This English version is provided for convenience. The French version is the original text. Where the two differ, the French version applies, without depriving the data subject of the rights conferred by the General Data Protection Regulation.

Version in force as of 7 August 2026

This privacy and cookie policy explains how LEZARE collects, uses, stores and protects the personal data of visitors to and customers of the site lezare.fr, referred to below as the Site.

1. Data controller

The data controller is LEZARE, a Société par Actions Simplifiée Unipersonnelle with a share capital of 10 euros, registered with the Bordeaux trade register under number 107 012 569, whose registered office is at 76 avenue Jean-Jacques Rousseau, 33160 Saint-Médard-en-Jalles, France.

For any question about personal data, or to exercise a right: contact.lezare@gmail.com

2. Personal data processed

Depending on how the Site and the services offered are used, LEZARE may process the following categories of data:

• Identification data: first name and surname.
• Contact details: email address, telephone number where given, billing address and delivery address.
• Account data: Shopify customer identifier, settings, preferences and account history.
• Order data: products purchased, options selected, quantities, amounts, discounts, payment status, delivery, returns and refunds.
• Flower collection data: flowers allocated or unlocked, how many of each, acquisition history, identifiers of the associated codes, activation and revocation status, unlocking date and adjustments made by LEZARE.
• Customer relationship data: messages, requests, complaints and exchanges with LEZARE.
• Technical and security data: IP address, device type, browser, connection logs, code entry attempts and information needed to prevent fraud. The IP address is recorded by Shopify, which links it to the order for its fraud risk analysis.
• Browsing data: pages viewed, interactions with the Site, source of the visit and cookie preferences.
• Marketing communication data: consent, subscription, unsubscription and interactions with the messages sent.

Full bank details are processed directly by the payment providers offered at the time of ordering. LEZARE neither collects nor stores them.

The codes that unlock a flower are stored in encrypted form or as a cryptographic hash. They are linked to an order and, once used, to the identifier of the customer account concerned.

3. Source of the data

Data is collected:

• Directly from the person concerned when an account is created, an order is placed, a code is entered, a form is used or an exchange takes place with LEZARE.
• Automatically through use of the Site, the customer account and the My Flowers service.
• From Shopify, in particular for information relating to orders, customers, payments and shipments.
• From the providers needed for payment, delivery, hosting, security or the running of the Site.

4. Purposes and legal bases

4.1. Managing orders

Data is used to record the order, process payment, prepare the products, arrange delivery, and manage returns, refunds and guarantees. The legal basis is performance of the contract concluded with the customer.

4.2. Managing the customer account and the flower collection

Data is used to create and administer the customer account, link orders to the account, activate codes after dispatch, unlock flowers, display the collection, hold several copies of the same flower and manage corrections linked to a return, a refund or an error. The legal basis is performance of the contract and provision of the service requested by the customer.

4.3. Customer service

Data allows us to answer requests, follow up orders, handle complaints and resolve difficulties relating to codes or to the flower collection. The legal basis is performance of the contract, or the legitimate interest of LEZARE in maintaining the relationship with its customers.

4.4. Accounting and legal obligations

The necessary data is used to issue invoices, keep the accounts, respond to lawful requests from the authorities and comply with the obligations that apply to LEZARE. The legal basis is compliance with a legal obligation.

4.5. Security and fraud prevention

Technical data, code entry attempts and order data may be used to secure the Site, limit abusive attempts, prevent a code being reused, detect unusual activity and defend the rights of LEZARE. The legal basis is the legitimate interest of LEZARE in protecting its customers, its services and its systems.

4.6. Marketing communications

Where the person has consented, LEZARE may use their email address to send news, announce a collection or present products. The legal basis is consent. It may be withdrawn at any time through the unsubscribe link in every message, or by writing to contact.lezare@gmail.com.

4.7. Audience measurement, personalisation and advertising

Where tools that are not strictly necessary are enabled, browsing data may be used to measure audience, understand how the Site is used, personalise the experience or measure the effectiveness of communications and advertising. Where the rules require it, this processing rests on the prior consent of the user.

5. Whether the information is required

The information marked as required when ordering is necessary to conclude and perform the contract. Without it, LEZARE may be unable to process the order, the payment or the delivery.

Logging into the customer account and entering a valid code are necessary to unlock a flower and add it to a collection. Information used only for marketing communications or for optional cookies is not required.

6. Relationship with Shopify

The Site and the customer accounts are hosted on the Shopify platform. Shopify processes certain data to provide LEZARE with e-commerce, payment, security, hosting and account management services.

For the processing carried out in order to run the shop on behalf of LEZARE, Shopify acts on the instructions of LEZARE. For certain services offered directly to consumers, in particular Shop, Shop Pay or certain enhanced features, Shopify may act as a separate controller.

Where Shopify Network Intelligence or an equivalent feature is enabled, Shopify may use a visitor’s interactions with the shop, with Shopify and with other merchants to improve or personalise its services. Processing that is not strictly necessary remains subject to the privacy choices and to the consent of the user where consent is required.

