Protection of Personal Data

Principles of Personal Data Processing

Květiny Expres s.r.o., as the operator of the online store at https://kvetinyexpres.cz/, approaches the protection of your personal data with maximum care and responsibility. These principles explain what data we collect, why we do it, and what rights you have in this regard.

1. Personal Data Controller The controller of your personal data is the business company: Květiny Expres s.r.o., with its registered office at Švecova 2383/2, 149 00, Prague 4, Czech Republic. ID (IČO): 24284190. Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 192828. Contact email for privacy matters: info@kvetinyexpres.cz

2. What personal data do we process? We process data you provide when creating an order or registering, and data about your purchases. This specifically includes:

Identification data: Name and surname, or company name and ID.
Contact data: Delivery and billing address, email address, phone number.
Order data: Purchased goods, messages attached to bouquets, purchase history. We never collect or store sensitive data about your payment cards. All payments are processed through secure third-party payment gateways.

3. Why and on what basis do we process data? We process your data for various purposes based on various legal titles:

Order processing and contract fulfillment: To accept, process, and deliver your order. (Legal basis: Fulfillment of the purchase contract).
Communication and support: Sending order status information or resolving inquiries and complaints. (Legal basis: Fulfillment of contract and legitimate interest).
Legal obligations: Retaining invoices for accounting and tax purposes. (Legal basis: Compliance with legal obligations).
Newsletter (Marketing): If you grant us consent, we may send news and special offers to your email. (Legal basis: Consent, which you can withdraw at any time).
Service improvement: If you choose “Accept all” in the cookie bar, we use the Microsoft Clarity tool to evaluate how you use the website: where you click, how you scroll and where you stop during checkout. This helps us remove places where customers get stuck. Fields where you enter personal data (name, address, phone, e-mail, gift message) are masked in the recording. (Legal basis: Consent, which you can withdraw at any time).

4. How long do we retain data?

Data for contract fulfillment is kept for the time necessary to process the order and for the duration of the warranty period.
Data required by law (e.g., invoices) is archived for the period specified by relevant legal regulations (usually 10 years).
Data processed based on your consent (newsletter) is kept until you withdraw your consent.

5. To whom do we transfer data? We handle your data with maximum discretion. We transfer it only to verified partners (processors) who help us ensure the operation of our services:

Shipping companies (e.g., EMS, our own couriers) for order delivery.
Payment gateway providers for secure payment processing.
IT and hosting providers ensuring the secure operation of our e-shop.
Analytics tool provider (Microsoft Corporation, Microsoft Clarity service), if you consent to analytics cookies.
Accounting and tax advisors within the fulfillment of our legal obligations. All partners are required to handle data securely and use it only for the agreed purpose.

6. What are your rights? In accordance with GDPR, you have the following rights:

Right of access, rectification, and erasure ("right to be forgotten").
Right to restriction of processing and data portability.
Right to object to processing and the right to withdraw consent.
Right to lodge a complaint with a supervisory authority (The Office for Personal Data Protection - ÚOOÚ). You can exercise your rights via our contact email: info@kvetinyexpres.cz.

7. How do we protect your data? We use modern security technologies. Data transfer between your browser and our server is encrypted using SSL protocol. Our databases and servers are protected against unauthorized access.

8. Cookies Cookies are small files that a website stores in your browser. In the bar at the bottom of the page you can choose “Accept all” or “Reject all”. We remember your choice in the cookieConsent cookie (365 days after acceptance, 1 day after rejection). We use the following groups:

Necessary cookies (no consent required): they keep the cart, login and site security working, e.g. PHPSESSID (session, 14 days) and cookieConsent.
Analytics cookies – Microsoft Clarity (with consent only): Clarity shows us how visitors use the website (clicks, scrolling, navigation through pages and checkout) in the form of session recordings and click maps. We cannot see the text you type into forms; fields containing personal data are masked. We do not use the data for advertising. Clarity sets the cookies _clck (a pseudonymous visitor identifier) and _clsk (links the viewed pages into a single visit) and the third-party cookies CLID, ANONCHK, MR, MUID and SM from Microsoft domains, which serve the technical operation of the service and unify the identifier across Microsoft services. The provider is Microsoft Corporation.
Third-party tools: We also use Google services (traffic measurement and advertising), Meta Pixel, the Smartsupp chat and the Heureka verified-by-customers reviews. These services may store their own cookies. You can restrict their storage in your browser settings.

The legal basis for the Microsoft Clarity analytics cookies is your consent. You can withdraw it at any time by deleting cookies in your browser settings; the cookie bar will then appear again and you can choose again. Questions about personal data protection: info@kvetinyexpres.cz.

Team Květiny Expres.cz