Privacy statement

Last updated: September 2026

1. Who is responsible for your data?

Identity of the controller: YB Creations ("Florezze")

KvK (trade register number): 86380265

VAT number: NL004237607B70

Registered address: Laan Rozenburg, the Netherlands

Contact for privacy matters: hello@florezze.com

2. What personal data do we process and how do we obtain it?

We collect your personal data mainly when you use our webshop, place an order, create an account or subscribe to our newsletter. The categories of data we process are:

• Identification and contact data: first name, last name, delivery address, email address and, if you provide it, your date of birth and phone number.

• Transaction and purchase data: the products you bought, your order history and your discount code usage.

• Navigation and preference data: basic technical data such as IP address and device details, and how you use the website, kept anonymously or aggregated where possible.

• Newsletter data: your email address and your communication preferences.

3. For what purpose and on what legal basis do we process your data?

• Managing your purchase and account: processing your orders, arranging delivery, sending order confirmations, handling returns and service requests, and managing your account. Legal basis: performance of the purchase agreement (art. 6.1.b GDPR).

• Meeting legal obligations: keeping the accounting and tax records required under Dutch law. Legal basis: legal obligation (art. 6.1.c GDPR).

• Customer service: answering your questions, complaints or information requests via our official channels. Legal basis: performance of the agreement or our legitimate interest in helping you (art. 6.1.f GDPR).

• Commercial communication and newsletters: sending you offers, news and promotions by email, and analysing how you interact with those emails. Legal basis: your explicit consent, given by ticking the box in our forms (art. 6.1.a GDPR).

• Improving the shop: anonymous statistics about visits and product views so we can improve the website. Legal basis: our legitimate interest (art. 6.1.f GDPR).

4. To which recipients do we disclose your data?

To provide our services, we share your data with trusted suppliers who act as processors under strict security conditions:

• Payment and transaction providers, so your order can be paid securely (we never see or store your card details).

• Transport and delivery partners, so your order reaches you.

• Technology suppliers such as hosting, email and analytics services that help us run the webshop.

• Public authorities and official bodies where there is a legal obligation to share data.

We do not sell or hand over your personal data to third parties for their own commercial purposes without your explicit consent.

5. How long do we keep your data?

We only keep your personal data as long as necessary for the purposes for which it was collected, or as long as a contractual or commercial relationship exists. Once the relationship ends, you unsubscribe or you withdraw your consent, your data is no longer used for active processing or communication. Order and invoice data are kept for 7 years because of Dutch tax retention rules; account data is kept until you ask us to delete it; newsletter data is kept until you unsubscribe. After the statutory retention periods, your data is permanently deleted.

6. What are your rights and how can you exercise them?

You have the right to:

• Access: know whether we process your data and obtain access to it.

• Rectification: ask us to correct incorrect or incomplete data.

• Erasure ("right to be forgotten"): ask us to delete your data when it is no longer needed.

• Objection: object at any time to the processing of your data for commercial purposes.

• Restriction of processing: ask us to suspend processing in the cases provided by law.

• Portability: receive your data in a structured, commonly used and machine-readable format.

• Withdraw consent: withdraw consents previously given at any time.

To exercise any of these rights, send a request to hello@florezze.com with "GDPR rights" in the subject line, and we will respond within one month. If you believe we have not handled your rights correctly, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via www.autoriteitpersoonsgegevens.nl.

7. Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Access to personal data is limited to the people and systems that need it to run the shop.