Who We Are
Bunches Direct imports premium roses from Ecuador and supplies them to business customers across Europe. Bunches Direct is responsible (the “controller”) for the personal data described on this page. For any privacy question or request, email es@bunches-direct.com.
What We Collect
We only collect what you send us through the website: company name, contact person, company email, phone or WhatsApp number, delivery address, tax or VAT number, truck company in Aalsmeer, requested delivery date, the roses and boxes you order, and any message you write to us. We do not use analytics, tracking or advertising tools.
Why We Use It and On What Legal Basis
Answering enquiries sent through the contact form, to take steps you asked for before an order (GDPR Article 6(1)(b)).
Handling orders: preparing the order document, sending confirmation emails, arranging delivery and invoicing, to perform our agreement with you (Article 6(1)(b)).
Checking VAT numbers through the European Commission’s VIES service and keeping business records, because tax law requires it (Article 6(1)(c)).
Customer service and keeping the website secure, based on our legitimate interest in running the business properly (Article 6(1)(f)).
Who Receives Your Data
We never sell your data. We share it only with the services we need to run the website and process orders:
- Brevo (Sendinblue SAS, Paris, France) – sends order and confirmation emails and delivers contact form messages to our inbox. Data is processed in the EU.
- Register.it – hosts our email inbox, where orders and messages are received.
- Fly.io – hosts this website, on servers in Amsterdam.
- Stripe – processes card payments, when you choose to pay by card.
- European Commission (VIES) – confirms that a VAT number is valid.
- The truck company you choose, to deliver your order.
Stripe and Fly.io are US companies and may process data in the United States. Where they do, the transfer relies on the safeguards those providers offer, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We have data processing agreements with the services that handle personal data for us.
How Long We Keep It
Order details and business correspondence are kept for 6 years, and invoices and accounting records for 10 years, as German commercial and tax law requires (§ 257 HGB, § 147 AO). Contact form messages that do not lead to an order are deleted within 2 years. Your cart and order details saved in your own browser stay there until you place the order or clear your browser data.
Your Rights
You can ask us to access, correct or delete your personal data, to restrict or object to its use, or to receive it in a portable format. Email es@bunches-direct.com and we will reply within one month. If you are unhappy with how we handle your data, you can complain to a data protection supervisory authority, in particular the authority of the German federal state where we are based, or the authority in the country where you live or work. A list of German authorities is available from the Federal Commissioner for Data Protection (BfDI).
Changes
We may update this policy when our services or legal obligations change. The date at the top shows when it was last changed.