Privacy Policy

1. Data controller

The data controller is Fiorista Pasquale Carrella — Italian VAT no. 04888730654 — via Torrione 111, Salerno (SA), Italy — info@carrellafloraldesign.com. For privacy-related enquiries, please contact the email address above.

2. Scope of this notice

This notice explains how personal data are processed when visitors use www.carrellafloraldesign.com, submit the contact form or reach the business through links displayed on the website. Once a visitor independently accesses a third-party service, that service’s own privacy information may also apply.

3. Personal data we process

Information provided by visitors may include full name, email address, telephone number, enquiry category, event date and location, message text and any additional details entered in the form. Technical browsing data may include IP addresses, request dates and times, identifiers and security or server logs, depending on the services actually enabled. See our Cookie Policy for cookies and similar technologies.

4. Purposes and lawful bases

Responding to enquiries, discussing bespoke floral projects, preparing quotations, arranging appointments and providing workshop information: Article 6(1)(b) GDPR, where processing is necessary to take steps requested before entering into a contract; otherwise Article 6(1)(f) GDPR, our legitimate interest in managing enquiries. Compliance with applicable legal obligations: Article 6(1)(c) GDPR. Website security and abuse prevention: Article 6(1)(f) GDPR, subject to appropriate safeguards. Optional analytics or marketing activities, if introduced, will be separately disclosed and based on consent whenever required. Submitting an enquiry does not automatically subscribe you to marketing communications.

5. Whether information is required

Fields marked as mandatory are needed to handle the enquiry. If they are not completed, we may be unable to respond. Optional details help us provide a more relevant response. Please avoid submitting sensitive personal information, such as health information, unless strictly necessary.

6. How information is handled and protected

Personal data are handled electronically and, where needed, through internal organisational processes by authorised individuals. The controller applies security and access controls proportionate to the associated risks. No online service can guarantee absolute security.

7. Recipients and service providers

Personal data may be processed by the controller and authorised individuals, as well as service providers necessary for operating and securing the website and managing communications. These include Aruba, used for the website's hosting and domain email service; WordPress, as the website platform; WPForms Lite, to collect enquiries and send form submissions by email; and WP Mail SMTP, to authenticate the sending of messages through the configured email service. Technical providers may process information within the scope of their services, subject to their respective roles and applicable arrangements. The controller does not sell personal data or make it available indiscriminately.

WPForms Lite Connect is disabled: its remote form-entry backup feature on WPForms servers is not used. Technical logs, hosting backups and copies of messages in the email mailbox may still exist depending on the services in use.

8. WhatsApp and external links

The website uses Joinchat to display a WhatsApp contact window, which may open automatically, and to allow visitors to choose whether to start a conversation. A check performed on the website identified a browser localStorage item named joinchat_views, which records how many times the widget has been displayed and helps control its behaviour. This is local browser storage rather than a cookie; it is also addressed in the Cookie Policy.

Simply seeing the contact window does not mean that a WhatsApp message has been sent. If a visitor chooses to start a conversation, WhatsApp is used as an external messaging service governed by its own privacy notice. Information voluntarily shared in the chat, including a telephone number, messages and any attachments, is processed by the controller to respond to the enquiry and manage any subsequent relationship. Please refer to WhatsApp's privacy notice for information about processing carried out by WhatsApp.

9. Retention

Enquiries received through the contact form, by email or via WhatsApp which do not lead to a contractual relationship are retained for no longer than 24 months after the last communication, unless a documented need to protect legal rights or an applicable legal obligation requires otherwise. At the end of the applicable period, personal data must be deleted or anonymised in accordance with the controller's actual procedures.

If an enquiry leads to a contractual or business relationship, or to accounting or tax documents, the relevant data are kept for the duration of the relationship and for any subsequent period required by applicable law or necessary to protect legal rights. Technical logs and backups are retained according to their security and recovery purposes and the relevant providers' settings. Cookie choices and local browser storage are described in the Cookie Policy.

10. International transfers

The website primarily uses Aruba hosting and email services. If a visitor chooses to use WhatsApp, they interact with an external provider which may process information through international infrastructure and operations, in accordance with its own privacy notice and stated safeguards. Where personal data are transferred outside the European Economic Area, the transfer must comply with Chapter V of the GDPR, relying on an adequacy decision or other applicable safeguards as appropriate. Visitors may contact the controller using the email address in section 1 for information about relevant safeguards and available documentation.

11. Your rights

Subject to the GDPR’s conditions, you may request access, rectification, erasure, restriction, portability or object to processing, and withdraw consent where processing relies on consent without affecting earlier lawful processing. Contact info@carrellafloraldesign.com. You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

12. Automated decisions and updates

Routine contact enquiries are not subject to decisions based solely on automated processing that produce legal or similarly significant effects. We will update this notice if the website’s services, providers or processing purposes change. Last updated: 30 October 2026.