PRIVACY POLICY
Last updated: October 18, 2026
1. Purpose of the Policy and Data Controller
This Privacy Policy informs users of the website www.lesfleursdavalys.com about the conditions under which their personal data is collected and processed.
It has been drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Law No. 78-17 of 6 January 1978, as amended.
The data controller is :
AVALYS
French Limited Liability Company (SARL) with a share capital of €7,500
Nanterre Trade and Companies Register (RCS): 508 000 171
SIRET Number: 508 000 171 00019
5 Rue de Longchamp
92200 Neuilly-sur-Seine, France
Phone: +33 6 19 51 56 51
Email : lesfleursdavalys@gmail.com
2. Personal Data Collected
Depending on how the website is used and the services requested, AVALYS may process the following data:
Identification and Contact Details : Last name, first name, title (where applicable), email address, telephone number, billing address, and delivery address.
Order Information : Products ordered, amounts, order history, payment method and status, delivery or pickup date and time slot, special instructions, and communications relating to the order.
Recipient Information : Name, delivery address, telephone number, access code, floor number, and any other information necessary for the delivery of the flowers.
Personalized Messages : Messages provided by the customer to accompany a floral arrangement.
Account Data :Information necessary for creating and using a customer account, where such an account has been created.
Technical Data : IP address, browser and device information, connection data, and information related to cookies or similar technologies, depending on the features used.
Correspondence : Information provided when contacting AVALYS by email, telephone, or any other available means of communication.
Les données demandées comme obligatoires lors de la commande sont nécessaires à son traitement. Leur absence peut empêcher la validation ou la bonne exécution de la commande.
All other information is optional, unless otherwise indicated.
AVALYS does not request sensitive personal data within the meaning of Article 9 of the GDPR. Users are advised not to provide such information, particularly in personalized messages or delivery instructions.
3. Information Concerning Flower Recipients
When an order is intended for a third party, the customer provides the information necessary for its delivery.
The customer is requested to provide only accurate, relevant information necessary for fulfilling the order and to ensure that they are authorized to share it.
AVALYS uses this information to prepare, organize, and carry out the delivery, contact the recipient when necessary, and manage any difficulties encountered during delivery.
The recipient’s information is not used for direct marketing purposes solely on the basis of its disclosure by the customer.
AVALYS takes care not to disclose the customer’s personal information unnecessarily to the recipient, except for information required to fulfill the order, details included in the personalized message, and disclosures required by applicable law.
4. Purposes and Legal Bases for Data Processing
Personal data is processed for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Order Management, Product Preparation, Pickup, and Delivery | Performance of a Contract |
| Management of Customer Accounts and Pre-Contractual Requests | Performance of a Contract or Pre-Contractual Measures |
| Payment Processing and Transaction Tracking | Performance of a Contract and, depending on the processing activity, Compliance with Legal Obligations |
| Invoicing, Accounting, and Tax Obligations | Legal Obligation |
| After-Sales Service, Complaints, and Request Management | Performance of a Contract or Legitimate Interest, Depending on the Circumstances |
| Website Security, Prevention of Abuse and Fraud | Legitimate Interest, Subject to Individuals’ Rights and Other Applicable Legal Bases |
| Management of Legal Disputes and Protection of AVALYS’s Rights | Legitimate Interest or Legal Obligation, as Applicable |
| Handling Requests to Exercise Data Protection Rights | Legal Obligation |
| Electronic Marketing Communications, Where Applicable | Consent Where Required, or Another Legal Basis Permitted by Applicable Regulations |
| Non-Essential Cookies and Technologies Requiring Consent | Consent, Where Required |
Processing activities based on legitimate interests are carried out only to the extent necessary to pursue AVALYS’s legitimate interests, taking into account the rights and freedoms of the individuals concerned.
Where consent is the legal basis for processing, it may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.
5. Data Recipients and Service Providers
Personal data is accessible to authorized personnel within AVALYS, to the extent necessary for the performance of their duties.
They may also be disclosed, as necessary, to the following categories of recipients:
payment service providers, including Stripe ;
hosting service providers, including o2switch ;
technical service providers involved in the operation, maintenance, or security of the website;
email and communication service providers necessary for order processing;
service providers involved in carrying out deliveries, where applicable;
professional advisers, chartered accountants, and authorized bodies, where necessary;
administrative or judicial authorities in cases provided for by law.
The website uses, in particular, WordPress and WooCommerce for its operation and order management.
Personal data is disclosed only to the extent necessary for the relevant purposes or in accordance with legal obligations.
Service providers acting as data processors are subject to applicable data protection obligations. Certain service providers may act as independent data controllers for specific processing activities, in accordance with their own legal obligations.
AVALYS does not sell its customers’ personal data.
6. Secure Payments
Online payments are processed using the services of Stripe, depending on the payment methods available on the website.
The information required for the transaction is transmitted and processed through the payment systems used.
AVALYS ne stocke pas les numéros complets des cartes bancaires ni les cryptogrammes de sécurité sur ses propres serveurs.
