Make a Data Request

Who this page is for

This page explains how to exercise your rights over personal data held by GetFloristPOS (the legal entity named on your invoice). It applies to:

• visitors to getfloristpos.com, including people who filled in a demo, trial or contact form;
• account holders and their staff who sign in to the GetFloristPOS application;
• customers of a florist who uses GetFloristPOS, for example someone who ordered a bouquet or booked a wedding.

How we handle your request depends on which group you are in. Please read the next section first.

Who decides about your data

For people who contact us or use our website, and for the account holders we bill, GetFloristPOS decides why and how their data is used. We are the “business” under California law and the “controller” under the UAE Personal Data Protection Law. Send your request straight to us.

For a florist’s own customers, the florist decides. They collect your name, phone number, delivery address, card message and order history to run their shop, and they choose what to keep. GetFloristPOS hosts that information on the florist’s behalf as a service provider or processor. If you ordered flowers from a shop, please contact that shop first. They can find, correct, export or delete your records in their account.

If you contact us about data held by a florist, we will tell you which shop holds it where we can, pass your request to them, and help them respond. We do not change or delete a florist’s records without their instruction unless the law requires us to.

Rights you can ask for

Depending on where you live, you can ask us to:

• Access: tell you whether we hold personal data about you, what it is, where it came from, why we use it and who we share it with, and give you a copy.
• Correct: fix data that is wrong or incomplete.
• Delete: erase data we no longer need or have no right to keep.
• Export (portability): give you your data in a common, machine-readable format, such as CSV.
• Opt out or object: stop using your data for marketing, or for any “sale” or “sharing” for cross-context behavioral advertising, or object to other processing. We do not sell personal data and we do not share it for cross-context behavioral advertising.
• Limit sensitive data: we do not use sensitive personal information to infer characteristics about you, but you may still ask about it.
• Restrict: pause processing while a question about accuracy or lawfulness is settled.
• Withdraw consent: where we rely on your consent, such as for analytics tags on this site, you can withdraw it at any time.

Account holders can do much of this themselves: export products, customers, sales and stock from the application, edit profile details, and close the account from settings.

Rules by country

United States, including California

California residents have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA): to know, access, correct, delete, opt out of sale or sharing, limit the use of sensitive personal information, and not be treated differently for using these rights. Residents of other states with privacy laws, such as Colorado, Connecticut, Virginia, Texas and others, have similar rights. We apply the same process to every US request, whichever state you live in.

We respond to verifiable requests within 45 calendar days. If we need more time we may extend that once by up to another 45 days, and we will tell you why within the first 45 days. We confirm receipt of a request within 10 business days.

United Arab Emirates

Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), you have rights to information and access, to request transfer of your data, to correction and erasure, to restrict processing, to stop processing, and to object to automated decisions that have legal effects on you. We respond within the time set by the PDPL and its executive regulations. Where those regulations do not yet set a period, we aim to respond within 30 days and tell you if we need longer. Different rules apply in the free zones that have their own data protection laws, such as the DIFC and ADGM; if you are in one of them, tell us and we will follow the applicable law.

Pakistan

Pakistan does not yet have a comprehensive personal data protection law in force. A Personal Data Protection Bill has been drafted but, as of the date above, has not been enacted. We still honor requests for access, correction, deletion and export from people in Pakistan as a matter of good practice, and aim to respond within 30 days. The Prevention of Electronic Crimes Act 2016 (PECA) makes unauthorized access to and misuse of data an offense, and we keep that in mind in how we secure and disclose data.

Everywhere else

If you live somewhere else, contact us anyway. We will apply the same standards and any law that applies to you.

How to make a request

1. Go to the contact form at /contact and choose Privacy or data request as the subject, or write to the privacy address shown via the Show email button on /contact.
2. Tell us which right you want to use, and whether you are a website visitor, an account holder or staff member, or a florist’s customer (and which shop).
3. Give us the details we need to find your data, such as the name, phone number or shop name you used.

Please do not send identity documents, card numbers or other sensitive information in your first message. We will ask for what we need.

How we verify your identity

We must make sure we only give data to, or delete data for, the right person.

• For account holders, we usually ask you to confirm the request from inside your account or from the contact details we already hold.
• For other people, we match two or three pieces of information you give us against what we hold. For a request to see specific pieces of data, or to delete sensitive data, we may ask for more.
• If we cannot verify you, we will tell you and explain why. We use any information you give us for verification only for that purpose.

Authorized agents

You may ask someone else to make a request for you. Under CCPA/CPRA, an authorized agent must provide your signed permission, and we may still ask you to verify your own identity directly or confirm that you gave permission, unless the agent holds a valid power of attorney. Parents or guardians may make requests for minors. Our services are for businesses and are not directed at children.

Fees

We do not normally charge for a data request. If requests from the same person are manifestly unfounded, excessive or repetitive, we may charge a reasonable fee that reflects our costs or decline the request, and we will tell you why.

What happens after a request

• Access and export: we send your data securely, usually as a download link that expires.
• Correction: we update our records and tell you when it is done.
• Deletion: we delete or de-identify the data, and tell service providers who hold it to do the same. We may keep some data where the law allows or requires, such as invoices we must keep for tax, records needed to handle a dispute, or a note that you asked not to be contacted. We will tell you what we kept and why.
• Opt out of marketing: you can also use the unsubscribe link in any marketing message.

If you disagree with our answer

If we refuse your request in whole or in part, we will explain why. You can appeal by replying to our decision through the contact form at /contact with the word “Appeal” in the subject. A different member of our team will review it and reply within 45 days for US requests, or within 30 days elsewhere where possible. If you are still unhappy, you may complain to a regulator: in the United States, your state attorney general or, in California, the California Privacy Protection Agency; in the UAE, the UAE Data Office. We will not treat you differently because you exercised your rights.

This page explains our process and is not legal advice. Our Privacy Policy gives full details of the data we collect and how we use it.