Privacy policy

1. General Provisions

1.1. This Privacy Policy explains how SIA “FLORERE”, registration No. 40203515880, legal address: Mirdzas Street 25, Jūrmala, LV-2008 (hereinafter – the “Data Controller”), collects, processes, and stores personal data obtained from customers and visitors of the FLORERE online store at www.floreres.com (hereinafter – the “Data Subject” or “You”).

1.2. Personal data means any information relating to an identified or identifiable natural person.

1.3. The Data Controller processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Personal Data Processing Law of Latvia.

2. Collection, Processing and Storage of Personal Data

2.1. The Data Controller collects personal data through the website www.floreres.com, email communication, and social media accounts (such as Facebook and Instagram). Data may also be collected in paper format.

2.2. By using FLORERE services, you agree that your personal data will be processed according to this Privacy Policy.

2.3. The Data Subject is responsible for the accuracy and completeness of their data and must immediately notify the Data Controller of any changes.

2.4. The Data Controller is not responsible for any losses arising from the submission of false or inaccurate data.

3. Processing of Customer Data

3.1. The Data Controller may process the following personal data:

Name, surname
Date of birth (if required)
Contact information (email, phone)
Delivery address
Transaction data (purchased goods, payment information, order date, etc.)
Communication data (correspondence, feedback, inquiries)

3.2. The Data Controller may verify the accuracy of data using public registers.

3.3. The legal basis for processing personal data is provided in Article 6(1)(a), (b), (c), and (f) of the GDPR:

a) consent;
b) performance of a contract or steps prior to entering a contract;
c) compliance with a legal obligation;
f) legitimate interests (such as ensuring business operations or defending legal claims).

3.4. Data is retained until:

it is no longer needed for the purpose collected;
legal claims are resolved;
a legal obligation requires retention (e.g., under the Accounting Law – 5 years);
consent remains valid, unless another legal basis applies.

After the retention period, data is irreversibly deleted or anonymised.

3.5. To fulfil its obligations, the Data Controller may share data with:

accounting and financial service providers;
delivery and logistics companies;
IT service providers;
the payment platform Maksekeskus AS (makecommerce.lv).

Upon request, data may also be shared with state or law enforcement authorities to protect legal interests.

3.6. The Data Controller implements appropriate organisational and technical measures to ensure the protection of personal data against unlawful access, disclosure, alteration or destruction.