Privacy Policy

1. Who we are

The controller of your personal data is Exotic Flora (legal name: [TO FILL — registered company name]), registered at [TO FILL — full registered address], registration/VAT number: [TO FILL]. Contact for data protection matters: hello@exoticflora.eu.

2. What data we collect

• Order data — name, email, phone, country, delivery address and any notes you add in the cart form. We need these to confirm availability, arrange shipping and fulfil your order.
• Messages — the name, email and message you send through our contact form.
• Cart content — your shopping cart is stored locally in your own browser (localStorage). It is not sent to us until you place an order.

3. Why we use it (legal bases)

• Performance of a contract — handling and delivering your order (Art. 6(1)(b) GDPR).
• Legal obligations — accounting and tax records (Art. 6(1)(c) GDPR).
• Legitimate interest — answering your enquiry and preventing abuse (Art. 6(1)(f) GDPR).

4. Who we share it with

We share data only with service providers that are necessary to run the shop: the email delivery service used for order notifications (Resend), the hosting provider (Cloudflare), and the shipping partners we agree on with you. We do not sell your data.

5. How long we keep it

Order and invoice data are kept for the period required by tax law ([TO FILL — e.g. 10 years]). Contact form messages are kept for up to 24 months.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing, and to lodge a complaint with your national supervisory authority. Email us at hello@exoticflora.eu and we will respond within one month.

7. Cookies

This website does not use advertising or analytics cookies. Only technically necessary local storage (your shopping cart) is used.