Showzazippycorner Florals S.L. ("Showzazippycorner", "we", "our", or "us") operates the website showzazippycorner.com and provides botanical curation, cut-flower retail services, and wedding floral planning. We are committed to safeguarding your personal data in full compliance with Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR) and Spanish Organic Law 3/2018 (LOPD-GDD).
1. Data Controller Identification
The legal entity responsible for the collection, storage, and processing of your personal data is:
- Legal Entity Name: Showzazippycorner Florals S.L.
- Company Identification Number (CIF): B-67941208
- Registered Commercial Address: Carrer d'Aragó 284, 08009 Barcelona, Spain
- Data Protection Officer (DPO) Contact: [email protected]
- General Inquiry Email: [email protected]
2. Categories of Data Collected
We only collect personal information when strictly necessary for the fulfillment of our services, communication regarding floral orders, or compliance with Spanish commercial accounting mandates:
- Direct Customer Communications: Full name, telephone number, email address, postal code, delivery location within the Barcelona metropolitan zone, and bespoke notes submitted through our inquiry forms.
- Transaction & Invoicing Data: Fiscal billing name, NIF/CIF/NIE tax numbers (for commercial invoices required by the Spanish Agencia Tributaria), delivery recipient details, and transaction timestamps. Note that credit card credentials are processed directly via PCI-DSS compliant gateways and are never stored on our servers.
- Technical Telemetry: Anonymized IP addresses, browser engine user-agent strings, referring URLs, and session durations collected solely for website performance monitoring and bot defense.
3. Lawful Basis and Purpose of Processing
Under Article 6 of the GDPR, our legal grounds for processing your data include:
- Contractual Performance (Art. 6.1.b): To formulate quotes, assemble custom floral arrangements, dispatch perishable flowers to physical addresses, and communicate schedule modifications.
- Legal Obligation (Art. 6.1.c): Compliance with Spanish fiscal, commercial, and consumer protection legislation, including retaining tax invoices for a statutory minimum of five years.
- Consent (Art. 6.1.a): Optional analytics cookies, marketing dispatches, or direct portfolio photography approvals, which you may revoke at any moment without penalty.
4. Third-Party Data Processors
We never trade, sell, or rent your personal data to external advertisers. Data is shared exclusively with vetted data processors under strict Data Processing Agreements (DPAs):
- Cloudflare Inc. (USA/EU): Content delivery network, SSL encryption, and web application firewall security services under standard EU contractual clauses.
- Stripe Payments Europe, Ltd. (Ireland): Secure processing of debit and credit card transactions.
- SendGrid / Twilio Inc.: Transactional email infrastructure for order receipts and inquiry notifications.
- Local Courier Partners: Eco-couriers operating within Barcelona (such as eco-cargo bicycle couriers in Ciutat Vella and Eixample) receive only the recipient’s name, delivery address, and contact telephone number for delivery confirmation.
5. International Data Transfers
Where service providers host infrastructure outside the European Economic Area (EEA), Showzazippycorner verifies that valid transfer mechanisms are in effect, including the EU-US Data Privacy Framework or European Commission Standard Contractual Clauses (SCCs).
6. Data Retention Schedules
Customer inquiries that do not culminate in a floral contract or event booking are permanently purged from our primary customer relationship systems after twelve (12) months. Invoices and transaction contracts are retained for six (6) years in accordance with Article 30 of the Spanish Commercial Code (Código de Comercio).
7. Your GDPR & CCPA Statutory Rights
Under European data protection law, you possess enforceable rights regarding your data:
- Right of Access: Request a complete copy of the personal data held in our systems.
- Right to Rectification: Require us to correct erroneous or outdated contact information.
- Right to Erasure ("Right to be Forgotten"): Request the complete deletion of your files, provided they are not required for ongoing fiscal audits.
- Right to Restrict Processing & Data Portability: Obtain your data in a structured, machine-readable format (CSV/JSON).
- Right to Object: Halt any non-essential processing based on legitimate interests.
To exercise any of these rights, contact our Data Protection Officer at [email protected] with the subject line "GDPR Rights Request". You also retain the statutory right to file a formal complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.