Privacy Policy
This policy explains how International Flower Technology LLC processes the personal data of Evoflor users (the person who purchases or uses the Service). We comply with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: International Flower Technology LLC
- Tax identification: EIN 35-2981927
- Registered address: 8 The Green #26835, Dover, DE 19901, United States
- Privacy contact: privacidad@evoflor.com
2. What data we process
- Account data: first name, surname, email, phone number and, where applicable, job title.
- Business data: trading name and the tax details you provide for billing the Service.
- Usage data: technical access information (logs, IP address, device/browser type) needed for security and operation.
- Communications: the messages you send us through support.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service and managing your account | Performance of the contract (Art. 6(1)(b) GDPR) |
| Billing and accounting/tax obligations | Legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention and improvement of the Service | Legitimate interest (Art. 6(1)(f)) |
| Our own marketing communications (where applicable) | Consent or legitimate interest, with the option to unsubscribe |
| Usage analytics through non-essential cookies | Consent (Art. 6(1)(a)) |
4. Retention periods
We keep your data while your account is active and, after you leave, for the legally required periods (e.g. tax and accounting). It is then deleted or anonymised.
5. Recipients and processors
We do not sell your data. To provide the Service we rely on providers that act as data processors, under a processing agreement and with appropriate safeguards:
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | European Union (Ireland) |
| Vercel, Inc. | Hosting and delivery of the web application | USA (standard contractual clauses / Data Privacy Framework) |
| Google Ireland Ltd. (Maps Platform) | Geocoding and autocompletion of delivery addresses | USA (standard contractual clauses / Data Privacy Framework) |
| Resend, Inc. (planned) | Sending transactional emails (alerts and notifications) | USA (standard contractual clauses / Data Privacy Framework) |
| Functional Software, Inc. (Sentry) | Technical error logging for diagnostics | European Union (Germany) |
| Google Ireland Ltd. (Google Analytics) | Aggregated analytics for the public website (only with consent) | USA (standard contractual clauses / Data Privacy Framework) |
| PostHog, Inc. (planned) | Product usage analytics (aggregated data) | European Union |
Your subscription payments are processed by Stripe (Stripe, Inc., USA), a payment service provider, which processes your card or bank account details in accordance with its own privacy policy. Evoflor does not store those details: it only keeps the customer and subscription reference, the payment status and the invoices.
6. International transfers
The Service’s data is hosted in the European Union. Some providers may process data outside the European Economic Area; in that case, transfers are covered by appropriate safeguards (the European Commission’s standard contractual clauses and/or the Data Privacy Framework).
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to privacidad@evoflor.com. If you consider that we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Security
We apply appropriate technical and organisational measures: encryption in transit and at rest, per-customer data isolation, role-based access control, audit logging and backups. No system is infallible, but we work to reduce the risks.
9. Changes to this policy
We may update this policy. We will publish the version in force on this page and, if the changes are material, we will let you know.