Certain transaction-related information, such as transaction amounts, statuses, or reference numbers, may be retained for order management, accounting, fraud prevention, and compliance with legal obligations.
Payment transactions are also subject to the terms and conditions and privacy policy of the relevant payment service provider.
7. Data Retention Periods
Personal data is retained for a period proportionate to the purpose for which it was collected, then deleted, anonymized, or, where legally justified, placed in intermediate storage with restricted access.
The main data retention rules are as follows:
Order Data: For the period necessary to fulfill the order, manage the customer relationship, and, where justified, handle complaints and any potential disputes.
Invoices and Supporting Accounting Documents: For the applicable statutory retention period, generally ten years from the end of the relevant financial year.
Customer Account Data: For the period necessary to manage the account, and thereafter in accordance with retention periods justified by the purposes pursued and applicable legal obligations.
Correspondence and Requests Submitted to AVALYS: For the period necessary to process them and, where necessary, to document the actions taken or defend AVALYS’s rights.
Direct Marketing Data: In accordance with the retention periods and conditions established by applicable regulations.
Cookies and Tracking Technologies: Depending on their purpose, nature, and the retention periods specified in the Cookie Policy.
Deleting an account or submitting a request for erasure does not necessarily result in the deletion of information whose retention remains required or permitted by applicable regulations.
8. Data Transfers Outside the European Economic Area
Certain technical or payment service providers may process personal data outside the European Economic Area.
Where such transfers take place, they must be based on a mechanism authorized under the GDPR, including an adequacy decision by the European Commission or appropriate safeguards such as Standard Contractual Clauses, supplemented by additional measures where necessary.
Additional information regarding the relevant data transfers and applicable safeguards may be requested from AVALYS.
9. Security and Confidentiality
AVALYS implements appropriate technical and organizational measures, proportionate to the risks associated with data processing, to safeguard the confidentiality, integrity, and availability of personal data.
These measures may include access controls, the use of secure connections, maintenance of IT systems, and the use of specialized service providers.
Access to personal data is restricted to individuals who need it for authorized purposes.
Despite the protective measures implemented, no IT system can guarantee the complete absence of risks.
This statement does not limit AVALYS’s security and notification obligations under applicable regulations.
10. Cookies and Similar Technologies
The website uses cookies and similar technologies necessary for its operation, particularly for managing the shopping cart, sessions, preferences, and certain security features.
Other cookies or tracking technologies may be used depending on the features and services actually enabled on the website.
Where applicable regulations require the visitor’s prior consent, the relevant cookies are only stored on or accessed from the visitor’s device after such consent has been obtained.
Visitors can accept, reject, or modify their preferences using the cookie management tool available on the website, particularly through Complianz.
Further information about cookie categories, their purposes, and their retention periods is available in the Cookie Policy du site.
11. Rights of Data Subjects
In accordance with the GDPR and applicable French legislation, data subjects have the following rights, subject to the conditions established by law:
Right of access to personal data;
Right to rectification of inaccurate data;
Right to erasure where the legal requirements are met;
Right to restriction of processing;
Right to object to processing in cases provided for by applicable regulations;
Right to data portability, where applicable;
Right to withdraw consent where processing is based on consent;
Right to provide instructions regarding the handling of their personal data after their death, in accordance with French law.
These rights are not absolute and may be subject to the conditions, exceptions, and limitations provided for by law.
Any request may be sent to:
AVALYS
5 Rue de Longchamp
92200 Neuilly-sur-Seine, France
Email : lesfleursdavalys@gmail.com
To prevent the disclosure of personal data to unauthorized individuals, AVALYS may request additional information necessary to verify the applicant’s identity where reasonable doubt exists.
Requests are processed within the statutory time limits. Exercising these rights is generally free of charge, subject to the exceptions provided for by applicable regulations, particularly in the case of manifestly unfounded or excessive requests.
Data subjects may also lodge a complaint with the French Data Protection Authority (CNIL) :
AVALYS encourages data subjects to contact it first to seek an appropriate solution, although doing so is not a mandatory prerequisite for lodging a complaint with the CNIL.
12. Additional Provisions and Amendments to the Policy
Personal Data Relating to Minors
The website is not intended to specifically collect personal data from children. Where AVALYS becomes aware of a situation involving minors’ personal data, it will assess the appropriate measures in accordance with applicable regulations.
Links to Third-Party Websites
The website may contain links to services or websites operated by third parties. These third parties may apply their own privacy policies when acting as independent data controllers.
AVALYS does not control the practices of these independent websites. This provision does not limit AVALYS’s responsibilities under applicable law.
Changes to the Privacy Policy
AVALYS may amend this Privacy Policy to reflect, in particular, legal, regulatory, technical, or organizational changes.
The version in effect is the one published on the website, subject to applicable notification requirements in the event of changes to data processing activities.
For any questions regarding this Privacy Policy or the processing of personal data, users may contact AVALYS at the address provided in Section 11.
