Privacy policy

1Who controls your data

The controller of personal data is sole proprietor (FOP) Hryntsov Vladyslav Ihorovych, taxpayer ID (RNOKPP) 3468711296, registered address: 02225, Kyiv, Arkhitektora Nikolaieva St, building 15-B, apartment 96 (hereinafter “we”, ODA Flowers).

This policy applies to the website oda-flowers.com.ua and everything related to it: orders, the personal account and our Telegram bot.

For questions about your data, write to contact@oda-flowers.com.ua or call +38 063 569 65 13.

2What data we collect

When you place an order:

• your name, phone number and e-mail;
• the recipient's name and phone number;
• the delivery address, the date and time of delivery and a comment for the courier;
• the greeting card text and the occasion, if you provided them;
• the contents and amount of the order, the payment method and payment status;
• where you came to the website from before placing the order (for example, from our shop's listing on Google Maps or from an advertisement); see section 7 for more on this.

If you started placing an order and entered your number but did not complete it, we save a draft: your name, number, e-mail, city, delivery day and time, what is in your cart, the step at which you stopped and where you came to the website from. We also save which checkout fields have been filled in (only “yes” or “no”, without what is written in them), whether you clicked “Next” and which field the website asked you to correct: this shows us where checkout is inconvenient. The recipient's data, the address and the greeting card text are not included in the draft.

If you have created a personal account:

• your order history and favourites list;
• saved recipients that you added yourself;
• your address, if you saved it;
• your date of birth — only if you provide it yourself, so that we can remind you of it and send you birthday greetings.

An account is also created when, without signing in, you click “Save recipient” on the order page and confirm this via the link in the e-mail sent to the address given in the order. Without your click in the e-mail, no account is created.

Automatically, as on any website: your IP address, browser and device type, the pages you opened, and cookies (see section 7 about them).

We do not collect your bank card details and have no access to them: you enter them on the payment service side.

3Why we need it

• To fulfil the order — to make the bouquet, deliver it, agree the delivery time and send you a photo of the bouquet before it goes out.
• To contact you about the order — to confirm it, clarify the address or inform you of a delay.
• To accept payment and make a refund where necessary.
• To help you complete the order — if you started checkout and did not finish, a manager may call or write to you and ask whether you need help.
• To review a request if something is wrong with the bouquet.
• To keep records — this is required by tax and accounting legislation.
• To remind you of important dates — only if you have asked us to do so yourself (by adding a date in your account or in our Telegram bot). You may opt out at any time.
• To make the website more convenient — we look at anonymised statistics: which pages are opened and where people stop.

We do not use your data for automated decision-making that would in any way affect your rights.

4Data of the bouquet recipient

Flowers are almost always given to another person, so you provide us with someone else's contact details: the recipient's name, phone number and address.

We use them solely to deliver the order: to call and agree the time and to come to the address. We do not add the recipient to mailing lists and do not use their number for advertising.

Before setting off, we call the recipient but do not say that it is flowers or who they are from, only that there will be a surprise delivery. If you ordered an anonymous delivery, we do not mention your name at all.

5Who we share data with

Only to those without whom the order cannot be fulfilled:

• The payment service WayForPay — to accept payment. You enter your card details on its secure page; they are not passed on to us.
• Our courier — the recipient's name, phone number and address, in order to deliver the bouquet.
• The RemOnline accounting service — this is our internal system, which holds the orders and customer records of all our shops.
• Telegram — if you use our bot: to send you a reminder or a confirmation.
• The hosting provider — the website physically runs on its servers.
• Analytics and advertising services (Google, Meta, Microsoft) — anonymised data on behaviour on the website. This data does not contain your name, phone number or address.
• Public authorities — where expressly required by law.

We do not sell your data and do not pass it on to other companies for their mailings or advertising.

6How long we keep it

• Orders — for as long as required by tax and accounting legislation.
• Personal account — for as long as you use it. If you ask us to delete it, we will do so.
• Important dates and reminders — until you remove them yourself (in your account or in the bot).
• Draft of an incomplete order — 30 days, after which it is deleted automatically.
• Technical data and analytics — within the retention periods of the services we use; usually up to 26 months.

7Cookies and analytics

Cookies are small files that a website stores in your browser. We use several types:

• Necessary — the website does not work without them: they remember your cart, your sign-in to your account, your favourites and a confirmed −5% discount.
• Analytics — show anonymised statistics: how many people visited, which pages they view and where difficulties arise.
• Advertising — allow us to show our advertising to people who have already visited the website and to see which advertising actually brings in orders.

You decide what to allow. When you visit the website for the first time, a banner appears at the bottom: you can accept all, keep only the necessary ones or choose categories individually. Your choice remains valid for 180 days, after which we will ask again.

What is active before you make any choice depends on the country from which you visit the website:

• Ukraine and other countries outside the European Union — anonymised analytics (Google Analytics) and advertising measurement (Google Ads) work immediately: without them we cannot see how many people visit the website, where they find it inconvenient and which advertising brings in customers. You can disable analytics and advertising cookies in your browser at any time with the “Necessary only” button.
• EU and European Economic Area countries, the United Kingdom and Switzerland — analytics and advertising cookies are not set until you have given your consent; only what the website cannot function without is active.

