1. Data controller

The controller of your personal data is Blooming Code, ul. Sienkiewicza 2/4, 05-800 Pruszków, Poland, tax ID (NIP) 5341971687, REGON 524956023, which runs the To Te Kwiaty online shop at totekwiaty.pl (“we”, “us”).

For anything concerning your personal data, contact us by e-mail at [email protected], by phone on +48 790 586 323 or by post at the address above.

This policy explains what data we process, why, who we share it with and what your rights are. We apply it in line with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

2. What data we process

Payer details – name, e-mail address, phone number, address (where needed) and, for an invoice, company name, address and tax ID.
Recipient details – name, delivery address, phone number and notes for the driver (e.g. door code).
Greeting card text and order notes.
Order details – products ordered, chosen delivery date and method, payment method, order history.
Account details – e-mail address, password (stored encrypted) and the information saved in your account.
Technical data – IP address, browser and device information, country derived from the IP address, and cookie data (see section 10).
Correspondence – the content of e-mails and requests, e.g. complaints.

3. Purposes and legal bases

Concluding and performing the sales contract (preparing the product, delivery or collection, contacting you about the order) and running your account – Article 6(1)(b) GDPR.
Delivery to the recipient – we process the recipient’s data on the basis of our legitimate interest in delivering the product ordered by the payer (Article 6(1)(f) GDPR).
Accounting, invoices and tax obligations – Article 6(1)(c) GDPR.
Handling complaints and withdrawals from the contract – Article 6(1)(c) GDPR.
Establishing, pursuing and defending legal claims – Article 6(1)(f) GDPR.
Fraud prevention and shop security (protection against spam and bots, payment checks, including determining the country from the IP address) – Article 6(1)(f) GDPR.
Replying to messages – Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR where the message concerns an order.
Visitor statistics and marketing (Google Analytics, Google advertising) – only with your consent (Article 6(1)(a) GDPR), given in the cookie banner.

Providing data is voluntary, but without the data needed to fulfil the order (marked as required in the form) we cannot conclude and perform the contract.

4. Recipient’s data

We receive the recipient’s data from the person placing the order. We use it only to deliver the product and to contact the recipient about the delivery. If you are a recipient, you have the rights described in section 9 and can contact us as set out in section 1.

5. Orders by phone and in the shop

You can also order by phone or in person at our flower shop. We then record the data needed to fulfil the order: your name and phone number and, for delivery, the recipient’s details and address and the greeting card text.

We process this data for the same purposes and on the same legal bases as orders placed online (sections 3 and 4). We share it only with the people fulfilling the order and, for courier shipments, with the parcel service and courier company (section 6). If we confirm the order by text message or e-mail, we use your phone number or e-mail address.

We keep it for as long as needed to fulfil the order and handle any complaint, for no longer than 2 years. Only accounting records, such as invoices, are kept longer (section 8).

6. Who we share data with

We share your data only with parties we need to run the shop and fulfil orders:

Payment operators – Przelewy24 (PayPro S.A., Poznań) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). They also process some data as independent controllers, under their own privacy policies.
Google (Google Ireland Limited) – with your consent, Google Analytics and Google Ads (statistics and advertising, section 10).
Parcel service and courier company – for products sent by courier: the recipient’s details needed to send and deliver the parcel.
Technical service providers – hosting and server, e-mail, protection of the shop and its forms against spam and bots. They process data only on our instructions.
Public authorities – where required by law.

On request, we will give you the names of all providers we share your data with.

We determine the country from your IP address on our own server, to prevent fraud. Your IP address is not sent to anyone for this purpose.

We do not sell your data.

7. Transfers outside the EEA

Some providers (including Google and PayPal) may process data in the United States or other countries outside the European Economic Area. Such transfers are based on the European Commission’s adequacy decision (EU–US Data Privacy Framework) for certified companies or on standard contractual clauses approved by the European Commission. You can obtain a copy of the safeguards by contacting us.

8. How long we keep data

Order data and invoices – for 5 years from the end of the calendar year in which the tax payment deadline expired (tax and accounting law).
Data needed to defend against claims – until the claims become time-barred.
Account – until it is deleted; data on orders placed through the account is kept as described above.
Correspondence – for as long as needed to deal with it or, where it concerns an order, as long as the order data.
Data processed on the basis of consent – until consent is withdrawn or the cookies expire.

9. Your rights

You have the right to:

access your data and receive a copy,
have your data rectified,
have your data erased,
restrict processing,
data portability (for data processed on the basis of a contract or consent),
object to processing based on our legitimate interest,
withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (you can change your cookie settings at any time using the privacy settings icon on the site),
lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise your rights, write to [email protected]. We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

10. Cookies

Cookies are small text files stored on your device by your browser. We use them under Article 399 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej).

On your first visit we show a banner where you decide on cookies other than strictly necessary ones. You can change your choice at any time using the privacy settings icon on the site.

Strictly necessary (always on)

They make the shop work: keeping the products you have chosen, checkout, signing in to your account, protecting forms against bots and remembering your cookie choice.

Analytics (with consent)

Google Analytics – lets us see how you use the shop so we can improve it. The data is processed by Google.

Marketing (with consent)

Google Ads and Google Merchant Center – let us measure how well our ads work and show the shop’s ads in Google services.

Without your consent, analytics and marketing cookies are not stored. You can also delete and block cookies in your browser settings – blocking strictly necessary cookies will prevent you from placing an order.

11. Security

The shop uses an encrypted connection (HTTPS). Only authorised people have access to the data. We do not process payment card details – payments are handled by the payment operators.

12. Changes to this policy

We may update this policy, for example when the law or the services we use change. The current version is always available in the shop.

This English version is a translation; in case of any discrepancy, the Polish version prevails.

This policy applies from 2026-10-14.

Privacy policy