Privacy Policy

The privacy policy aims to provide information regarding the collection, use and disclosure to third parties of personal data collected through the cityflowers.ro website, owned by NBS Creativ SRL.

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), NBS Creativ SRL is obliged to process securely and only for the purposes specified below, the personal data that you provide us about yourself, a member of your family or another person.

NBS Creativ SRL undertakes to maintain the confidentiality of the personal data provided by you through the cityflowers.ro website by filling out the contact form, sending an e-mail or calling the phone, provided through the website.

WHAT INFORMATION DO WE COLLECT AND FOR WHAT PURPOSE?

Personal data is stored exclusively to facilitate the communication process and to be able to respond to your messages.

Depending on the user's interaction with our site, we collect the following types of data:

(1) Data provided directly by the user :

• Name and surname

• Delivery and/or billing address

• Email address

• Phone number

• Information regarding orders placed and returns made

(2) Data collected automatically :

• IP address

• Browsing data (cookies, pages visited, session duration)

• Information about the device used (operating system, browser type)

(3) Data collected from third parties (if applicable):

• Information obtained from social accounts used for authentication (e.g. Facebook, Google)

• Data provided by business partners for order processing

HOW IS DATA COLLECTED?

Personal data is collected through the following communication channels:

• Contact forms on the cityflowers.ro website

• The checkout form on the cityflowers.ro website

• Email address office@cityflowers.ro

LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

The processing of personal data by cityflowers.ro is carried out in strict accordance with Regulation (EU) 2016/679 (GDPR) and applicable national legislation, based on the following legal grounds:

(1) Performance of a contract (Art. 6(1)(b) GDPR) – necessary to provide the services requested by the user.

(2) User consent (Art. 6(1)(a) GDPR) – for data processing for marketing purposes, personalized advertising or other voluntary purposes.

(3) Compliance with a legal obligation (Art. 6(1)(c) GDPR) – when processing is necessary for compliance with obligations imposed by national or European law.

(4) Legitimate interest (Art. 6(1)(f) GDPR) – for service improvement, cybersecurity and fraud prevention.

USER RIGHTS

The rights of the website user regarding the personal data provided:

• Right to information and access (Art. 15 GDPR) – You can request information about the data we hold about you.

• Right to rectification (Art. 16 GDPR) – You have the right to request the correction of inaccurate data.

• Right to erasure of data ("right to be forgotten") (Art. 17 GDPR) – You can request the deletion of data if it is no longer necessary for the purpose of processing.

• Right to restriction of processing (Art. 18 GDPR) – You can request the limitation of data processing in certain situations.

• Right to data portability (Art. 20 GDPR) – You can request the transfer of your data to another operator.

• Right to object (Art. 21 GDPR) – You can object to the processing of your data for direct marketing.

• The right not to be subject to automated individual decision-making , including profiling

• The right to file a complaint with the supervisory authority ANSPDCP – National Supervisory Authority for Personal Data Processing

• The right to seek legal action if you find that the legislation in the field has been violated

You can exercise these rights by sending an email to office@cityflowers.ro

WHO HAS ACCESS TO YOUR PERSONAL DATA

We do not sell or transfer users' personal data to third parties. However, for the optimal functioning of the services, data may be shared with:

- Payment service providers (e.g. online payment processors)

- Courier companies (e.g. delivery of orders)

- IT service providers (e.g. hosting, security)

- Public authorities (if required by law)

All our partners comply with GDPR regulations and protect user data.

As part of the site administration, we have taken technical and organizational measures to ensure a level of security appropriate to the risks existing through storage and processing.

In the event of a security breach, we will notify users and the competent authorities in accordance with Article 33 GDPR.

DEVICE DATA

Data is automatically collected regarding your visit to the site. This data may include some or all of the following: data regarding the type of device used (smartphone, tablet, laptop) – its location, IP address, type of hardware equipment, information regarding the time interval and date when our website was used, screen resolution, data about the operating system and browser used.

Data about the type of device used, browser and screen resolution is automatically collected by Google, and this is used by us to optimize the way website pages are displayed for different types of devices - the data is anonymous and cannot be used to identify you as an individual person.

We reserve the right to update this policy to reflect legislative changes or internal modifications.