Privacy and Personal Data Protection Policy (GDPR)
1. Data Controller
This privacy policy applies to personal data processed by Floria de Lux S.R.L. and Ok Flora S.R.L., legal entities organized and operating under the laws of the Republic of Moldova, having their registered legal address at: Republic of Moldova, Chisinau municipality, 60 Vadul lui Voda St., apt. 5; IDNO Floria de Lux SRL: 1016600027250, IDNO Ok Flora SRL: 1018600037532, hereinafter referred to as "OkFlora" or the "Controller".
2. Applicable Legal Framework
OkFlora attaches paramount importance to the protection of personal data. Data processing is carried out in compliance with the provisions of Republic of Moldova Law No. 195/2024 on Personal Data Protection (transposing EU Regulation 2016/679 — GDPR) and other normative acts applicable in the Republic of Moldova.
3. Contact Details of the Controller and Data Protection Officer (DPO)
For any questions, clarifications, or to exercise your rights regarding the processing of your personal data, you can contact us at:
Postal address: 44 Puskin St., Chisinau municipality
E-mail for data protection: office@livrareflori.md
Telephone: +37378862121 / +37322862121
4. Categories of Personal Data Collected
Depending on your interaction with our website and application, we collect and process the following categories of data:
Identification data: first name, last name;
Contact details: phone number, e-mail address;
Delivery data: physical delivery address of orders (and details of the recipients specified by you);
Financial and transactional data: payment details, order history, and issued invoices;
Technical and browsing data: IP address, browser type, device identifiers, data collected through cookies (in accordance with the Cookie Policy).
Note: OkFlora does not collect or store special categories of personal data (such as ethnic origin, political opinions, religious beliefs, or health data).
5. Purposes and Legal Bases of Processing
We process your personal data for the following purposes and under the following legal bases:
a) taking, processing, and delivering orders (basis: performance of a contract or taking steps at the request of the data subject prior to entering into a contract);
b) financial and accounting management and invoicing (basis: compliance with a legal obligation under the tax legislation of the Republic of Moldova);
c) direct marketing communications, newsletters, promotional offers, and contests (basis: your prior and explicit consent);
d) protection of individuals and assets within our physical locations via video surveillance (basis: legitimate interest of the Controller);
e) improving services and user experience on the website/application (basis: legitimate interest of OkFlora or consent, as applicable).
6. Data Retention Period
Your data will be stored only for the duration necessary to fulfill the stated purposes:
transactional and order data: stored for the duration prescribed by the tax and accounting legislation of the Republic of Moldova (generally up to 5–6 years);
data used for marketing/newsletters: stored until you withdraw your consent (unsubscribe);
user account data in the application: stored for the duration of the account's existence or until an explicit request for its deletion is made.
7. Recipients of Personal Data
Data may be transmitted or made accessible to the following categories of recipients exclusively for the specified purposes:
authorized employees of OkFlora;
courier and delivery service providers;
electronic payment processors / partner banking institutions;
IT service, web hosting, and e-mail broadcasting providers (processors acting on behalf of the Controller);
local and central public authorities (tax bodies, law enforcement agencies) to the extent that an express legal obligation exists.
8. Data Transfers Outside the Republic of Moldova
If certain data is transferred to IT service providers outside the Republic of Moldova or the European Economic Area (e.g., cloud services or email dispatch providers), we ensure that the transfer complies with the requirements of the new data protection law, providing an adequate level of protection (through standard contractual clauses or appropriate safeguards).
9. Your Rights
As a data subject, under current data protection law in the Republic of Moldova, you enjoy the following rights:
right to information: the right to receive clear information about the processing of your data;
right of access: the right to obtain confirmation as to whether or not your data is being processed and to receive a copy of it;
right to rectification: the right to request the correction or completion of inaccurate or incomplete data;
right to erasure ("right to be forgotten"): the right to obtain data erasure under legal conditions (e.g., when the data is no longer necessary or consent is withdrawn);
right to restriction of processing: the right to request a temporary limitation on data processing;
right to data portability: the right to receive provided data in a structured, commonly used, machine-readable format;
right to object: the right to object to data processing for reasons related to your particular situation or for direct marketing purposes;
right not to be subject to an automated individual decision (including profiling);
right to withdraw consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal);
right to lodge a complaint with the National Center for Personal Data Protection (CNPDCP — www.datepersonale.md) or to apply to competent courts.
10. How to Exercise Your Rights or Request Data Deletion
You can exercise any of the rights mentioned above or unsubscribe from direct marketing communications:
by submitting a written request electronically via email to: office@livrareflori.md;
directly from your user account in the OkFlora app or website;
by using the "unsubscribe" link included in the footer of every promotional email received.
11. Data Security
OkFlora has implemented appropriate technical and organizational measures to ensure a suitable level of security and protection against unauthorized access, loss, destruction, or alteration of your personal data.
12. Updates to the Policy
This privacy policy may be updated periodically to reflect changes in legislation or adjustments to our services. Any changes will be published on this page.