Shopify’s consumer privacy policy is available at: https://www.shopify.com/legal/privacy/consumers

Shopify’s privacy portal is available at: https://privacy.shopify.com

7. Who receives the data

Within the limits of their duties and of the information they need, data may be accessible:

• To authorised people within LEZARE.
• To Shopify and to the entities of its group involved in providing its services.
• To the payment providers selected at the time of ordering.
• To the carriers and logistics providers responsible for delivery and returns.
• To the provider hosting the My Flowers application and its database.
• To the technical providers needed for hosting, security, maintenance, email and customer service.
• To audience measurement, communication or advertising providers where those tools are enabled and the required consent has been obtained.
• To advisers, administrative authorities, judicial authorities or legally empowered bodies where the law requires it or where it is necessary to defend the rights of LEZARE.

LEZARE does not directly sell the personal data of its customers. Certain transfers made for personalised advertising may nevertheless be characterised as a sale or a share by some foreign laws. Where a right to object applies, it can be exercised through the privacy settings available on the Site or through Shopify’s privacy portal.

8. International transfers

Shopify International Limited is established in Ireland. Shopify and certain other providers may transfer or process data outside the European Economic Area, in particular in Canada and the United States.

These transfers rest, depending on the case, on an adequacy decision of the European Commission, on standard contractual clauses, or on any other safeguard recognised by the applicable rules.

Further information about Shopify is available at: https://www.shopify.com/legal/dpa

9. Retention periods

LEZARE keeps data only for as long as is necessary for the purposes described in this policy, and then deletes or archives it where a legal obligation or the defence of a right justifies doing so.

• Order and invoicing data: for the duration of the commercial relationship, then ten years under accounting obligations.
• Customer account and flower collection data: for as long as the account is used, then until it is deleted or a right to erasure is exercised, subject to data that must be archived to meet a legal obligation or defend a right.
• Flower codes and proof of unlocking: for as long as is necessary for the collection to work and for handling returns, refunds, fraud or disputes. After the account is deleted, the direct link with the customer is removed or anonymised where no named retention is required.
• Logs of unlocking attempts and associated security data: six months at most, except where longer retention is necessary to analyse an incident, establish fraud or defend a right.
• Exchanges with customer service: for as long as is necessary to handle the request, then up to five years where retention is necessary as evidence or to defend a right.
• Data used for marketing to a customer: for the duration of the commercial relationship, then three years from the last purchase or the last contact from the customer.
• Data of a prospect who is not a customer: three years from collection or from the last contact from the prospect.
• Information needed to record an objection to marketing: three years.
• Choices about accepting or refusing cookies: six months before a new choice may be requested, unless the Site or the tools used change significantly.
• Payment method data: not kept by LEZARE and processed by the payment provider under its own obligations.

10. Cookies and other trackers

A cookie is a file or an identifier saved on, or read from, the device used to visit the Site.

10.1. Strictly necessary cookies

These cookies make the basket, checkout, account login, security, language memory and privacy preferences work. They are necessary for the Site to function and cannot be switched off through the consent mechanism.

10.2. Audience measurement cookies

Where these tools are enabled, they measure traffic and help us understand how visitors use the Site. Cookies subject to consent are only set once accepted.

10.3. Personalisation and advertising cookies

Where these tools are enabled, they may be used to personalise content, measure a campaign or offer suitable advertising. They are only set after consent where consent is required.

10.4. Managing preferences

On a first visit, the privacy banner lets you accept, refuse or choose in detail among the optional cookies. Refusing must be as easy as accepting. Preferences can be changed at any time through the cookie settings link available on the Site.

Your browser can also block or delete cookies. Blocking strictly necessary cookies may, however, prevent some features of the Site from working properly.

11. Your rights

On the conditions set by the rules, every person has the following rights:

• Right of access to their personal data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure in the cases provided by law.
• Right to restriction of processing.
• Right to object to processing based on legitimate interest.
• Right to object at any time to marketing.
• Right to data portability where that right applies.
• Right to withdraw consent at any time, without calling into question the processing carried out before that withdrawal.
• Right to give directions on what happens to their data after their death, on the conditions set by French law.

Requests should be sent to contact.lezare@gmail.com, stating which right is being exercised. LEZARE may ask for proof of identity only where that is necessary to verify who is making the request. An answer is given within the legal period, in principle one month from receipt of a complete request.

The person concerned may also lodge a complaint with the Commission Nationale de l’Informatique et des Libertés, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at https://www.cnil.fr.

12. Security

LEZARE and its providers put in place reasonable technical and organisational measures to protect data against destruction, loss, alteration, disclosure or unauthorised access.

Flower codes are protected by encryption and hashing. Unlocking attempts are rate limited to reduce the risk of fraud and automated attack.

As no transmission or storage of data on the internet can be guaranteed to be entirely secure, users should protect their credentials and report any suspicious activity.

13. Third party sites and services

The Site may contain links to sites or services operated by third parties. Their use is subject to their own privacy policies. LEZARE is not responsible for the privacy or security practices of services it does not control.

14. Minors

The Site and the sales offered are not intended for minors ordering on their own. LEZARE does not knowingly seek to collect personal data from children.

15. Changes to this policy

LEZARE may update this policy to take account of changes to the Site, to the My Flowers application, to the providers used, to Shopify settings or to the applicable rules. The date of the version in force is shown at the top of the page.

16. Contact

For any question about this policy, about the privacy practices of LEZARE or about exercising a right, you can write:

• By email: contact.lezare@gmail.com
• By post: LEZARE, 76 avenue Jean-Jacques Rousseau, 33160 Saint-Médard-en-Jalles, France