Personal data privacy policy

Categories of personal data

For the processing purposes mentioned below, we process your personal data provided on our website – hereinafter referred to as „personal data” as follows:

Name, surname, date of birth, mobile/landline phone number, e-mail address, home address, bank account, (hereinafter referred to as „personal data”);
Order number, type of products ordered, payment information, transaction details (hereinafter referred to as „order data”);
The content of the comment sent and its subject, the content of the documents attached and sent to The Tulip and The Rose Shop (hereinafter referred to as „communication data”);
Information regarding your use of the user account and the website, such as the date and time you accessed the website, including public IP address, public device ID and similar data about you (hereinafter referred to as „tracking data „).

The Tulip and The Rose Shop collects your personal data in the following ways: directly from you (given on the website, email, social networks or through other means of communication), from the traffic reports recorded by the servers that host the site, from social networks as well as through cookies or from third-party partners who communicate data to us in order to deliver products to you. (e.g. online sales platforms).

Purposes of processing

We process your personal data to the extent permitted or required by applicable law for the following purposes:

for the provision of the goods and services offered by The Tulip and The Rose Shop, including actions specific to this activity, including to allow the optimal use of the site and for the purpose of obtaining statistical information for the improvement of The Tulip and The Rose Shop services (called hereinafter „purposes related to the provision of services and the operation of the website”);
for the secure administration of The Tulip and The Rose Shop’s IT system and for the purpose of preventing criminal activities (hereinafter referred to as „security and fraud prevention purposes”);
to enable customers to create an account on our website, place online orders and purchase products from The Tulip and The Rose Shop online store. We use the information you provide us to administer the account created on our site. You can manage your account, take advantage of special offers, make shopping easier and manage your personal settings (hereinafter „online supermarket purposes”);
to enable customers to provide suggestions and feedback regarding the services provided by The Tulip and The Rose Shop (hereinafter referred to as „customer suggestion and feedback purposes”);
to allow suppliers to provide their opinions and comments in relation to The Tulip and The Rose Shop’s business or to propose collaboration ideas or to submit offers to The Tulip and The Rose Shop (hereinafter referred to as „supplier-related purposes”);
to enable contacting and managing the contracting of potential partners of The Tulip and The Rose Shop (hereinafter referred to as „expansion partner purposes”).;
to enable marketing activities (hereinafter referred to as „marketing-related purposes”);

These activities may include:

Using your personal data to send you news about our products and services, when you purchase a product from the online store or when you set up a user account. You can unsubscribe from these marketing communications at any time, quickly and easily. You only have to click on the ˝unsubscribe˝ link included in each newsletter.
Based on the information you provide us, you may be shown personalized offers on the site (including on social media). Based on the information you provide us, you may be shown personalized offers on the site (including on social media).
When you participate in other promotional activities (raffles, contests), you may be asked to provide us with relevant information that will be used to administer these promotions or to take possession of the prizes awarded.
Using your number by telephone by The Tulip and The Rose Shop or a designee thereof, to contact you for the purpose of improving our services or our subcontractors / partners (e.g. in the case of surveys regarding your interaction with representatives / designees of The Tulip and The Rose Shop).

We will use the personal data, as provided by you to The Tulip and The Rose Shop, for the purposes mentioned in this privacy policy.

The basis for processing your personal data

In general, the processing of personal data is necessary in order to carry out the activity specific to the purposes of the processing.

In general, you are required to provide your personal data on a mandatory basis, except in limited situations where we inform you that certain information is optional. If you do not provide us with the required data, the process may be delayed or even impossible.

In order to be able to process your personal data, The Tulip and The Rose Shop relies on different legal grounds, as follows:

Consent: We may rely on your consent to use your personal information for certain direct marketing purposes, consent being the legal basis for the collection, processing and use of your personal data as permitted by applicable law. You can withdraw your consent at any time by contacting us at the addresses at the end of this privacy policy.
Execution of a contract or in order to conclude a contract: Processing is necessary for the execution of the contract to which the data subject is a party or to take the steps necessary to conclude the contract between you and The Tulip and The Rose Shop (e.g., in the case of expansion partners being it’s about the collaboration contract, in the case of customers it’s about the sale-purchase contract, in the case of suppliers it’s about the supply contract). For example, if you use our services to place an online order, we will use your personal data to fulfill our obligation to complete and administer that order in accordance with the contract we have with you. Also, the processing of your personal data may be necessary to take steps before concluding a possible contract, in the conditions where you are a potential partner and wish to contact us for a possible commercial collaboration;
Legitimate Interests: We may use the information for our legitimate interests, such as providing the best appropriate website content, emails and newsletters, to improve and promote our products and services, and the content on the website our and for legal, administrative and fraud detection purposes.