Recordings of how the website is used (Microsoft Clarity). To see where the website is inconvenient, we look at anonymised session recordings and heatmaps: where people click, how they scroll the page and at which step they stop. What you type into fields (name, phone number, address, e-mail) is not passed to Microsoft, and all text is hidden on the checkout and personal account pages. The same rule applies to Clarity as to analytics above: in Ukraine it works immediately, and the “Necessary only” button disables its cookies, in which case separate pages are not linked into a single visit; in EU countries, the United Kingdom and Switzerland, Clarity cookies are set only after your consent.

Where you came to the website from. When you open the website via a link — from our shop's listing on Google Maps, from an advertisement, from search or from Instagram — the website records in a cookie in your browser where this visit and several previous visits came from: the name of the source, the page you landed on and the date. It contains no name, phone number or address. The cookie is stored for 90 days. If you place an order, these markers are added to it: this is how we see which shop listing or advertisement actually brings in customers. The same rule applies as for analytics: in Ukraine it works immediately, and the “Necessary only” button disables it; in EU countries, the United Kingdom and Switzerland, it works only after your consent.

You can change your decision at any time: the “Cookie settings” button is at the bottom of every page, and also here: Cookie settings

In addition, cookies can be deleted or blocked in your browser settings; please note that if necessary cookies are blocked, the cart and sign-in to your account will stop working.

Orders themselves are always recorded, and it is only fair to explain this. When an order has been paid, our server sends the statistics system an anonymised record of the fact of the sale itself: the order number, amount, currency and product names. This happens on our side, not in your browser, and therefore does not depend on your choice in the cookie banner.

This record contains nothing by which a person can be identified: no name, phone number, address or e-mail. We need it to know how many bouquets have been sold and for what amount, that is, for accounting and planning, not for tracking you. If you have declined analytics (or, in EU countries, have not consented to it), your navigation between pages is not included in the statistics, only this anonymised purchase summary.

If you came to the website from our advertisement on Google. Google itself adds a technical click identifier to the page address. To see which advertising actually brings in customers, our server notifies Google Ads of a paid order: the click identifier (if any), the payment time, the purchase value and the order number, as well as your e-mail address and phone number — only in encrypted form (SHA-256). Google cannot read them: it only compares the encrypted value with its own accounts in order to recognise the click. This message contains no name or address. The message is compiled by our server and does not use cookies, so your choice in the banner does not affect it: the banner controls only cookies in your browser. For orders with a Ukrainian phone number we always send it; for orders with a foreign number, only after your consent to advertising cookies.

Purchases in our shops and by phone. If you have left your phone number in a shop, in the Telegram bot or when placing an order, we may likewise notify Google Ads of the purchase — the encrypted number, the time and the value of the purchase — in order to assess whether the advertising works. We do not pass on product names, your name or your address.

Lists of our customers in Google Ads. We may pass to Google Ads the phone numbers of people who have bought from us or registered in our Telegram bot (and the e-mail addresses of those who ordered on the website) only in encrypted form (SHA-256). In this way, Google recognises which of the people who see our advertising have already bought from us: we see how many new customers the advertising brings in, and we may choose not to show advertising to those who have just made a purchase. Google cannot read the number; it does not receive names, addresses or purchase history and uses these lists only for our advertising. The numbers of bouquet recipients are not added to these lists. If you do not want to be on such a list, write to contact@oda-flowers.com.ua, and we will remove your number.

Protection against click fraud. When people visit the website via a Google advertisement, we record the click identifier, IP address, browser type, and the time and duration of the page view. This is necessary to distinguish real visitors from automated “click fraud” on advertising and, where necessary, to pass these records to Google for the verification of invalid clicks. The records are stored for 70 days, after which they are deleted. If, after such a visit, you clicked a phone number or a messenger on the website, we may notify Google Ads of the fact of the contact itself (the click identifier and the time, without the number or the content of the conversation): for visits from Ukraine, always; for visits from other countries, only after consent to advertising cookies.

8Your rights

With regard to your data, you have the right to:

• know what data we hold about you and obtain a copy of it;
• have inaccurate data corrected;
• demand the deletion of data;
• withdraw your consent to mailings and reminders at any time;
• object to the use of data for advertising;
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights.

To exercise any of these rights, write to contact@oda-flowers.com.ua. We respond within 30 days. We may ask you to confirm your identity: otherwise anyone could obtain someone else's data.

We are obliged to keep some data even after your request, for example, documents relating to paid orders. We will tell you about this directly.

9How we protect data

The website runs over a secure connection (HTTPS): data between your browser and the website is transmitted in encrypted form. Only those of our employees who need it for their work have access to orders. Passwords are not stored in plain text but as irreversible hashes; even we cannot see them.

No system in the world offers a one hundred per cent guarantee. If a leak affecting your data occurs, we will notify you of it.

10Children

The website is intended for adult buyers. We do not knowingly collect children's data. If you are a parent and believe that your child has provided us with their data, write to us and we will delete it.

11Changes to this policy

We may update this policy, for example, when a new service or a new website feature appears. The current version is always available here, and the date at the top of the page shows when we last updated the text.

If the changes are significant, we will notify you of them prominently, on the website or by e-mail.