1. Data Controllers

Two separate legal entities operate on flowereast.com, and each acts as a data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and, where applicable, the GDPR, in respect of the data it processes. The split is set out below so that you know whom to contact about which data. Full details of both companies are on the Corporate Information page.

1.1. Platform operator — site usage data

Data arising from the operation of the website (visit logs, IP address, browser information, cookie records, messages and requests you send through the site, and your account details if you register) is controlled by the company operating the site.

1.2. Seller — order and delivery data

Data arising when you place an order (order contents, invoice details, sender and recipient identity and contact details, delivery address and date, gift message and the record of contract acceptance) is controlled by the seller of your order.

2. Personal Data We Process

• Identity and contact: name, email address, phone number.
• Recipient details: recipient's name, phone number and delivery address.
• Order data: order number, products, amount, delivery date and slot, gift message.
• Transaction security: IP address, browser information, cookie records.
• Consent records: date of contract acceptance and the version of the text accepted.
• Account data (only if you register): account email address, full name, an irreversible hash of your password, the record linking your orders to your account, and sign-in security records (failed attempt counter). Your password is never stored in plain text and cannot be read by us.

Registration is not required. You can place an order without an account, in which case none of the account data above is created.

We do not process or store card details. Payment data is transmitted directly to the licensed payment institution.

3. Purposes and Legal Bases

4. Transfers

When you place an order, your order and delivery details are passed through the Platform to the seller so that the order can be fulfilled. This transfer is necessary for the performance of the contract.

Your data may also be shared, limited to the above purposes, with courier and local delivery partners, payment institutions, our email delivery provider, accounting and legal advisers, and with competent public authorities upon lawful request.

For international orders, recipient details are transferred to the delivery partner in the destination country. This transfer is necessary for the performance of the contract.

5. Retention

• Order and invoice records: 10 years as required by law.
• Contract acceptance records: same period as the order record.
• Cookies: the periods stated in the Cookie Policy.
• Request and complaint correspondence: 3 years after completion.
• Account data: for as long as your account remains open. If you ask us to delete your account, your account data is deleted; your orders are not — retaining order and invoice records for 10 years is a legal obligation. In that case the orders are kept with the link to your account removed.

6. Your Rights

You have the right to access your personal data, to have inaccurate data corrected, to request erasure where the conditions are met, to be informed about third parties to whom your data has been transferred, to object to results produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing. Under the GDPR you additionally have rights to restriction of processing and data portability.

7. How to Apply

Addressing your request to the relevant party speeds things up, but if you are unsure, writing to either one is enough. Either way we respond within 30 days. If you are in the European Union you may also lodge a complaint with your national data protection authority.