Privacy policy

Last updated: 23 September 2026

• Key terms and shop details

  1. This Privacy Policy sets out how personal data obtained through the online shop https://gladiola.pl/ (hereinafter: the „Online Shop”) is processed.
  2. The data controller is Kwiaciarnia Gladiola Elżbieta Kępa, ul. Patli 5, 16-400 Suwałki, Poland, REGON: 791053423, NIP (VAT ID): 8441185145.

• What data we process and why

  1. The Shop collects information about its Customers when:
     • an order is placed in the Online Shop, in order to perform the contract of sale. Legal basis: necessity for the performance of a contract (Article 6(1)(b) GDPR);
  2. When placing an order in the Online Shop, the Customer provides the following data:
     • e-mail address,
     • address details:
     • town or city,
     • street with house / flat number,
     • first name and surname,
     • telephone number.
     • for businesses, the above is additionally extended by: the company name and VAT identification number.
  3. While the Shop’s website is being used, additional information may be collected, such as the IP address assigned to the Customer’s computer or the external IP address of their internet provider, the domain name, the browser type and the operating system. This also covers data on the links the Customer chooses to click and other actions taken in our Online Shop. Legal basis: legitimate interest (Article 6(1)(f) GDPR), consisting in making the electronically supplied services easier to use and in improving their functionality.
  4. Personal data is provided to the Shop by Customers voluntarily, in connection with contracts of sale being concluded or services being supplied through the Shop’s website. Failure to provide the required information in the order form makes it impossible for the Customer to place and complete an order.

• Who we share data with

  1. The Customer’s personal data is passed on to the providers of services that the Shop uses in running the Online Shop. Depending on the contractual arrangements, those service providers either act on the Shop’s instructions (processors) or determine the purposes and means of processing themselves (controllers).
     • Processors. These include, for example, hosting providers and flower suppliers.
     • Controllers. These supply electronic payment and banking services.

• What cookies are

  1. Cookies are computer data, in particular text files, which are stored on the end device of the Online Shop’s Customer and are intended for use with the Online Shop’s web pages. Cookies usually contain the name of the website they come from, how long they are stored on the end device, and a unique number.
  2. Cookies are used in order to:
     • adapt the content of the Online Shop’s web pages to the Customer’s preferences. They make it possible to recognise the Customer’s device and display the page in a way suited to their individual needs.
     • compile statistics that help us understand how Customers use the web pages, which makes it possible to improve their structure and content.
  3. The Online Shop uses two main types of cookies: „session” cookies and „persistent” cookies. Session cookies are temporary files stored on the Customer’s end device until they leave the website or close the software (the web browser). Persistent cookies are stored on the Customer’s end device for the time specified in the cookie parameters, or until the Customer deletes them.
  4. The Online Shop uses the following types of cookies:
     • „essential” cookies, which make it possible to use the services available within the Online Shop, for example authentication cookies used for services requiring authentication;
     • cookies used to ensure security, for example those used to detect authentication abuse within the Online Shop;
     • „performance” cookies, which make it possible to collect information about how the Online Shop’s web pages are used;
     • „functional” cookies, which make it possible to „remember” the settings chosen by the Customer and to personalise their interface, for example the selected language or region, the font size or the appearance of the website;
     • „advertising” cookies, which make it possible to deliver advertising content better suited to the Customer’s interests.
  5. Customers of the Online Shop may change their cookie settings at any time. Those settings may in particular be changed so as to block the automatic handling of cookies in the web browser settings, or to be informed each time cookies are placed on the Customer’s device. Detailed information on the options and methods of handling cookies is available in the settings of the software (the web browser).
  6. Restricting the use of cookies may affect some of the functionality available on the Online Shop’s web pages.
  7. Cookies placed on the end device of the Online Shop’s Customer may also be used by advertisers and partners cooperating with the operator of the Online Shop, including social networks. The Shop is not responsible for the privacy policies applying on those services.

