Privacy Policy

This policy describes what personal data we process, why, for how long, and what rights you have. Processing follows Regulation (EU) 2016/679 (GDPR) and Czech Act 110/2019 Sb.

This is a courtesy translation. The Czech version is the binding text.

1. Data controller

Premium Nairi s.r.o.
Registered office: Na Příkopě 22, Praha 1, 110 00
Company ID (IČO): 22107096
VAT ID (DIČ): CZ22107096
Společnost zapsaná v obchodním rejstříku vedeném Městským soudem v Praze, oddíl C, vložka 411018
Email: nairiflowers@gmail.com
Phone: +420606608009

We have not appointed a data protection officer — we are not required to. For any privacy question, write to nairiflowers@gmail.com.

2. What we process and on what basis

Your order and its delivery

Name, email, phone, delivery address, order contents, and where given the recipient’s name and phone, the gift-card message and a VAT ID. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Without these we cannot fulfil an order.

Order records are kept after fulfilment because accounting and tax law requires it — compliance with a legal obligation (Art. 6(1)(c) GDPR).

Customer account

Email, name, phone, saved addresses, wishlist items and the payment-gateway customer identifier. Legal basis: performance of a contract.

Conversations with the assistant

We keep the text of a conversation only if you consent in your privacy settings. Legal basis: consent (Art. 6(1)(a) GDPR), withdrawable at any time. Audio recordings are never kept — the recording is discarded once it has been transcribed and is never written to storage.

Newsletter

Your email address. Legal basis: consent. After you unsubscribe we keep the address on a suppression list so that we do not write to you again by mistake, on the basis of our legitimate interest in honouring your unsubscribe.

Running and securing the site

An anonymous visit identifier, a hash of your IP address, browser type, pages viewed, rate-limit records and a log of account changes. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in operating the site securely and preventing abuse. For audience measurement the IP address is stored only as an irreversible hash.

Evidence of cookie consent

Your decision, the time, a hash of the session identifier, a hash of the IP address and a hash of the browser string. Legal basis: legal obligation — we must be able to demonstrate consent (Art. 7(1) GDPR). Details are in the Cookie Policy.

3. Who we share data with

We do not sell personal data. We share it only with processors who provide part of the service for us, and only to the extent that purpose requires:

For recipients outside the European Economic Area, transfers are covered by the standard contractual clauses approved by the European Commission, or by an adequacy decision.

We also disclose data to public authorities where the law requires it — for example to the tax administration in connection with tax documents.

4. How long we keep it

• Audio recordings: not kept at all.
• Assistant conversations: 90 days from the last message, and only with consent. Withdraw consent and they are deleted immediately.
• Orders and tax documents: for the period accounting and tax law requires. If you ask for erasure we anonymise the personal data in the order and keep only what the law demands.
• Customer account: while it exists; after erasure only anonymised records remain.
• Evidence of consent: kept even after consent is withdrawn — otherwise we could not demonstrate it was given.
• Newsletter suppression list: indefinitely, so that your unsubscribe keeps working.
• Operational and security records: admin action logs 2 years, AI usage records 1 year, traffic data 30 days.

5. Your rights

In relation to your data you have the right:

• of access, and to a copy,
• to rectification of inaccurate data,
• to erasure, unless a legal obligation requires us to keep it,
• to restriction of processing,
• to portability of data you provided to us,
• to object to processing based on legitimate interest,
• to withdraw consent at any time where processing is based on it.

You can obtain a copy of your data and delete your account yourself: data export and account erasure. If you have no account, write to nairiflowers@gmail.com — we respond within one month.

6. Automated decision-making

We carry out no automated decision-making or profiling with legal effects. The assistant on the site only recommends flowers; it decides nothing about you.

7. Security

The site runs only over encrypted connections. Passwords are stored only as an irreversible hash. Card details never reach us — you enter them directly into the payment gateway. Access to the admin area is limited to authorised people and actions there are logged.

8. Supervisory authority

If you believe our processing breaches the law, you may lodge a complaint with the supervisory authority:

Úřad pro ochranu osobních údajů
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
uoou.gov.cz

9. Changes to this policy

We may update this policy. The date of the last change is shown at the top of the page; we notify newsletter subscribers by email and post a notice on the site for material changes.