Informativa sulla privacy

Version 1.0 effective 29 October 2026

This policy explains which personal data Flowermes collects, why, how long it is kept and how to exercise your rights. It applies to anyone who uses the Service, whether they create a card (the Sender) or receive one (the Recipient).

Data controller: Kevalco, SAS with a share capital of 2 500,00 €, registered under 994 157 576 R.C.S. La Roche sur yon, 4 Le Pommeragu, 85260 Montreverd, France, hello@kevalco.com, SIRET: 994 157 576 00012

2.1 Creating and sending a card

Data: the Recipient's first name and email address, the Sender's first name and email address, written message, optional voice message, choice of flower and viewing angle.

Purposes:

• Creating the card and sending it to the Recipient
• Making the card available during its availability period
• Sending the emails related to the card (notification to the Recipient, receipt to the Sender)

Legal basis: performance of the contract.

The Recipient's data is entered by the Sender, who guarantees they have the right to provide it. The Recipient receives an email informing them that a card has been sent and may ask for their data to be deleted at any time.

2.2 Payment and tax obligations

Data: payment identifier and amount, VAT applied, country of the bank card and country deduced from the IP address.

Purposes:

• Processing the payment
• Issuing the receipt and invoices
• Evidence of the customer's country for VAT, accounting and tax management

Legal basis: performance of the contract, legal obligation.

Bank card numbers are never stored by Kevalco: they are processed by Stancer.

2.3 Connection data and security

Data: IP address.

Purposes:

• Securing the Service and fighting abuse (rate limiting)

Legal basis: legitimate interest.

2.4 Audience measurement

Statistics without cookies or individual profiling, using Plausible Analytics, hosted by Kevalco (see section 7).

Legal basis: legitimate interest.

Your data is neither sold nor shared for advertising purposes. It may be passed on to the following recipients:

• Authorised staff: Kevalco's technical and support team
• Technical providers:
• Competent authorities: only on legal request

These providers act as processors, bound by contracts guaranteeing the security and confidentiality of your data, in line with the GDPR.

Some providers may be located outside the European Union. In that case, the transfer is made with appropriate safeguards:

• European Commission adequacy decision
• Standard contractual clauses approved by the Commission
• Approved certification or code of conduct

You can obtain a copy of the appropriate safeguards by contacting us at hello@kevalco.com.

• Card (written message, voice message, Recipient and Sender contact details): 6 months from sending, then deleted
• Card being created and not paid: 7 days
• Billing and payment data: 10 years (legal accounting obligation)

At the end of these periods, your data is deleted or anonymised, unless the law requires otherwise.

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: have your data deleted under certain conditions
• Right to restriction: limit the processing of your data
• Right to portability: receive your data in a structured format
• Right to object: object to processing on legitimate grounds

To exercise your rights, contact us at hello@kevalco.com. To verify your identity, we may ask you for information that lets us find the card concerned. We will answer within one month at most. The Recipient may in particular ask for a card sent to them to be deleted.

7.1 Strictly necessary cookies

The Service only uses cookies and local storage data that are strictly necessary for it to work, which do not require prior consent:

• Resuming a card in progress: secure cookie, unreadable by scripts, limited to card creation calls, kept for 7 days, containing a random token
• Preferences: remembers the detected or chosen language
• Consent: records your answer to the information banner
• Administration session: reserved for Kevalco's team, with no effect for visitors

No tracking, advertising or behavioural analytics cookie is set.

7.2 Privacy-friendly analytics

We use Plausible Analytics, a privacy-friendly, GDPR-compliant analytics tool that:

• Sets no cookie on your device
• Collects no personally identifiable data
• Does not use fingerprinting
• Shares no data with third parties
• Only collects anonymised, aggregated statistics

No consent is required for this kind of anonymous collection.

7.3 Managing cookies

You can configure your browser to refuse all cookies. However, this will prevent you from resuming a card that is being created.

We put in place appropriate technical and organisational measures:

• Encryption of data in transit (HTTPS/TLS)
• Encryption in the database of the Recipient's contact details and the Sender's email address
• Card link made of a random token that cannot be guessed
• Administration access protected by password and two-factor authentication

In the event of a data breach likely to present a high risk to your rights, we will notify you within 72 hours in accordance with the GDPR.

Sending a card is reserved for individuals aged 18 or over. We do not knowingly collect personal data of minors from Senders. If you believe a minor has given us personal data, contact us at hello@kevalco.com so that we can delete it.

This privacy policy may be changed to reflect changes in our practices or in the regulations. The current version is the one published on this page, whose last update date appears at the top.

If you consider that the processing of your personal data does not comply with the GDPR, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority:

• CNIL, 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, France
• Phone: +33 1 53 73 22 22
• Website: https://www.cnil.fr

For any question about this privacy policy or to exercise your rights, contact us:

• Email: hello@kevalco.com
• Address: 4 Le Pommeragu, 85260 Montreverd, France

This policy supplements the Terms of Use and the Terms of Sale, available at https://www.flowermes.com.