Privacy Policy
We handle your personal data with the same care we give our flowers. This page explains exactly what we collect, why we collect it, and the rights you have over it under the General Data Protection Regulation (GDPR / AVG).
Last updated: 8 August 2026
Contents
Who we are
LS Art Flowers designs, sells and rents handcrafted foam floral arrangements from the Netherlands. When you contact us, request a pre-order or book a viewing, we are the controller of your personal data within the meaning of the GDPR (in Dutch, the AVG).
- Trading name: LS Art Flowers
- Address: Netherlands
- Email: info@lsartflowers.nl
- Telephone / WhatsApp: +31 6 24596223
We are not required to appoint a Data Protection Officer. For any question about your data, write to us at info@lsartflowers.nl.
What personal data we collect
We only ask for what we genuinely need in order to answer you and to arrange your order. We do not buy personal data from third parties, and we never sell yours.
Data you give us directly
- Contact form: your name, email address, telephone number, subject and message.
- Pre-order request: your name, email address, the piece you are interested in, whether you wish to rent or buy, and any message.
- Appointment request: your name, email address, telephone number, preferred date and time of day, and any message.
- Email, telephone and WhatsApp: whatever you choose to tell us in the conversation.
- Order and delivery details: billing and delivery address, rental period and payment details, once an order is agreed.
Data collected automatically
- Technical data: your IP address, browser type and the pages you visit, recorded in our hosting provider's server logs.
- The page you submitted from, and a timestamp, saved with each enquiry so we can see the context of your request.
Please note
Our forms are not designed to receive special categories of data (such as health information). Please do not include any in the message field.
Why we use it, and on what legal basis
The GDPR requires us to have a lawful basis for every use of your data. Ours are set out below.
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Answering your enquiry | Name, email, phone, message | Steps taken at your request prior to a contract (6(1)(b)), or our legitimate interest in replying (6(1)(f)) |
| Handling a pre-order or appointment | Name, contact details, product, preferred date | Performance of a contract, or steps prior to it (6(1)(b)) |
| Delivering, setting up and collecting an order | Name, address, phone, order details | Performance of a contract (6(1)(b)) |
| Invoicing and bookkeeping | Name, address, order and payment details | Compliance with a legal obligation (6(1)(c)) |
| Keeping our website secure and working | IP address, server logs | Our legitimate interest in a secure site (6(1)(f)) |
| Sending you news or offers, if you ask us to | Name, email | Your consent (6(1)(a)) — withdrawable at any time |
How long we keep it
We do not keep personal data for longer than is necessary for the purpose it was collected for, except where the law requires otherwise.
| What | How long | Why |
|---|---|---|
| Enquiries that do not lead to an order | Up to 12 months | So we can pick up the conversation if you come back to us |
| Order and rental correspondence | Up to 2 years after the order ends | Aftercare and any warranty or damage questions |
| Invoices and accounting records | 7 years | Statutory retention period under Dutch tax law |
| Server logs | Short-term, per our hosting provider's policy | Security and troubleshooting |
| Marketing consent | Until you withdraw it | Consent lasts only as long as you give it |
Who we share it with
We share your data only where it is necessary to run our business, and only with parties who are bound to protect it. Where a party processes data on our behalf, we have a data processing agreement (verwerkersovereenkomst) in place with them.
- Our web host, which stores the website and the enquiries submitted through it.
- Our email provider, which carries the messages between us.
- Our accountant and payment providers, for invoicing and payments.
- Transport partners, where a delivery requires it.
- WhatsApp (Meta), if you choose to contact us that way — your message passes through their service under their own privacy terms.
- Government bodies, where we are legally obliged to disclose information.
We do not sell your personal data, and we do not share it for advertising purposes.
Data outside the European Union
We keep your data within the European Economic Area wherever we can. Some services we rely on are provided by companies based outside it — most notably WhatsApp, if you contact us through it. Where data does leave the EEA, it is protected by an adequacy decision of the European Commission or by Standard Contractual Clauses.
If you would rather your data stayed within the EU, simply contact us by email or telephone instead of WhatsApp.
Cookies and the website
We keep our website deliberately simple. We do not use advertising cookies and we do not track you across other websites.
- Functional cookies may be set by our website software so that pages load and forms work correctly. These are necessary and do not require your consent.
- Fonts on this site are loaded from Google Fonts, which means your IP address is sent to Google in order to deliver them.
You can delete or block cookies through your browser settings at any time. Doing so may affect how parts of the site work.
How we protect your data
We take appropriate technical and organisational measures to keep your data safe. Our website is served over an encrypted connection (HTTPS), access to enquiries is limited to the people who need it, and our systems are kept up to date.
No system is ever completely secure. If a data breach occurs that is likely to pose a risk to your rights and freedoms, we will report it to the Dutch Data Protection Authority within 72 hours and inform you without undue delay where the law requires it.
Your rights
Under the GDPR you have the right to:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data, where no legal obligation requires us to keep it.
- Restriction — ask us to pause our use of your data while a question about it is resolved.
- Data portability — receive the data you gave us in a common, machine-readable format.
- Object — object to processing based on our legitimate interests.
- Withdraw consent — at any time, where our use rests on your consent. This does not affect the lawfulness of what came before.
To exercise any of these, email info@lsartflowers.nl. We will respond within one month. We may ask you to confirm your identity first, so that we do not disclose your data to somebody else.
If you wish to complain
We would always rather hear from you first, so please give us the chance to put things right. You also have the right to lodge a complaint with the Dutch supervisory authority:
Supervisory authority
Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag, the Netherlands
autoriteitpersoonsgegevens.nl
Children
Our website and services are intended for adults. We do not knowingly collect personal data from children under 16 without the consent of a parent or guardian. If you believe we hold such data, please contact us and we will delete it.
Changes to this policy
We may update this policy as our services or the law change. The current version always appears on this page, with the date it was last revised shown at the top. Significant changes will be highlighted here.
Questions about your data?
We are happy to explain anything on this page in plain language. Get in touch and we will come back to you personally.
