This Privacy Policy describes how Bloemhoek ("we", "us", "our"), operating at Witte de Withstraat 41, 3012 BL Rotterdam, Netherlands, collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch Implementation Act (Uitvoeringswet AVG).
1. Data Controller
The data controller responsible for your personal data is:
Bloemhoek
Witte de Withstraat 41
3012 BL Rotterdam
Netherlands
Email: [email protected]
Phone: +31 10 414 2290
2. Personal Data We Collect
We may collect and process the following categories of personal data:
- Identity data: first name, last name, title
- Contact data: email address, telephone number, postal address, delivery address
- Transaction data: details of bouquets, subscriptions, and event orders; payment information (processed by third-party payment providers; we do not store full card numbers)
- Technical data: IP address, browser type and version, time zone, operating system, device information
- Usage data: information about how you use our website and services
- Communication data: correspondence, consultation notes, event briefs, delivery preferences
- Marketing data: your preferences in receiving marketing communications from us
3. Legal Basis for Processing
Under the GDPR, we process your personal data on the following legal bases:
- Contract (Art. 6(1)(b)): processing necessary to fulfil orders for counter bouquets, wrapped stems, weekly subscriptions, and event bunches, including delivery and payment
- Legitimate interests (Art. 6(1)(f)): improving our services, fraud prevention, internal analytics, and responding to enquiries — where our interests are not overridden by your rights
- Consent (Art. 6(1)(a)): sending marketing communications, placing non-essential cookies, and processing special-category data where applicable — you may withdraw consent at any time
- Legal obligation (Art. 6(1)(c)): compliance with tax, accounting, and other legal requirements under Dutch and EU law
4. How We Use Your Data
We use your personal data to:
- Process and fulfil flower orders, subscriptions, and event bookings
- Arrange delivery and counter pickup
- Communicate about your orders, consultations, and account
- Process payments and issue invoices
- Send service-related notifications (order confirmations, delivery updates, subscription renewals)
- Respond to contact form submissions and consultation requests
- Improve our website, products, and customer experience
- Send marketing communications where you have opted in
- Comply with legal and regulatory obligations
5. Data Sharing and Recipients
We do not sell your personal data. We may share data with:
- Payment processors: iDEAL and card payment providers for secure transaction processing
- Delivery partners: couriers and logistics providers for subscription and event deliveries within Rotterdam
- IT and hosting providers: website hosting, email services, and CRM systems bound by data processing agreements
- Professional advisers: accountants and legal counsel where necessary
- Public authorities: where required by law, court order, or regulatory request
All third-party processors are required to protect your data in accordance with GDPR and process it only on our documented instructions.
6. International Transfers
Your data is primarily processed within the European Economic Area (EEA). If any processor transfers data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or an adequacy decision.
7. Data Retention
We retain personal data only as long as necessary for the purposes described:
- Order and transaction records: 7 years (Dutch tax and accounting requirements)
- Subscription data: duration of subscription plus 2 years
- Contact form and enquiry data: 2 years from last contact, unless an order follows
- Marketing consent records: until consent is withdrawn plus 1 year
- Website analytics: 26 months maximum
After retention periods expire, data is securely deleted or anonymised.
8. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of access (Art. 15): request a copy of the personal data we hold about you
- Right to rectification (Art. 16): request correction of inaccurate or incomplete data
- Right to erasure (Art. 17): request deletion of your data where there is no compelling reason for continued processing
- Right to restrict processing (Art. 18): request limitation of processing in certain circumstances
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format
- Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent (Art. 7(3)): withdraw consent at any time without affecting prior lawful processing
- Right not to be subject to automated decision-making (Art. 22): we do not use automated decision-making that produces legal or similarly significant effects
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.
9. Right to Lodge a Complaint
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag
Netherlands
Website: autoriteitpersoonsgegevens.nl
10. Cookies and Tracking
Our website uses cookies and similar technologies. For detailed information, please see our Cookie Policy.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- SSL/TLS encryption for data transmitted via our website
- Access controls limiting data access to authorised personnel
- Secure storage of physical and digital records
- Regular review of security practices and processor compliance
- Staff training on data protection obligations
While we take security seriously, no method of transmission over the internet is completely secure. We cannot guarantee absolute security.
12. Children's Data
Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Where changes materially affect your rights, we will notify you by email or a prominent notice on our website.
14. Contact
For privacy-related questions or to exercise your rights:
Email: [email protected]
Phone: +31 10 414 2290
Address: Witte de Withstraat 41, 3012 BL Rotterdam, Netherlands