Privacy policy

1. Who is responsible

Flor do Pomar is run by Isabel Maria Quinteiro dos Santos, a sole trader, tax number (NIF) 238080056. She is the controller of your data. For anything about your data: eventos@flordopomar.pt.

2. What we collect and why

When you ask us about a date (the “Check availability” form): your names, the name of the person we should speak to, the wedding date, the district and the venue, how the bouquet reaches us, what you imagine for the piece and any photos you add, your phone number and your email. We use them to answer you and prepare a proposal, at your request (Art. 6(1)(b) GDPR).

When you place an order: the details above, the details of the order (the piece, the wedding, the delivery) and, for the client area, your name, email, phone and the language you use. We use them to make your piece, to show you its stages and to email you when it moves on (Art. 6(1)(b) GDPR). Your password is stored only in encrypted form (a hash): nobody on the team can see it.

To keep the client area safe: each session keeps the IP address and the browser it was opened from (our legitimate interest in security, Art. 6(1)(f) GDPR).

Site statistics, without cookies: we count visits to understand what works on the site. We do not store your IP address or your browser: each visitor is a code that changes every day. We keep the country, region and city worked out from the IP on our own server, the type of device, the language, the site you came from (its domain only), how far you read and where you clicked. If your browser asks not to be tracked (Do Not Track or Global Privacy Control), you are not counted. Basis: our legitimate interest in improving the site (Art. 6(1)(f) GDPR).

When you talk to us by WhatsApp, email or Instagram: what you write to us, to answer you.

3. Your photos

The photos you send us (with your request or during the order) are private: only the team sees them, and we remove the hidden data the camera adds (such as the location) when we receive them. We never use them in our portfolio or on social media without your explicit permission.

4. Who else handles your data

We do not sell or give your data to anyone. To run the site we rely on these services, which only handle what they need, on our behalf:

• Hostinger: the server where the site, the database and the photos live.
• CallMeBot: passes the summary of your request to the team’s WhatsApp.
• WhatsApp (Meta): where the team receives your request and where we talk to you if you write to us there.
• Resend: sends the site’s emails (the invitation to the client area, password links and the emails at each stage).

Some of these services may handle data outside the European Economic Area (in the United States, for example). When they do, it is with the safeguards of the GDPR: an adequacy decision of the European Commission or its standard contractual clauses (Art. 45 and 46 GDPR).

5. How long we keep it

• A request that does not become an order: deleted, with its photos, 3 months after the wedding date.
• Photos added to the form but never sent: deleted the next day.
• Orders: kept while the order lasts and, after that, for as long as the law requires (tax rules, for example). The client area stays open until 15 days after the piece is delivered.
• Statistics: clicks for 90 days, the rest for 24 months.
• Backups: one a day, kept for 14 days.

6. Your rights

You may ask to see your data, to correct it, to delete it, to limit or object to its use, and to receive it in a format you can take elsewhere. Where we rely on your consent, you may withdraw it at any time. Write to us at eventos@flordopomar.pt. We answer within one month (up to two more in complex cases, and we will tell you why).

When we delete an account, we remove everything that says who you are (name, email, phone, password, photos and what we wrote about you) and keep only what the law requires us to keep, such as the reference and dates of the order.

You also have the right to complain to the Portuguese data protection authority, the CNPD.

7. Security

The site only works over HTTPS. Passwords are encrypted, the team signs in with a second factor, photos are only served to whoever is allowed to see them, and every team action on your data is recorded.

8. Cookies

We use only the cookies the site needs to work, and none for statistics or advertising. See the cookie policy.

9. Changes to this policy

When this policy changes, we publish the new version here with its date.