Customer Care
Privacy
Draft for review — not yet in force. Last updated 6 October 2026.
This policy explains what personal data Rosa e Flor collects through rosaeflor.com, why we collect it, and what you can ask us to do with it.
Who we are
The controller of your personal data is We-Sustain Lda, NIF 515960217, with registered address at Rua do Progresso 140, Fração BU, 4760-841 Vilarinho das Cambas, Portugal. For anything to do with your data, write to info@rosaeflor.com.
What we collect today
Very little. You don't need an account to browse rosaeflor.com, and the site uses no analytics, advertising or tracking cookies.
Like any website, our hosting provider records technical data — such as your IP address, browser type and the pages requested — in server logs, to deliver the site and keep it secure.
If you email us, we receive what you choose to send: usually your name, email address and the content of your message.
When you place an order
Online ordering isn't open yet. Once it is, we'll process what's needed to fulfil your order: your name, delivery and billing address, email address, phone number (for the carrier), the pieces ordered and the payment status. Card details are handled by our payment provider and are never stored by us. We'll update this policy to name that provider before checkout opens.
Newsletter
We don't currently run a mailing list. If we start one, we'll only add you with your explicit consent, and every email will include a simple way to unsubscribe.
Why we use your data
- To fulfil a contract with you — processing, delivering and, if needed, returning your order.
- To meet legal obligations — invoicing and keeping tax records.
- For our legitimate interests — keeping the site secure and answering your enquiries.
- With your consent — for a newsletter, if and when we offer one. You can withdraw consent at any time.
Who we share it with
Only the service providers who help us run the shop, and only what each one needs: our website host (Netlify, Inc.), the carriers who deliver your order, our payment provider, and our accountant, plus the tax authority where the law requires it. We never sell your personal data.
Our website host is based in the United States. Transfers of server-log data rely on the safeguards in its data processing agreement, such as the European Commission's Standard Contractual Clauses.
How long we keep it
- Order and invoicing records: 10 years, as Portuguese tax law requires.
- Correspondence: as long as needed to deal with your request and any related claim.
- Server logs: for the hosting provider's standard retention period.
Your rights
You can ask to access, correct or delete your personal data, to restrict or object to how we use it, or to receive it in a portable format. Write to info@rosaeflor.com and we'll reply within one month.
You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).
Changes to this policy
We'll update this page whenever the way we handle data changes — for example, when checkout or a newsletter opens — and change the date at the top.