Privacy Policy

1. Introduction

National Flowers LLC ("National Flowers," "the Company," "we," "our," or "us") operates a retail flower delivery business, selling fresh-cut flowers, bouquets, and floral gift arrangements to individual customers through our website and related channels, from our premises at Industrial Area - Al Naglah, Abu Dhabi, United Arab Emirates.

This Privacy Policy describes how we collect, use, disclose, and safeguard personal data when you visit nationalflower.ae, create an account, place an order, contact customer support, or otherwise communicate with us. It is drafted primarily with reference to UAE Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data ("UAE PDPL") and related UAE legislation identified in this document.

By using our website or services, you acknowledge that you have read this Privacy Policy. Where a specific processing activity legally requires your consent, we will ask for it separately and explain what it covers.

2. Who This Policy Covers

This Privacy Policy applies to personal data we process about:

• Website visitors browsing our catalog without an account;
• Customers who register an account, place an order, or request a delivery;
• Gift recipients whose name, address, and contact details are provided to us by a customer for the purpose of delivering an order to them;
• Prospective customers who sign up for our newsletter or submit an enquiry form; and
• Business contacts and suppliers who correspond with us for commercial or corporate-order purposes.

This Policy does not cover the processing of employee or job-applicant data, which is addressed separately where applicable.

3. Personal Data We Collect

We only collect personal data that is relevant to operating our retail flower delivery service, including:

• Identification & contact information: full name, email address, phone number, WhatsApp number, and billing/delivery address.
• Gift recipient information: where you order flowers to be delivered to a third party, we collect that recipient's name, address, and phone number from you, solely to complete delivery. You are responsible for having the recipient's permission to share this information with us.
• Account information: login credentials (your password is stored in encrypted/hashed form), order history, saved addresses, and preference data.
• Order & transaction information: products purchased, order value, delivery date/time preference, gift card message text, and order communication history.
• Payment information: we do not store full card numbers. Card and digital wallet payments (e.g., Apple Pay, Google Pay, PayPal) are processed by our third-party payment processor [PAYMENT PROVIDER], which provides us with limited confirmation data (such as payment status, last 4 digits, and transaction reference).
• Communication records: content of messages you send us via our contact form, email, telephone, or WhatsApp.
• Technical & usage information: IP address, browser type, device identifiers, pages viewed, referring URL, and similar data collected through cookies and comparable technologies (see Section 8 and our Cookie Policy).

We do not collect information we have no operational need for. If a feature is added in the future that collects additional categories of data, this Policy will be updated before that feature goes live.

4. How We Collect Your Data

We collect personal data through:

• Account registration and checkout forms on our website;
• Order placement, including delivery and gift-message details you type in;
• Newsletter sign-up forms;
• Enquiries submitted via our contact page, email, telephone, or WhatsApp;
• Customer reviews or feedback you choose to submit;
• Cookies and similar technologies used by our website; and
• Correspondence with our customer support team, including for order issues or claims.

5. How We Use Your Data

We process personal data for the following purposes:

• Creating and managing your account;
• Processing, fulfilling, and delivering your flower orders, including coordinating with delivery personnel;
• Processing payments and issuing tax invoices/receipts;
• Responding to enquiries, support requests, and complaints;
• Sending order confirmations, delivery updates, and service notices;
• Sending marketing communications where you have opted in, or as otherwise permitted by law (see Section 15);
• Maintaining the security of our website and preventing fraud or abuse;
• Complying with applicable UAE tax, accounting, and other legal obligations; and
• Improving our website and product range based on aggregated usage trends.

6. Legal Basis for Processing

Where the UAE PDPL requires a specific ground for processing, we rely on one or more of the following, depending on the activity in question:

• Contractual necessity: processing needed to create your account, take your order, and deliver it to you or your chosen recipient.
• Consent: used for marketing emails/SMS/WhatsApp and non-essential cookies. You may withdraw consent at any time, without affecting processing carried out before withdrawal or processing that rests on another lawful ground.
• Legal obligation: retaining invoices and transaction records to meet UAE tax and commercial record-keeping requirements.
• Legitimate interest: used narrowly for fraud prevention, website security, and marketing to existing customers about similar products, where permitted under applicable exceptions and not overridden by your rights.

We do not apply "consent" as a blanket justification for every processing activity — the applicable basis depends on the specific purpose described in Section 5.

7. Sensitive Personal Data

We do not intentionally collect sensitive personal data (such as health information, religious beliefs, racial or ethnic origin, or biometric data) as part of our ordering process. We do not ask for or require this information to sell you flowers.

Free-text fields such as gift card messages are entirely within your control, and any personal detail you choose to include there is handled with the same security safeguards described in Section 12, but is not something we solicit, categorize, or use for profiling.

8. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to keep your shopping cart and session working, remember your preferences, and understand how our site is used. Categories may include:

• Essential/strictly necessary cookies — required for your shopping cart, checkout session, and account login.
• Functionality cookies — remember preferences such as previously viewed items.
• Analytics cookies — help us understand site traffic and usage patterns, where enabled (e.g., via [ANALYTICS PROVIDER]).
• Marketing/advertising cookies — used only if and when we run online advertising campaigns.

We do not claim to use every category above at all times. The categories actually active on our site, and how to manage your preferences, are set out in full in our dedicated Cookie Policy, which forms part of this Privacy Policy.

