1. Data Controller Identification

The entity responsible for processing your personal data is Zippycornerfeedbrst Florale SAS, registered with the Paris Trade and Companies Register (Registre du Commerce et des Sociétés) under number RCS Paris B 892 411 730, having its registered seat at 28 Rue du Faubourg Saint-Honoré, 75008 Paris, France. Inquiries concerning this policy may be directed to our designated Data Protection Officer (DPO) at [email protected].

2. Categories of Personal Data Collected

In delivering fine botanical arrangements and personalized concierge experiences, we collect and process the following categories of information:

  • Identity and Contact Data: Full name, billing address, recipient delivery address, personal email address, telephone contact number, and bespoke door/access codes provided for private residence deliveries.
  • Gifting and Calligraphy Content: Sentiment messages, anniversary dates, personal correspondence texts submitted for hand-lettered cards, and recipient preferences.
  • Technical and Telemetry Data: IP address, browser typology, operating system, localized language preferences, and interaction logs captured via our strictly regulated cookie implementations.
  • Financial Transaction Records: Proof of payment, transaction timestamps, and masked billing metadata managed exclusively through certified Level 1 PCI-DSS compliant French payment gateways (our servers do not store raw primary account numbers or CVVs).

3. Legal Grounds and Purposes of Processing

All data processing activities conducted by Zippycornerfeedbrst Florale SAS conform to Article 6 of Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR):

  • Contractual Performance: Processing required to assemble, inspect, route, and courier luxury floral orders to your designated Paris destination.
  • Legal Compliance: Maintaining commercial invoices and accounting ledgers in accordance with the French Commercial Code (Code de commerce) and tax obligations.
  • Legitimate Interests: Securing our website infrastructure against automated spam, safeguarding against fraudulent luxury transactions, and refining our floral catalog presentation.
  • Explicit Consent: Sending seasonal private harvesting catalogs and placing optional analytical tracking scripts, which you may revoke at any time.

4. Third-Party Data Processors

We do not sell, rent, or trade your personal data to external data brokers or advertisers. Data is disclosed only to verified service providers under stringent data processing agreements (DPAs):

  • White-Glove Courier Services: Vetted Parisian transport contractors bound by confidentiality to ensure discreet hand delivery to private residences and hotels.
  • Cloud Infrastructure and Hosting: Secure, ISO/IEC 27001 certified data storage located within the European Economic Area (EEA).
  • Calligraphy Artisans: Independent artisans bound by non-disclosure agreements who receive only the necessary sentiment text and first name to produce hand-lettered stationery.

5. Data Retention Periods

Personal information is retained only as long as necessary to fulfill the initial collection purpose:

  • Order Invoices & Billing Records: Retained for ten (10) years in compliance with Article L123-22 of the French Commercial Code.
  • Atelier Inquiry Messages: Retained for twenty-four (24) months from the last active customer interaction, after which records are purged.
  • Cookie Consents: Stored locally on your device for a maximum duration of six (6) months before re-prompting.

6. Your Statutory Rights (GDPR & CCPA)

Under the General Data Protection Regulation and relevant international privacy statutes (including the California Consumer Privacy Act where applicable), you possess enforceable legal rights:

  • Right of Access: Request a comprehensive copy of the personal information we maintain concerning your identity.
  • Right to Rectification: Request correction of inaccurate addresses, recipient details, or contact coordinates.
  • Right to Erasure ("Right to be Forgotten"): Demand the deletion of personal data where legal storage mandates no longer apply.
  • Right to Restriction and Objection: Object to processing founded on legitimate interest or restrict active handling during disputes.
  • Right to Data Portability: Obtain your digital records in a structured, commonly used, machine-readable format.

To exercise any statutory right, please submit a signed written request along with identity verification to [email protected] or by registered mail to our Paris headquarters. If you believe your data rights have been infringed, you maintain the right to lodge a formal complaint with France's national supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, 75007 Paris (cnil.fr).