← Back to home

Privacy policy

1. Data controller

Cheng Lin Xuefen (trading as Floristería Cloris) — Tax ID (NIF): 51487445-J — Address: Calle San Germán, 66, 28020 Madrid, Spain — Email: contact@cloris.es.

2. Purposes and legal basis

  • Order and enquiry handling (web form, email, phone): legal basis in pre-contractual or contractual measures (GDPR Art. 6.1.b).
  • Legal obligations (invoicing, tax): GDPR Art. 6.1.c.
  • Web analytics: we measure visits with our own anonymous table and with Google Analytics 4, and only if you accept analytics cookies in the banner (consent, GDPR Art. 6.1.a and Art. 22.2 LSSI). Without your acceptance nothing is loaded or stored. You can withdraw consent at any time; see the cookie policy and the “Site analytics” section for details.
  • Sending offers and news by email: only if you tick the optional box in the order; legal basis is your consent (GDPR Art. 6.1.a and Art. 21 LSSI). You can withdraw it at any time by writing to contact@cloris.es or through the unsubscribe link in each email.

3. Retention

Data are kept as long as needed for the purpose and, where applicable, for legal retention periods (e.g. commercial or tax).

4. Recipients

We will not disclose your data to third parties except where required by law. To provide the service we use the following providers, which process data on our behalf as processors (GDPR Art. 28) under the safeguards of their data processing agreement:

  • Supabase Inc. (USA): database of orders, admin panel accounts and gift-page files. As the provider is based in the USA, international transfers rely on the European Commission's standard contractual clauses included in its data processing agreement (supabase.com/legal/dpa).
  • Hostinger International Ltd. (Cyprus, EU): hosting of the web server running this shop (hostinger.com/legal).
  • Resend, Inc. (USA): sending transactional emails (order notices and the gift-page link). Transfer covered by standard contractual clauses (resend.com/legal/dpa).
  • Google Ireland Ltd. (Ireland, EU): Google Analytics 4, only if you accept analytics cookies, and Google Maps Platform, to calculate the distance and delivery cost for your address and to show the shop map. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses (policies.google.com/privacy).
  • Cloudflare, Inc. (USA): anti-spam check (Turnstile) on forms, which processes your IP and technical browser data (cloudflare.com/privacypolicy).
  • Provider of the language model that generates the Flora assistant's replies: it receives the messages you type in the chat (see the Flora assistant section).

We may also disclose data to public authorities where required by law (for example, the tax agency).

5. Rights

You may exercise access, rectification, erasure, objection, restriction and portability by writing to contact@cloris.es, proving your identity. You may complain to the Spanish Data Protection Agency (www.aepd.es).

6. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration.

Digital gift page (digital pack)

If you order the gift page, we process the photos and texts you upload, and the image of the people who appear in them, to create your page and show it to anyone with the link or QR code. Legal basis: the contract with you (GDPR Art. 6.1.b) and, for the people appearing in the photos, our legitimate interest in providing the service you ask for (Art. 6.1.f), with these safeguards: a private page that search engines do not index, photos reachable only through temporary links, review before printing and automatic deletion. You are responsible for having their permission.

Retention: 90 days from the page's creation; after that we delete photos and texts within 30 days at most (in practice, in the next daily run of the automatic deletion). If the order is deleted, its photos are deleted too. Backups kept by the database provider are overwritten in its normal rotation cycle. We count how many times the page is opened, without recording who opens it.

Providers involved: Supabase (database and files), Hostinger (web server) and Resend (sending the email with the link). Anyone appearing on a page can ask us to remove it using the “Report content” link on the page itself or by writing to contact@cloris.es.

Flora Assistant — Chat processing

Cloris offers an automated assistant named Flora inside the site (🌸 button in the bottom-right corner). Your messages are processed on a server to generate a response, but the conversation content is not persistently stored.

When you close the browser tab, the conversation is no longer accessible. After 15 minutes of inactivity, the server purges the session context.

Flora can read the public catalog (products, shipping settings) to answer questions. It has no access to orders or other customers' data.

Site analytics

We record anonymous page visits in an internal table hosted on Supabase. We store only: visited path, a random anonymous identifier (no personal data), referrer origin (no full URL) and timestamp. We do not store IP nor user agent. This data is used to understand which pages are useful and is kept for a maximum of 12 months.