9. Third-Party Service Providers

We work with third-party providers who process personal data on our behalf, strictly to help us run our business. These currently include, or may include:

• Payment processing: [PAYMENT PROVIDER], to securely process card and digital wallet payments.
• Backend & database infrastructure: Convex, which hosts our application data and powers real-time site features.
• Website hosting: [HOSTING PROVIDER].
• Analytics: [ANALYTICS PROVIDER], if and when enabled.
• Customer communications: email/SMS/WhatsApp delivery providers used to send order and marketing messages.
• Delivery/courier partners: engaged to deliver physical orders to your address or your chosen recipient.

We do not control these providers' own privacy practices beyond the instructions and contractual protections we put in place with them. We do not sell personal data to third parties.

10. How We Share Your Data

Personal data may be shared with:

• The service providers listed in Section 9, to the extent necessary for them to perform their function;
• Delivery/courier personnel, limited to the recipient's name, address, and phone number needed to complete delivery;
• Professional advisers (e.g., auditors, lawyers), where reasonably necessary;
• Government, regulatory, tax, or law-enforcement authorities, where required or permitted by UAE law or a valid legal order;
• A successor entity in the event of a merger, acquisition, or sale of some or all of our business assets, subject to continued protection of your data; and
• Any other party where you have given your permission.

We do not sell personal data. Because we rely on the third-party processors above to operate the service, we cannot state that your data is never shared with anyone — only that sharing is limited to the purposes described in this Policy.

11. International Data Transfers

Some of the service providers described in Section 9 may process or store data on servers located outside the United Arab Emirates. Where this occurs, we take steps intended to ensure such transfers are conducted in a manner consistent with the requirements of the UAE PDPL, such as using providers that maintain appropriate contractual and technical safeguards.

We do not represent that all personal data remains within the UAE at all times, given our use of cloud-based infrastructure and payment providers.

12. Data Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These include encrypted connections (HTTPS/TLS), access controls on our administrative systems, hashed password storage, and restricted internal access to customer data on a need-to-know basis.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also play a role in protecting your own account — for example, by using a strong password and not sharing your login credentials.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including:

• Order, invoice, and transaction records: retained for a minimum of 5 years, in line with UAE tax and commercial record-keeping obligations;
• Account data: retained while your account remains active, and for a reasonable period after closure to resolve disputes or comply with legal obligations;
• Marketing contact data: retained until you unsubscribe or withdraw consent; and
• Support/communication records: retained for a reasonable period to handle any follow-up, complaints, or claims.

Where you request deletion and we are legally required to retain certain records (e.g., invoices for tax purposes), we will retain only what the law requires and delete or anonymise the rest.

14. Your Rights Under UAE Law

Subject to the exceptions and conditions set out in the UAE PDPL, you may have the right to:

• Be informed — understand what data we hold and how it is used, as set out in this Policy.
• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete personal data.
• Erasure — request deletion of data that we are not legally required to keep.
• Restrict or object — object to or limit certain processing, including direct marketing, subject to applicable conditions.
• Withdraw consent — withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.
• Data portability — request your data in a portable format, where applicable under UAE PDPL.
• Complain — lodge a complaint with the competent UAE data protection authority.

These rights are subject to legal exceptions and limitations (for example, we cannot delete records we are legally obliged to keep for tax purposes). To exercise any of these rights, contact us using the details in Section 20.

15. Marketing Communications

With your consent (for example, by subscribing to our newsletter or opting in at checkout), we may send you promotional emails, SMS messages, or WhatsApp messages about products, offers, and seasonal occasions.

• You can opt out of marketing emails at any time using the unsubscribe link in the message.
• You can opt out of marketing SMS/WhatsApp messages by replying STOP or contacting us directly.
• Opting out of marketing does not affect transactional messages relating to an order you have placed.

16. Children's Privacy

Our website and checkout are intended for use by individuals who are at least 18 years old, or the age of legal majority in their jurisdiction, as account holders and purchasers. We do not knowingly collect personal data directly from children to create an account or complete a purchase. If we learn that a child has provided us with personal data without appropriate parental or guardian involvement, we will take steps to delete it.

17. Third-Party Websites

Our website may contain links to third-party websites, such as social media platforms or payment provider pages. We do not control these third-party sites and are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any third-party website you visit.

18. Data Breach Notification

If a personal data breach occurs that is likely to result in a risk to your rights, we will assess and respond to it in accordance with applicable UAE legal and regulatory requirements. We do not commit to a specific notification timeframe beyond what the law requires, as the appropriate response depends on the nature and severity of the incident.

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable UAE law. The "Last Updated" date at the top of this page will always reflect the current version. Where changes are material, we will take reasonable steps to bring them to your attention.

20. Contact Information

For privacy enquiries, to exercise any of your rights under Section 14, or for general questions about this Policy, please contact:

National Flowers LLC — Privacy Enquiries
Industrial Area - Al Naglah, Abu Dhabi, United Arab Emirates
Telephone: +971 3 780 3534
Email: info@nationalflower.ae
Trade Licence Number: [INSERT] · Data Protection Contact: [INSERT IF A DEDICATED DPO/CONTACT IS APPOINTED]

This document is provided for general informational purposes and does not constitute legal advice. National Flowers LLC should have this Policy reviewed and approved by UAE-qualified legal counsel before relying on it as a complete statement of legal compliance.