing, we may be unable to process payment, prepare the order or complete delivery. Marketing subscriptions and consent to optional tracking are not conditions of purchasing flowers.

5. Gift Delivery and Card Messages

We deliver orders ourselves. Personnel who need recipient details, access instructions or card text to prepare and deliver an order can access the relevant information. These details may also be processed in Shopify and the communication systems used to manage the order.

A card message and sender name are intended to be seen by the recipient and may be read by people helping prepare or deliver the order. Please consider this when writing your message. We do not use card text to build advertising profiles or publish private messages or delivery photographs for promotion without an appropriate separate permission.

When we contact a gift recipient, we provide relevant privacy information, including access to this policy, in accordance with applicable transparency requirements. Recipient data is not used for advertising simply because someone ordered flowers for them.

6. Email Marketing

We use Shopify Messaging for our email newsletter and promotional emails. We send these emails to people who have opted in. You can unsubscribe through the link in a marketing email or by contacting us. Withdrawing consent does not affect the lawfulness of earlier processing.

Unsubscribing from marketing does not stop necessary order confirmations, delivery messages, payment communications or replies to enquiries.

Shopify Messaging supports reporting on email delivery, opens, link clicks, unsubscribes and spam complaints. Where enabled and legally permitted, we use campaign information to understand performance. Where consent is required for tracking technologies in emails, we obtain it before using those technologies. You can contact us about your email tracking preferences separately from unsubscribing.

7. Cookies, Analytics and Advertising

Our website uses cookies and similar technologies to operate the shop, remember relevant choices, protect checkout, understand website use and support advertising. The data and purposes depend on the integrations enabled and your consent choices.

Strictly necessary technologies can operate without consent where permitted by law. Advertising cookies and pixels, and analytics technologies requiring consent, are activated only after you consent. You can refuse optional tracking or change and withdraw consent using the website’s cookie preferences. Refusal does not prevent you from making a purchase.

Information about active optional services, their purposes and available choices is provided through our cookie information and preferences. A browser’s cookie deletion tools provide an additional control but do not replace the consent choices on our website.

Where advertising personalisation is enabled with your consent, information about your browsing or purchases may be used to measure campaigns or help show relevant advertising. We do not treat your visit to the website as consent to this activity.

8. Shopify and Other Recipients

We share personal data only as needed for the purposes and legal bases described in this policy, including with:

  • Shopify and its service providers for hosting, checkout, order management, customer accounts, security and Shopify Messaging.

  • Shopify Payments, the provider of your selected payment method and relevant financial institutions to authorise payments, prevent fraud and process refunds. Available methods may include cards, Shop Pay, Apple Pay, iDEAL / Wero and Klarna; availability depends on checkout and provider eligibility.

  • Providers supporting our business communications and administration, including email and messaging platforms and professional advisers where needed.

  • Analytics and advertising providers through enabled integrations, subject to applicable consent requirements.

  • Authorities, advisers or other recipients where disclosure is legally required or necessary and lawful to protect rights or resolve disputes.

Providers may act as processors on our behalf or as independent controllers for their own purposes, depending on their role. Their own privacy notices explain processing for which they are responsible.

Shopify also provides enhanced features through Shopify Network Intelligence. These can involve processing information about interactions with our store together with interactions with other merchants and Shopify. Shopify acts as a controller for processing it undertakes for its own purposes. Where these features involve optional tracking or personalised advertising requiring consent, the relevant use is subject to your consent and privacy choices.

You can learn more through the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

You can contact us about our processing; Shopify’s portal does not replace your rights against August Flowers.

9. International Transfers

Shopify and other service providers may process data outside the European Economic Area. For transfers requiring GDPR safeguards, we rely on an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with any additional measures required.

Contact us for information about safeguards applicable to your data and how to obtain a copy, subject to lawful redactions.

10. How Long We Keep Data

We retain personal data only as long as necessary for the relevant purpose and applicable legal obligations:

  • Required accounting and transaction records are generally retained for the Dutch statutory seven-year period; some records may be subject to a different mandatory period.

  • Operational delivery details, access instructions and card messages are kept only as needed to prepare and fulfil the order and address related issues. Their inclusion in an order record does not automatically make every detail necessary for the full accounting retention period.

  • Enquiries and complaint records are kept for handling the matter and, where necessary, the applicable period for legal claims.

  • Account data is kept while needed to provide the account, subject to deletion requests and any continuing lawful retention obligations.

  • Marketing data is kept while consent remains valid and needed for the subscription. After unsubscribing, we may retain a minimal suppression record to prevent further marketing and evidence needed to demonstrate compliance.

  • Cookie and analytics data follows the lifetimes and retention settings of the relevant service, as explained in the cookie information and provider documentation.

We delete or irreversibly anonymise data when retention is no longer justified. Contact us for the retention period or criteria applicable to a particular record.

11. Security

We use appropriate technical and organisational measures to protect personal data, including restricting access to people who need it for their work. No system is completely secure.

Please do not send full payment card details, passwords or unnecessary sensitive information through email or messaging.

12. Your Rights

Subject to the conditions and exceptions in the GDPR, you have rights to access, rectification, erasure, restriction, data portability and objection.

Where processing relies on legitimate interests, you may object on grounds relating to your situation. You may object to direct marketing at any time, including related profiling. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

You also have protections relating to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, where the GDPR provisions apply.

Contact augustflowers.amsterdam@gmail.com to exercise your rights, including if you are a gift recipient. We may request proportionate information to verify your identity.

We normally respond without undue delay and within one month. If a permitted extension is necessary because of the complexity or number of requests, we will notify you within the first month and explain why. Requests are normally free; statutory exceptions may apply to manifestly unfounded or excessive requests.

You may complain directly to the Dutch data protection authority, Autoriteit Persoonsgegevens, or another competent supervisory authority. You do not have to contact us first.

13. Children and Third-Party Services

Our shop and marketing are aimed at a general adult audience. If you believe we are processing a child’s personal data inappropriately, please contact us so we can assess and address the matter.

If you choose to contact us through WhatsApp or Instagram, or follow a link to another website, that provider also processes information under its own privacy notice. Linking to a provider does not remove our responsibility for processing for which we are the controller.

14. Changes

We may update this policy when our practices or legal requirements change. We will publish the revised version with an updated date and provide additional notice or seek fresh consent where required.

An update does not itself authorise a new use of data that requires your consent.