Privacy Policy

This policy explains what personal data we collect when you visit fraintesaandtheflowers.com or place an order, why we collect it, and what rights you have over it. We keep it short and plain.

1. Who is responsible

&TheFlowers e.U., Hetzendorferstrasse 106-1, 1120 Vienna, Austria, is the controller of your personal data. The studio address is not a public shop and is open by appointment only.

For any question about your data, write to hello@fraintesaandtheflowers.com.

2. What we collect, and why

Order data — your name, delivery and billing address, email address and the contents of your order. We need this to make and send your Flower Collar and to issue the invoice. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal accounting duties (Art. 6(1)(c)).

Payment data — handled by our payment provider, not by us. We never see or store your card or bank details; we receive only the confirmation that the payment succeeded and the reference needed to match it to your order. Legal basis: performance of the contract.

Order emails — we use your email address to confirm the order, and to tell you when your piece leaves the studio. Because every piece is made after you order it, production can take up to 14 days, and we write to you by email as soon as your piece is shipped. Legal basis: performance of the contract.

Messages you send us — if you write to us, we keep the message and your email address so we can answer. Legal basis: our legitimate interest in replying (Art. 6(1)(f)).

Server logs — our host records the usual technical data (anonymised IP address, browser, time of request) to keep the site running and secure. Legal basis: legitimate interest (Art. 6(1)(f)).

We do not use analytics or advertising trackers. If that ever changes, we will ask for your consent first through the cookie banner, and you will be free to refuse.

Waitlist — if you join the list on a product page, we collect your email address. We use it only to write to you when the Flower Collar is ready to order. The legal basis is your consent (Art. 6(1)(a) GDPR), given when you submit the form. You can unsubscribe at any time through the link in every email or by writing to us. We delete your address once you unsubscribe, or 12 months after sales open at the latest.

3. Who else sees your data

We share data only with the service providers we need to run the shop, and only what each one needs:

— IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany), which hosts the website and its server logs. Servers are in the EU.

— PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg), which processes your payment.

— Österreichische Post AG (Rochusplatz 1, 1030 Vienna, Austria), which receives your name and address to deliver the parcel.

— IONOS SE, through whose mail servers our order emails are sent.

— Brevo (Sendinblue SAS) (106 boulevard Haussmann, 75008 Paris, France), which stores the waitlist and sends the email when the Flower Collar is ready. Servers are in the EU.

— our tax adviser and the Austrian tax authority, for invoices, as the law requires.

Each provider acts as a processor on our instructions under a data processing agreement. We never sell your data.

Hosting, email and the waitlist stay within the EU. PayPal is established in Luxembourg but may transfer data to its parent company in the United States; those transfers are covered by the European Commission's Standard Contractual Clauses. Details are in PayPal's privacy statement.

4. How long we keep it

Invoices and order records: seven years, as Austrian tax law requires. Messages you send us: two years. Server logs: kept by IONOS for a maximum of eight weeks, with IP addresses stored in anonymised form only. After that, data is deleted.

5. Your rights

You have the right to ask us for a copy of your data, to correct it, to have it deleted, to receive it in a portable form, to restrict or object to our use of it, and to withdraw any consent you have given. Write to hello@fraintesaandtheflowers.com and we will answer within one month.

If you believe we have handled your data wrongly, you can complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna — dsb.gv.at.

6. Cookies

The site uses only the cookies it needs to work, such as remembering what is in your cart. Details are in our Cookie Policy.

7. Changes to this policy

If we change how we handle data, we update this page and the date below.

Last updated: 24 October 2026