Privacy policy
PRIVACY POLICY – FLOWER BAR (FLOWERBAR.PL)
Last updated: 18 October 2026
1. General information
The controller of personal data processed in connection with the online store available at flowerbar.pl is Anastazja Guziuk, running a business under the name FLOWER BAR ANASTAZJA GUZIUK, ul. Mińska 31A/HU.1, 03-808 Warsaw, Poland.
Tax ID (NIP): 1132914269, REGON: 387334770.
Data protection contact:
e-mail: info@flowerbar.pl
phone: +48 536 238 032.
The Administrator is the data controller within the meaning of the GDPR.
2. Scope and sources of data
The Administrator processes personal data provided voluntarily by the User in connection with using the Store and placing orders. Shopify may process personal data as a processor or – to the extent specified by Shopify – as a separate data controller. Details are available in Shopify's privacy policy. The data collected includes in particular:
first and last name,
correspondence address / delivery address,
e-mail address,
phone number,
invoice details (tax ID, company name, address) — if the User requests an invoice,
payment details (transferred directly to the payment provider; the Administrator does not necessarily store card numbers),
order information (products, transaction history),
technical data (IP address, device data, server logs),
data provided in correspondence (e-mail, phone).
Sources of data: directly from the User (order form, user account, contact), automatically (server logs, cookies, analytics tools) and from partners / processors (payment provider, courier companies). Providing data is voluntary but necessary to place and fulfil an order — without it, the contract cannot be concluded.
3. Purposes and legal bases of processing
We process data for the following purposes and on the following legal bases:
Order fulfilment and contract performance — processing necessary to conclude and perform the sales contract (Art. 6(1)(b) GDPR): address, contact, transaction and billing data.
Payment handling — processing for settlements and payments (Art. 6(1)(b) GDPR).
Compliance with legal obligations — storing accounting and settlement records (Art. 6(1)(c) GDPR).
Direct marketing and advertising profiling — based on consent (Art. 6(1)(a)) for the newsletter, remarketing and personalised ads — consent is voluntary and given separately.
Legitimate interest of the Administrator (Art. 6(1)(f)) — e.g. establishing or defending legal claims, ensuring the security of the service, detecting and preventing fraud — always balancing the User's interests.
Handling requests and complaints — based on Art. 6(1)(b), (c) or (f), depending on the situation.
Consents are managed using the Cookiebot tool.
4. Data retention period
We store data for as long as necessary to achieve the purposes:
Order data and accounting records (invoices, receipts) — for the period required by tax and accounting law (usually 5 years from the end of the year the document relates to).
Data necessary to fulfil an order (contact, delivery address) — for the duration of the contract and until the limitation periods for claims under applicable law expire.
Marketing data (newsletter, marketing consents) — until consent is withdrawn.
User accounts — for as long as the account exists and 12 months after it is closed for evidentiary purposes, unless the law requires longer storage.
Server logs and technical data — usually up to 12 months.
Data processed to prevent abuse — for as long as necessary to analyse the risk or until claims expire.
In each case, retention periods are minimised and depend on applicable law and legitimate needs.
5. Recipients of data (processors / categories)
Data may be shared only with entities that support the provision of services, e.g.:
Shopify,
payment providers (e.g. Apple Pay, Google Pay, BLIK, Klarna, PayPal, Przelewy24, payment cards),
courier and logistics companies,
accounting office,
IT service providers (hosting, backup), analytics providers (Google Analytics 4, PostHog — data stored on servers in the European Union) and advertising providers (Meta Platforms (Facebook and Instagram), Google Ads).
The Administrator concludes GDPR-compliant data processing agreements with these entities.
6. International data transfers
We use platforms and services (e.g. Shopify) that may process data outside the European Economic Area (EEA). Where data is transferred outside the EEA, the Administrator ensures appropriate legal safeguards (e.g. Standard Contractual Clauses – SCC) or other legally accepted mechanisms. Information about these safeguards is available on request.
7. Cookies and tracking technologies
The Store uses cookies and similar technologies. Types of cookies:
necessary (technical) — without them the store may not work properly; they do not require consent;
analytics — help analyse traffic and how the store is used (Google Analytics 4, PostHog, including anonymous session recordings without the content typed into forms) — require consent;
marketing / profiling — used for remarketing and personalised ads (e.g. Facebook Pixel, Google Ads) — require consent.
The User gives consent to cookies via the consent interface (banner / modal) and may change cookie settings at any time in the browser or in the cookie settings panel on the website. Detailed information about the cookies used, including their types, purposes, providers and retention periods, is available in the Cookie Policy and in the cookie settings panel provided by Cookiebot.
8. Profiling and behavioural advertising
The Administrator may use profiling and behavioural advertising tools (e.g. remarketing) only with the User's consent and using cookie technology. The User may withdraw consent at any time. The Administrator does not make decisions about Users that produce legal effects or similarly significantly affect them based solely on automated processing of personal data.
9. User rights and how to exercise them
In connection with the processing of personal data, the User has the right to:
access their data and receive a copy,
rectify (correct) their data,
erasure ("right to be forgotten") — to the extent provided by law,
restrict processing,
data portability,
object to processing based on legitimate interest,
withdraw consent (where processing is based on consent) — withdrawal does not affect the lawfulness of processing before withdrawal,
lodge a complaint with the supervisory authority (President of the Personal Data Protection Office — PUODO).
How to submit requests: please send requests to info@flowerbar.pl or by post to the Administrator's address. The Administrator responds without undue delay, no later than 1 month after receiving the request; this period may be extended by a further 2 months if necessary due to the complexity or number of requests.
If it is necessary to verify the identity of the requester, the Administrator may ask for a document confirming identity.
10. Children
Our services are not intended for children under 16 (in accordance with Polish/EU law). We do not knowingly collect personal data of children under this age. If the Administrator learns that a child's data has been provided without a guardian's consent, it will delete the data at the guardian's request.
11. Data security
The Administrator applies appropriate technical and organisational measures to protect data (encrypted transmission, permission-based access, regular backups, data processing agreements with processors). Despite these measures, risk cannot be completely excluded; the Administrator makes every effort to keep it to a minimum.
12. Disclosure of data (e.g. requests from authorities)
Data may be disclosed to public authorities on the basis of applicable law (e.g. court orders, law enforcement). The Administrator will disclose data only within the limits of and on the basis of applicable law.
13. Changes to this Privacy Policy
This policy may be updated. The Administrator will inform Users of any material changes via the store website and will update the "Last updated" date.
14. Contact and additional information
For matters relating to personal data protection and store service, please contact us at info@flowerbar.pl or by phone: +48 536 238 032.
The User has the right to lodge a complaint with a supervisory authority if they believe that the processing of their data violates the law. A complaint may be lodged in the EU member state of habitual residence, place of work or place of the alleged infringement.
In Poland, the supervisory authority within the meaning of the GDPR is the President of the Personal Data Protection Office (PUODO).
