1. Identity of the Data Controller

Jollystackfeedbrst Floriculture B.V. (referred to hereafter as "Jollystackfeedbrst", "we", "our", or "the Company") operates the website jollystackfeedbrst.living. We act as Data Controller within the meaning of the European General Data Protection Regulation (Regulation (EU) 2016/679) and the Dutch Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming - UAVG).

  • Legal Entity Name: Jollystackfeedbrst Floriculture B.V.
  • Chamber of Commerce (KVK): 84920148
  • RSIN: 863412901
  • Registered Office: Keizersgracht 382, 1016 GB Amsterdam, The Netherlands
  • Designated Data Protection Contact: [email protected]

2. Categories of Personal Data Collected

We process only personal data that is adequate, relevant, and limited to what is necessary for our botanical retail, corporate floristry, and courier operations. The data categories encompass:

  • Contact & Identification Data: Full name, billing address, delivery address, contact email, and telephone number.
  • Recipient Logistics Details: Third-party recipient names, canal building door codes or access instructions, and gift card enclosure texts provided during bouquet checkout.
  • Commercial Transaction Records: Invoices, ordered floral tiers, delivery timestamps, VAT registration identifiers, and proof-of-delivery signatures obtained by couriers. (Note: payment card data is processed directly via tokenized PCI-DSS Level 1 payment gateways; no raw credit card numbers reside on our servers).
  • Technical & Telemetry Data: IP address, device operating system, browser configuration, timestamp of visit, and consent choices submitted via our cookie preferences banner.

3. Legal Grounds for Processing

We collect and utilize your personal information solely under lawful grounds recognized by Article 6 of the GDPR:

  1. Performance of a Contract (Art. 6(1)(b)): Necessary to bind floral orders, prepare bouquets, allocate courier schedules, and deliver flowers to designated addresses across Amsterdam.
  2. Compliance with Legal Obligations (Art. 6(1)(c)): Maintaining statutory accounting, fiscal records, and tax invoices pursuant to the Dutch State Taxes Act (Algemene wet inzake rijksbelastingen).
  3. Legitimate Interests (Art. 6(1)(f)): Improving courier route efficiency, preventing fraudulent chargebacks, and maintaining website infrastructure security.
  4. Consent (Art. 6(1)(a)): Collected voluntarily when users subscribe to seasonal newsletter edits or activate optional performance cookies.

4. Third-Party Data Processors & Transfers

We strictly do not sell, rent, or lease customer data to commercial data brokers. We share data only with audited technical service providers operating under strict Data Processing Agreements (DPAs):

  • Logistics Dispatch: In-house bicycle couriers access route sequences via encrypted endpoints. Third-party Randstad regional couriers receive solely the recipient's name, street address, and transit phone number.
  • Hosting Infrastructure: Our static files and secured databases are hosted within the European Economic Area (EEA), ensuring complete alignment with EU data sovereignty standards.
  • Fiscal Compliance: Dutch certified accountants and the Dutch Tax and Customs Administration (Belastingdienst) where required by statute.

5. Data Retention Periods

We retain records only as long as necessary to fulfill the commercial purpose or comply with statutory retention laws:

  • Fiscal Transaction Records: Retained for 7 years in compliance with Dutch tax code record-keeping requirements.
  • Inquiry Form Communications: Retained for 12 months following last communication, after which emails are permanently purged.
  • Courier Waybills & Recipient Door Codes: Deleted within 30 days of confirmed bouquet delivery.

6. Your Statutory Rights Under the GDPR

As a data subject residing within the EEA, you possess the following enforceable rights under Articles 15 through 22 of the GDPR:

  • Right of Access: You may request a verified copy of all personal data held concerning you.
  • Right to Rectification: You may request immediate correction of inaccurate or incomplete contact details.
  • Right to Erasure ("Right to be Forgotten"): You may request deletion of data that is no longer required for legal obligations.
  • Right to Restriction of Processing: You may freeze processing while disputes regarding accuracy are resolved.
  • Right to Data Portability: You may obtain your transaction history in a structured, machine-readable JSON or CSV format.
  • Right to Object: You may object at any time to processing predicated on our legitimate interests.

To exercise any of these rights, email our Data Protection Officer at [email protected]. We respond to all formal requests within thirty (30) calendar days without charge. If you believe your privacy rights have been infringed, you retain the legal right to lodge a complaint with the Dutch Data Protection Authority: Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ Den Haag).