Data transfers, recipients and the legal basis of these transfers

Recipients

Third parties: The Tulip and The Rose Shop will be able to transfer data to governmental and regulatory agencies, courts and other governmental authorities, according to the provisions of the applicable legislation, based on Art. 6(1) (c) GDPR, and to external consultants with the role of operators of data (for example, lawyers, accountants, auditors, etc.) based on Art. 6 (1) (f) GDPR.

Service providers: as part of its normal business operations, The Tulip and The Rose Shop enters into contracts with service providers, in order to carry out certain tasks related to the administration of the clientele or IT, the management of suppliers at a global level, the provision of secure global systems and networks such as service provider for The Tulip and The Rose Shop may process personal data, including for: processing payments (e.g. banks, payment processors, etc.), delivering products (e.g. carriers/couriers), organizing campaigns and designating winners (e.g. marketing and advertising agencies), awarding of prizes (e.g. travel agencies). Third party service providers have signed confidentiality clauses and are not allowed to use your personal data for purposes other than those mentioned in this privacy policy.

Retention periods

The personal data processed for the purposes mentioned herein will be kept only as long as necessary, for the duration of the existence of your account and subsequently, during a transition period (for example, to receive a response to your request, to deliver goods, issue invoices ) or for any other longer period in which The Tulip and The Rose Shop has the legal obligation to archive personal data.

If a legal action is initiated, the personal data may be kept until the end of this action, including any appeal periods, and then it will be deleted or archived, according to the provisions of the applicable legislation.

In principle, we will keep your personal data for as long as required or permitted by applicable law. We will subsequently remove/delete your personal data from our systems and records and/or take steps to anonymize it so that you can no longer be identified from it. In all cases, personal data from contracts, communications and other identified documents may be subject to legal retention requirements, which in principle require retention for up to 10 years. Any other personal data will be deleted, in principle, within 6 months from the deletion of your user account or from its collection through the site, with the exception of data related to the order, which can be kept for up to 3 years from the date of the transaction or, as the case may be, for a period necessary to fulfill legal obligations (including if we are required to do so by a court order) or if necessary for reasons of security, fraud prevention, litigation or abuse.

Security procedures

In accordance with European data protection legislation, we use reasonable procedures to prevent unauthorized access and inappropriate use of personal data.

We use appropriate systems and procedures to protect and secure the personal data you transmit to us. We also use security procedures and technical and physical restrictions on accessing and using personal data on our servers. Only authorized personnel can access personal data while working.

Your rights

If you have declared your consent regarding certain processing activities, you can withdraw this consent at any time with future effects. Such withdrawal will not affect the lawfulness of the processing prior to the withdrawal of consent.

Based on the conditions provided by the applicable legislation (GDPR), you have the following rights:

The right of access: You have the right to be informed, upon request, if your personal data is being processed, and if so, you have the right to request access to it. the information includes, among others, the purposes of the processing, the categories of personal data affected and the recipients or categories of recipients to whom your personal data has been or will be disclosed.
You have the right to obtain a copy of the personal data processed. For additional copies, we may charge you a reasonable fee based on administrative costs.
The right to rectification: You have the right to obtain from us the rectification of your incorrect personal data. depending on the purposes of the processing, you have the right to complete incomplete personal data, including by means of an additional declaration.
Right to erasure: You have the right to ask us to erase your personal data.
The right to restriction: You have the right to request the restriction of the processing of your personal data. In this case, the respective data will be marked and can be processed by us only for certain purposes.
The right to data portability: You have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format and you have the right to transmit this data to another entity without objection from Our.
The right to object:
You have the right to object, on grounds related to your situation, at any time to our processing of your personal data, and we may be asked to stop processing your personal data. If you have the right to object and you exercise it, we will no longer process your personal data for that purpose. Exercising this right is free of charge. This right can be invalidated in particular if the processing of your personal data is necessary for the formalities related to the conclusion of a contract or for the fulfillment of a contract already concluded.

The rights mentioned above will be exercised by formulating a request in written form, dated and signed, sent to The Tulip and The Rose Shop in the request, you can indicate whether you want the information to be communicated to a specific address, which can also be by post electronically, or through a mail service that ensures that delivery will be made to you only in person. Please note that before we act on any such request, we reserve the right to verify your identity to ensure that the request comes from you.

The Tulip and The Rose Shop will communicate the requested information, within 30 days from the date of receipt of the request, respecting the request expressed by you regarding the method of communication.

Please note that the above rights may be limited under applicable national data protection legislation. The Tulip and The Rose Shop, as data controller, remains the central point of contact for exercising these rights.

You also have the right to file a complaint with the National Authority for the Supervision of Personal Data Processing.
Please address any questions to The Tulip and The Rose Shop at contact@thetulipandtheroseshop.ro to the attention of the Data Protection Officer.