Privacy policy

1. Data controller

The controller of your personal data is Anastasiia Kharysh, a sole trader registered as Anastasiia Kharysh BAŻANE, Aleja Wojciecha Korfantego 97, 40-160 Katowice, Poland, NIP 6343076968, entered in the Central Register of Business Activity (CEIDG), e-mail: info@bazane.pl. For anything about personal data, write to info@bazane.pl. We have not appointed a data protection officer — we are not required to, and we answer all questions ourselves.

This policy covers the bazane.pl online shop and the customer account, including signing in with Google.

2. What data we collect

When you order: the orderer's full name and e-mail address, the recipient's full name and phone, the delivery address and the card message. The recipient's details are provided by the orderer — if you order flowers for someone, please let them know you are sharing their details with us for delivery.

We neither see nor store your payment card details — you enter them directly on the Stripe payment page.

When you create an account: e-mail address, name, optionally phone, saved delivery addresses and order history. We do not store your password — only a hash of it computed with Argon2.

When you subscribe to the newsletter: e-mail address, language and the time you gave consent. When you use the contact form: name, e-mail address and message. When you request a bouquet quote: the options you chose, name, phone, and optionally e-mail and notes.

On every visit the server records the IP address, time and requested page. This is used for security only — for example, to limit sign-in attempts.

3. Signing in with Google

You can create an account and sign in with Google. We request only the openid, email and profile scopes. We receive only: your e-mail address, whether Google has verified it, your name from your profile and a stable Google account identifier. We have no access to your contacts, mail, calendar, files or any other data in Google.

We use this data only to: sign you in, link Google sign-in to an account created with the same e-mail address, and prefill your name in the order form. Your e-mail address is also used to send you messages about your account and orders.

We do not sell data received from Google, do not use it for advertising or profiling, do not transfer it to data brokers, do not use it to determine creditworthiness, and do not use it to train artificial intelligence models. We do not share it with anyone else — except the providers who send e-mails and host the shop on our behalf (see “Who receives the data”). BAŻANE's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke access at any time in your Google account settings: myaccount.google.com/permissions. Deleting your account in the shop also removes the link to Google.

4. Purpose and legal basis

Fulfilling and delivering your order — performance of a contract (Art. 6(1)(b) GDPR). Accounting documents and keeping them — legal obligation (Art. 6(1)(c)).

Running your account, including Google sign-in — performance of the contract for the account service (Art. 6(1)(b)).

Replying to messages and preparing quotes — steps taken at your request before entering into a contract (Art. 6(1)(b)).

Newsletter — your consent (Art. 6(1)(a)), confirmed by clicking the link in an e-mail. You can withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal.

Measuring how our ads perform and showing them to people who have visited the shop (Meta pixel) — your consent (Art. 6(1)(a)), given in the cookie banner. You can withdraw it at any time via “Cookie settings” in the page footer; this does not affect the lawfulness of processing before withdrawal.

Shop security, including server logs and abuse prevention — our legitimate interest (Art. 6(1)(f)).

5. Do you have to provide data

Providing data is voluntary, but without order details we cannot deliver the flowers, without an e-mail address you cannot create an account or subscribe to the newsletter, and without contact details we cannot reply to your message. You can order without creating an account.

We do not make automated decisions and do not profile customers ourselves. If you consent to the Meta pixel, Meta may link information about your visit to your Facebook or Instagram account to select ads, under Meta's privacy policy.

6. Who receives the data

We share data only with parties the shop cannot run without, and only as much as needed. We do not sell data.

Stripe Payments Europe, Limited (Ireland) — online payment operator: BLIK, card, Apple Pay and Google Pay. It receives the order number and amount, your e-mail address and the payment details you enter on the Stripe page. Stripe may transfer data to Stripe, Inc. (USA) under the EU-U.S. Data Privacy Framework.

A server provider in the European Union — hosting of the shop and database.

Cloudflare, Inc. (USA) — the Turnstile service, which checks at checkout that the order is not being submitted by a bot; it processes the IP address and technical browser data under standard contractual clauses.

Proton (Switzerland) — e-mails about orders, your account and contact form messages. The European Commission has found that Switzerland ensures an adequate level of data protection.

Resend (USA) — newsletter delivery. Only the e-mail addresses of people who confirmed their subscription are sent there, under standard contractual clauses.

Google — only if you choose to sign in with Google, to the extent described above.

Meta Platforms Ireland Ltd. (Ireland) — only with your consent. The Meta pixel receives the address of the page you visit, your IP address, technical browser data and shop events: a product viewed, an item added to the cart, an order placed with its amount, and a form sent. We do not share your name, e-mail address, phone number or delivery address with Meta. We are jointly responsible with Meta for collecting this data through the pixel. Meta may transfer it to Meta Platforms, Inc. (USA) under the EU-U.S. Data Privacy Framework.

Our accounting office — sales documents. Public authorities — only where the law requires it.

7. How long we keep data

Orders — for as long as tax law requires, i.e. 5 years from the end of the year in which the order was fulfilled. Accounts — until deleted. Newsletter — until you withdraw consent; an unconfirmed subscription is deleted after 30 days. Contact form messages and quote requests — 12 months. Server logs are automatically overwritten by newer entries.

When you delete your account we remove your name, phone, saved addresses, password and Google link, and replace your e-mail address with an anonymous one. Orders are kept for the period required by tax law.

Your cookie banner choice is stored in your browser until you change it. Meta pixel cookies (_fbp, _fbc) expire after 90 days.

8. How we protect data

All communication with the shop uses an encrypted HTTPS connection. Data is stored on a server in the European Union and only the studio has access to it. Passwords are stored only as an Argon2 hash, and your sign-in session is kept in a secure cookie that page scripts cannot read.

Data received from Google is stored only in the shop's database, together with your account. We do not store Google access tokens — once you are signed in, we have no access to your Google account.

To delete the data we received from Google, delete your account in the shop's account settings or write to info@bazane.pl — we will delete it within 30 days.

9. Your rights

You have the right to access, rectify and erase your data, to restrict processing and to data portability, and the right to object to processing based on our legitimate interest. You can delete your account yourself in the account settings; for anything else write to info@bazane.pl — we will reply within one month.

You may also lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

10. Cookies and analytics

Without your consent we use only cookies strictly necessary for the shop to work: a session cookie after you sign in (up to 30 days) and a short-lived cookie securing Google sign-in (10 minutes). These cookies do not require consent.

With your consent, given in the banner, we load the Meta pixel. It stores the _fbp and _fbc cookies (up to 90 days) and sends Meta the data described under “Who receives the data”. Without consent the pixel script is not loaded at all. You can change or withdraw your consent at any time via “Cookie settings” in the page footer.

For visit statistics and anonymous click and scroll maps we use Umami on our own server. It stores no cookies and does not identify users, so we do not ask for consent. Your cart is remembered locally in your browser.

11. Changes to this policy

If we change how we use data — in particular data received from Google — we will update this page and the date at the top, and notify account holders of significant changes by e-mail.