If you need any part of the text explained, please write to us at kvet@loukykvet.cz and we will be happy to go through it with you.

---

Who processes your personal data?

The data controller according to Art. 4 point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: "GDPR") is Loukykvět s.r.o. (ID: 05663687) with its registered office at Mšecké Žehrovice 11, Mšecké Žehrovice, 270 64 (hereinafter "controller").

• The email address of the controller is kvet@loukykvet.cz
• The phone number of the controller is +420 314004287
• The correspondence address of the controller is Mšecké Žehrovice 11, Mšecké Žehrovice, 270 64, Czech Republic
• The controller has not appointed a data protection officer

---

Why do we process personal data?

Processing based on contract performance or legitimate interest

The main reason why we process your personal data is so that we can provide our services to you, such as bouquets, flower subscriptions, floral workshops, weddings, the shop, and the Loukykvětí newsletter. Therefore, to deliver a bouquet, we need to know your name, surname, phone number, and delivery address. It is the same for other products.

Processing based on compliance with legal obligations

If we process your personal data due to compliance with legal obligations, we do not need to obtain your consent. On this legal basis, we process your identification and contact data, order data, mainly to comply with the following laws:

• Act No. 89/2012 Coll., Civil Code
• Act No. 634/1992 Coll., on Consumer Protection
• Act No. 235/2004 Coll., on Value Added Tax
• Act No. 563/1991 Coll., on Accounting

---

What personal data do we process?

• Identification data, which means mainly name and surname and email
• Contact data, which means personal data that allows us to contact you, i.e., email, phone number and address, your contact on social networks
• Data about your orders, which are mainly data about the products you ordered, the method of delivery and payment

Newsletter

Based on your consent, we process your email so that we can send you our newsletter.

Contact form

To send the contact form on the Loukykvět website, you need to fill in the following data:

• Your name and surname
• Email

We use this data to be able to contact you back.

Contact

In order to communicate with you through available communication channels (e.g., email, Facebook Messenger, Instagram Direct), we process your name, email, and information about your profile (Facebook, Instagram).

Order

If you order a bouquet, flower subscription, floral workshop, wedding, gift voucher on our website, or place an order through the Loukykvět shop (loukykvet.cz/obchod), we process the following personal data for the realization of the order:

• Your name and surname
• Phone
• Email
• Address

And optionally for invoicing purposes, the name, registered office, and ID of the company.

Cookies

The following rules apply to cookies:

• Rules for using or blocking cookies can be set by each user in their internet browser, thereby expressing their consent to their processing.
• The user can set permission or refusal of all or only some cookies (e.g., third-party cookies). Blocking cookies may have a negative impact on the usability of the website and service.
• On this website, visitors who agree to the placement of cookies in their browser through the appropriate settings of individual browsers are provided with information from the following companies: Google, Meta (Facebook, Instagram), Sentry, Stripe, Cloudflare.

If you object to the processing of technical cookies necessary for the functioning of the website, full functionality and compatibility of the website cannot be guaranteed in such a case.

---

Who do we pass personal data to?

In order to deliver your order, we pass your personal data to the shipping company, specifically the name, phone number, and delivery address.

• Direct Parcel Distribution CZ s.r.o. (DPD)
• Messenger a.s.
• PPL CZ s.r.o.
• DHL Express (Czech Republic) s.r.o.

We may pass your personal data to an external accountant for processing purposes.

Furthermore, they may be passed to providers of communication, accounting programs, marketing tools, and web hosting services. Recipients of personal data may be in countries outside the EU.

• Google Cloud & Google Workspace (Google Ireland Limited)
• Amazon Web Services (Amazon Web Services EMEA SARL)
• Hetzner (Hetzner Online GmbH)
• Cloudflare (Cloudflare, Inc.)
• Fakturoid (Fakturoid s.r.o.)
• Front (FrontApp, Inc.)
• Stripe (Stripe Payments Europe, Ltd.)
• Comgate (Comgate Payments, a.s.)
• Sentry (Functional Software, Inc.)
• Ably (Ably Realtime Ltd)
• Twilio (Twilio Inc.)
• Typesense (Typesense, Inc.)
• Ipregistry (Ipregistry)
• PrintNode (PrintNode, Ltd.)
• Meta (Facebook, Instagram)

Under certain, precisely defined conditions, we are then obliged to pass some of your personal data on the basis of valid legal regulations, e.g., to the Police of the Czech Republic, or other law enforcement agencies including specialized units (ÚOOZ, Customs Administration, etc.) and other public administration bodies.

---

Who has access to personal data?

Access to personal data of our customers is only available to selected employees of Loukykvět s.r.o.

---

Where do you store personal data?

We store personal data in data centers of Google Cloud, Amazon Web Services, and Hetzner.

---

How is personal data secured?

Only selected employees of Loukykvět s.r.o. have access to personal data. Login to data centers and services (Google Cloud, AWS, Hetzner, Cloudflare, etc.) is conditioned by two-factor authentication.

---

How long do we keep your data?

We will process your data for the entire time of using our services (i.e., the duration of the contractual relationship between us) and subsequently for a period appropriate to protect our rights, assert claims from defective performance or liability for caused damage.

In the case of granting explicit consent, we will process your data for the period stated in this consent, at most for a period of ten years, unless your consent to the processing of personal data is revoked by you earlier.

---

What are all your rights?

Under the conditions set out in the GDPR, you have:

• the right to access your personal data under Art. 15 GDPR
• the right to rectification of personal data under Art. 16 GDPR, or restriction of processing under Art. 18 GDPR
• the right to erasure of personal data under Art. 17 GDPR
• the right to object to processing under Art. 21 GDPR
• the right to data portability under Art. 20 GDPR
• the right to withdraw consent to processing in writing or electronically to the address or email of the controller listed in Art. III of these conditions

Furthermore, you have the right to lodge a complaint with the Office for Personal Data Protection if you believe that your right to personal data protection has been violated.

You can exercise all your rights by contacting us at kvet@loukykvet.cz.

You can lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (www.uoou.cz).

Right of access means that you can ask for our confirmation at any time whether personal data concerning you are processed or not, and if so, for what purposes, to what extent, to whom they are made available, how long we will process them, whether you have the right to rectification, erasure, restriction of processing or to object, where we obtained the personal data from and whether automated decision-making, including profiling, occurs based on the processing of your personal data. You also have the right to obtain a copy of your personal data, with the first provision being free of charge, and for further provision, we may require reasonable payment of administrative costs.

Right to rectification means that you can ask us at any time to correct or supplement your personal data if it is inaccurate or incomplete.

Right to erasure means that we must delete your personal data if (i) they are no longer needed for the purposes for which they were collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, or (iv) a legal obligation requires us to do so.

Right to restriction of processing means that until we resolve any disputed issues regarding the processing of your personal data, we must limit the processing of your personal data so that we can only have them stored and possibly use them for the establishment, exercise or defense of legal claims.

Right to object means that you can object to the processing of your personal data that we process for direct marketing purposes or due to legitimate interest. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

---

May 25, 2018