Data Processing Policy

PRIVACY AND PERSONAL DATA PROCESSING POLICY

Last updated: 23 August 2026

This Privacy Policy explains how personal data of users of xoflowers.md, customers and recipients of XOstudio FLOWERS orders are processed and protected.

The personal data controller is:

  • MY DECOR S.R.L.

  • brand: XOstudio FLOWERS

  • IDNO: 1015600012280

  • Republic of Moldova, Chișinău, stradela Teatrului 2/1

  • website: xoflowers.md

  • e-mail: order@xoflowers.md

For questions regarding personal data processing or the exercise of data subject rights, you may contact us using the details above.

1. Personal data we may process

Depending on how you interact with the website and XOstudio FLOWERS, we may collect and process:

  • first and last name;

  • telephone number;

  • e-mail address;

  • delivery address;

  • name and contact details of the order recipient;

  • information about the order and selected products or services;

  • the text of a greeting card or message;

  • comments and preferences relating to the order;

  • information necessary to process and confirm payment;

  • history of enquiries and orders;

  • IP address and information about the browser, device and operating system;

  • cookie and similar technology data;

  • information about use of the website;

  • other information voluntarily provided by the user.

XOstudio FLOWERS does not request data that is not necessary for the relevant processing purpose.

2. Purposes for which data is used

Personal data may be processed for:

  • accepting and fulfilling orders;

  • arranging delivery of flowers, gifts and other products;

  • communicating with the customer;

  • communicating with the order recipient when necessary for delivery;

  • confirming and processing payments;

  • providing consultations and responding to enquiries;

  • performing contractual obligations;

  • meeting accounting, tax and other legal obligations;

  • maintaining the security and stable operation of the website;

  • analysing website use and improving its functionality;

  • improving the quality of products and services;

  • measuring advertising campaign performance;

  • marketing communications and advertising - where an appropriate legal basis exists or the user has given the required consent.

3. Legal bases for processing

Depending on the specific circumstances, personal data is processed on one or more of the following legal bases:

  • performance of a contract or steps necessary to place and fulfil an order;

  • compliance with legal obligations;

  • the legitimate interests of MY DECOR S.R.L., provided those interests are not overridden by the rights and freedoms of the user;

  • the user’s consent - where consent is required by applicable law.

Where processing is based on consent, the user may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4. Data of the flower or gift recipient

A customer may place an order for another person and provide that person’s name, telephone number, delivery address or other information required to fulfil the order.

By providing another person’s data, the customer confirms that there is a lawful basis for sharing it with XOstudio FLOWERS for the purpose of fulfilling the relevant order.

Recipient data is used only to the extent necessary for:

  • delivery of the order;

  • contacting the recipient;

  • clarifying the delivery address or delivery time;

  • other actions strictly necessary and directly related to fulfilment of the order.

Recipient data is not used for marketing communications merely because it was provided by another customer.

5. Disclosure of data to third parties

Where necessary, data may be disclosed to service providers involved in operating the website or fulfilling an order, including:

  • delivery services and couriers;

  • payment operators and banks;

  • hosting providers;

  • website developers and technical contractors;

  • e-mail and communications service providers;

  • analytics providers;

  • advertising platforms;

  • other service providers where necessary to fulfil the order or operate the website.

Only the amount of data necessary for the specific purpose is disclosed. Personal data may also be provided to public authorities where such disclosure is required by the laws of the Republic of Moldova.

6. International data transfers

Some technology, analytics or advertising services used by the website may process data using infrastructure located outside the Republic of Moldova. In such cases, MY DECOR S.R.L. takes the measures required to ensure that the transfer is carried out in accordance with applicable personal data protection requirements.

7. Data retention

Personal data is retained only for as long as necessary to achieve the purposes for which it was collected.

Data relating to orders, payments, accounting and tax documents may be retained for the periods required by the laws of the Republic of Moldova.

Data processed on the basis of consent is retained until the processing purpose has been achieved, the specified retention period has expired or consent has been withdrawn, unless longer retention is required by law.

After the relevant retention periods expire, data is deleted, destroyed or anonymised.

8. User rights

To the extent provided by applicable law, the user has the right to:

  • receive information about the processing of their personal data;

  • obtain access to their personal data;

  • request correction of inaccurate or incomplete data;

  • request deletion of data;

  • request restriction of processing;

  • object to processing;

  • withdraw previously given consent;

  • receive their data in the cases provided by law;

  • lodge a complaint with the competent personal data protection authority.

To exercise these rights, the user may contact MY DECOR S.R.L. using the contact details stated in this Policy.

9. Data security

MY DECOR S.R.L. applies reasonable technical and organisational measures to protect personal data against unauthorised access, unlawful use, accidental loss, alteration, disclosure or destruction.

Access to personal data is granted only to persons who need it to perform the relevant duties.

10. Changes to this Policy

This Policy may be updated from time to time if the law, website functionality, services used or processing practices change. The current version is published on xoflowers.md.