Privacy Policy

Who we are and what this policy covers

This policy explains how GetFloristPOS (the legal entity named on your invoice), referred to here as “we”, “us” or “our”, handles personal data. It covers two different situations, and the difference matters:

1. Visitors to this marketing website. When you browse the site, fill in a form, book a demo or start a trial, we decide why and how your data is used. For that data we are the controller (in UAE terms) or the business (in California terms).
2. Data inside the hosted point-of-sale service. When a florist uses GetFloristPOS to run their shop, they enter their own customers’ names, delivery addresses, card messages, order history, staff records and similar information. That data belongs to the florist. We process it only on the florist’s instructions to provide the service. For that data we act as a processor (UAE) or service provider (California), and the florist is responsible for telling their own customers how it is used.

If you are a customer of a flower shop that uses GetFloristPOS and you have a question about your order or your details, contact the shop directly. If they need our help to answer you, they will ask us.

This policy is written to meet our obligations in the United States (including the California Consumer Privacy Act as amended by the California Privacy Rights Act, “CCPA/CPRA”), the United Arab Emirates (Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, “PDPL”) and Pakistan. It is not legal advice to you or to any florist using our service.

Personal data we collect on this website

We collect only what we need to answer you, run a trial and improve the site.

• Details you give us in forms. Name, shop name, phone number, WhatsApp number, email address, country, city, number of locations, the system you use today and anything you write in a message box. Demo and switching-call bookings also record the time you chose.
• Account sign-up details. When you start a free trial, we collect the details needed to create your account: your name, business name, contact details, country, chosen plan and login credentials (passwords are stored in hashed form, never in plain text).
• Billing details. Company name, billing address, tax registration number where relevant and the plan you are paying for. Subscription card payments are handled by our billing provider; we do not store full card numbers.
• Technical data. Like most websites, our hosting and security provider receives your IP address, browser type, device type, pages requested and the time of the request. This is used to deliver pages, stop abuse and keep the site working.
• Preferences stored in your browser. Your theme, color palette, country, consent choice, accessibility settings and recent searches are kept in your own browser’s local storage, not sent to us. The Cookie Policy lists each one.
• Bot protection. Our forms use Cloudflare Turnstile to tell people from automated spam. It evaluates signals from your browser and may set a strictly necessary token.

We do not knowingly collect sensitive personal data (such as health, religious or biometric data) through this website, and we ask you not to put it in message boxes.

Personal data we process inside the service

To run the point-of-sale service for a florist, we store and process whatever the florist and their staff enter. Typically this includes:

• the florist’s customer records: names, phone numbers, delivery addresses, occasion dates, card messages, order history, reward points and advance balances (deposits);
• recipient names and addresses for deliveries and wire orders;
• staff user accounts, roles and, if the florist uses the HRM module, shift and payroll information;
• supplier contacts, purchases and stock records;
• payment records (amount, method, reference). Card transactions are processed by the florist’s own payment processor; we receive only the result the processor returns, not full card numbers.

We use this data only to provide, secure, support and maintain the service for that florist, and as the florist instructs. We do not sell it, we do not use it to market to the florist’s customers, and we do not combine it across shops. Our agreement with florists is set out in the Terms of Service.

How and why we use website data

We do not use automated decision-making that produces legal or similarly significant effects on you.

Who we share data with

Form submissions are sent to our customer relationship management system (GoHighLevel), where our sales and onboarding teams follow up, and a short notification is posted to an internal team channel so someone answers quickly. We also use service providers for hosting and content delivery, security and bot protection, subscription billing, email and messaging, and customer support tools.

Each provider may use the data only to perform services for us and is bound by contract to protect it. We may also disclose data:

• when the law, a court or a regulator requires it;
• to protect the rights, property or safety of our customers, the public or us;
• to a buyer or successor if our business is sold or reorganized, under the same protections.

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.

International transfers

We serve florists in the USA, the UAE and Pakistan, and our providers may store or process data in countries other than yours, including the United States and the European Union. Where UAE law applies, we transfer personal data outside the UAE only where the PDPL allows it, such as to countries with adequate protection, under contractual safeguards, or where needed to perform a contract with you. We apply the same safeguards to all transfers regardless of which market you are in.

How long we keep data

• Enquiries and demo requests that do not become accounts: up to 24 months after our last contact, then deleted or anonymized.
• Account and billing records: for as long as the account is active, then for the period tax and accounting law requires (often up to 7 years for invoices).
• Service data in a florist’s account: for as long as the account is active. After cancellation the florist can export their data; we then delete it from live systems within 90 days, and from backups as they roll over.
• Security logs: generally up to 12 months.

How we protect data

We use encryption in transit (HTTPS), access controls based on roles, hashed passwords, regular backups, logging of administrative access, and least-privilege access for our staff. Staff with access to customer data are bound by confidentiality. No system is perfectly secure, so if we learn of a breach affecting your personal data we will notify you, affected florists and regulators as the law requires.

Your rights

Everyone

Whatever country you are in, you can ask us to tell you what data we hold about you, correct it, delete it, or stop sending marketing messages. Use the Data Request page. We will answer within 30 days, and sooner where the law requires.

United States and California (CCPA/CPRA)

California residents have the right to know the categories and specific pieces of personal data we collected, the sources, the purposes and the categories of recipients; to delete; to correct; to opt out of sale or sharing (we do neither); to limit use of sensitive personal information (we do not use it beyond what the law permits); and not to be discriminated against for exercising these rights. You may use an authorized agent; we will ask for proof of authorization and may verify your identity. We honor Global Privacy Control signals as an opt-out where applicable. In the last 12 months we collected identifiers, commercial information (plan and billing), internet activity (technical data) and professional information (shop details), for the purposes listed above.

Residents of other US states with privacy laws, such as Virginia, Colorado, Connecticut and Texas, have similar rights, including the right to appeal a refusal. Reply to our decision through the same contact route and ask for an appeal.

United Arab Emirates (PDPL)

Under Federal Decree-Law No. 45 of 2021 you have the right to receive information about the processing of your data, to access and obtain a copy, to request correction or completion, to request erasure, to restrict processing, to object to processing (including for direct marketing), and to data portability where the law provides it. You may also withdraw consent at any time without affecting earlier processing. If you are not satisfied with our response, you may complain to the UAE Data Office. Data held in free zones with their own data protection regimes may be subject to those rules.

Pakistan

Pakistan does not yet have a comprehensive personal data protection law in force. A Personal Data Protection Bill has been drafted but has not been enacted at the time of writing. We nonetheless give Pakistani users the same rights described above and follow recognized good practice: collecting only what we need, keeping it secure, and not selling it. We also comply with the Prevention of Electronic Crimes Act, 2016 (PECA), including its provisions on unauthorized access to information systems and data.

Florists’ own customers

If you are a florist using GetFloristPOS, you are responsible for having a lawful basis to collect your customers’ data, for giving them your own privacy notice, and for answering their requests. We will help you answer access, correction, deletion and export requests using the tools in the service, and by assisting you where you ask.

Children

This website and the service are for businesses. They are not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, tell us and we will delete it.

Marketing choices

You can unsubscribe from marketing emails using the link in any of them, or reply STOP to marketing texts. Service messages, such as invoices and security notices, will still be sent while you have an account.

Changes to this policy

We will update this page when our practices or the law change, and change the date at the top. If a change is significant, we will tell account holders before it takes effect.

How to contact us

For any privacy question or request, use the contact form at /contact, or the privacy address shown via the Show email button on /contact. You can also use the Data Request page. Please say which country you are in, so the right desk and the right law apply.