• Rights of data subjects

  1. The right to withdraw consent — legal basis: Article 7(3) GDPR.
     • The Customer has the right to withdraw any consent they have given to the Shop.
     • Withdrawal of consent takes effect from the moment it is withdrawn.
     • Withdrawal of consent does not affect processing carried out lawfully by us before it was withdrawn.
     • Withdrawal of consent has no negative consequences for the Customer, but it may make it impossible to continue using services or functionality which, by law, the Shop may supply only with consent.
  2. The right to object to processing — legal basis: Article 21 GDPR.
     • The Customer has the right to object at any time — on grounds relating to their particular situation — to the processing of their personal data, including profiling, where the Shop processes their data on the basis of a legitimate interest, for example marketing of the Shop’s products and services.
     • Unsubscribing by e-mail from marketing messages concerning products or services constitutes the Customer’s objection to the processing of their personal data, including profiling, for those purposes.
     • If the Customer’s objection proves justified and the Shop has no other legal basis for processing the personal data, the personal data to which the objection relates will be erased.
  3. The right to erasure („the right to be forgotten”) — legal basis: Article 17 GDPR.
     • The Customer has the right to request the erasure of all or some of their personal data.
     • The Customer has the right to request erasure of personal data where:
     • the personal data is no longer necessary for the purposes for which it was collected or processed;
     • they have withdrawn a specific consent, to the extent that the personal data was processed on the basis of that consent;
     • they have objected to the use of their data for marketing purposes;
     • the personal data is processed unlawfully;
     • the personal data must be erased in order to comply with a legal obligation under Union law or the law of a Member State to which the Shop is subject;
     • the personal data was collected in connection with the offering of information society services.
     • Despite a request for erasure made in connection with an objection or the withdrawal of consent, the Shop may retain certain personal data to the extent necessary for the establishment, exercise or defence of legal claims. This applies in particular to personal data comprising the first name, surname and e-mail address, which is retained for the purpose of handling complaints and claims relating to the use of the Shop’s services, and additionally to the residential or correspondence address and the order number, which is retained for the purpose of handling complaints and claims relating to contracts of sale or the supply of services.
  4. The right to restriction of processing — legal basis: Article 18 GDPR.
     • The Customer has the right to request restriction of the processing of their personal data. Until such a request is considered, it prevents the use of specific functionality or services whose use would involve processing the data covered by the request. The Shop will also not send any messages, including marketing messages.
     • The Customer has the right to request restriction of the use of personal data in the following cases:
     • where they contest the accuracy of their personal data — the Shop then restricts its use for the time needed to verify the accuracy of the data, but no longer than 7 days;
     • where the processing is unlawful and, instead of erasure, the Customer requests restriction of its use;
     • where the personal data is no longer necessary for the purposes for which it was collected or used, but the Customer needs it for the establishment, exercise or defence of legal claims;
     • where they have objected to the use of their data — the restriction then applies for the time needed to consider whether, in view of their particular situation, the protection of the Customer’s interests, rights and freedoms overrides the interests pursued by the Shop in processing their personal data.
  5. The right of access — legal basis: Article 15 GDPR.
     • The Customer has the right to obtain from the Shop confirmation as to whether it processes personal data, and if so, the Customer has the right to:
     • obtain access to their personal data;
     • obtain information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of that data, the envisaged period of storage of the Customer’s data or the criteria for determining that period (where it is not possible to specify the envisaged processing period), the rights available to the Customer under the GDPR and the right to lodge a complaint with a supervisory authority, the source of that data, automated decision-making including profiling, and the safeguards applied in connection with transfers of that data outside the European Union;
     • obtain a copy of their personal data.
  6. The right to rectification — legal basis: Article 16 GDPR.
     • The Customer has the right to obtain from the Shop, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement, by sending a request to the e-mail address given in this Privacy Policy.
  7. The right to data portability — legal basis: Article 20 GDPR.
     • The Customer has the right to receive the personal data they provided to the Shop and then to transmit it to another controller of their choice. The Customer also has the right to request that the personal data be transmitted by us directly to such another controller, where this is technically feasible.
  8. Where the Customer exercises a right arising from the above, the Shop complies with the request or refuses to comply with it without undue delay, and in any event within one month of receiving it. If, however — because of the complex nature of the request or the number of requests — the Shop is unable to comply within one month, it will do so within the following two months, having informed the Customer within one month of receiving the request of the intended extension and the reasons for it.
  9. The Customer may submit complaints, enquiries and requests to the Shop concerning the processing of their personal data and the exercise of their rights.
  10. The Customer has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in respect of an infringement of their right to the protection of personal data or of other rights granted under the GDPR.

• Changes to the Privacy Policy

  1. This Privacy Policy may be updated and amended.
  2. Questions concerning the Privacy Policy should be sent to: kwiaciarnia@gladiola.pl

This is a courtesy translation. In the event of any discrepancy, the Polish version of the Privacy Policy — available at gladiola.pl/polityka-prywatnosci — shall prevail.