Privacy policy

Last updated: June 2026

1. Controller

The controller responsible for processing personal data on this website and in our online shop is:

The Rosarium
Inhaber: Rahmat Sharifi
Horst-Schulmann-Straße 9
60314 Frankfurt am Main
Deutschland
Email: info@therosarium.de
Website: www.therosarium.de

No company data protection officer has been appointed. You may send data protection enquiries to info@therosarium.de at any time.

2. General information

We process personal data only to the extent necessary to operate our website, process orders, deliver our products, communicate with customers, comply with legal obligations, or on the basis of consent.

This Privacy Policy explains which personal data we process, the purposes for which we process it, the legal basis for the processing, the recipients to whom data is disclosed, and the rights you have.

3. Categories of personal data

Depending on how you use our online shop, we process the following data in particular:

Name, address, billing address, delivery address, email address, telephone number, order data, payment information, transaction data, customer account data, messages sent to us, complaint information, delivery instructions, greeting card texts, IP address, device and browser information, usage data, and cookie and consent data.

For orders delivered to third parties, we also process the recipient's data, in particular their name, delivery address, telephone number, delivery instructions and, where applicable, the text of a greeting card.

4. Orders and performance of contracts

When you place an order through our online shop, we process the data you provide in order to process and fulfil your order. This includes, in particular, your name, contact details, billing and delivery address, products ordered, payment method, payment status and delivery information.

The legal basis is Art. 6 Abs. 1 lit. b DSGVO insofar as the processing is necessary for the performance of the contract. Where we are legally required to retain certain data, the legal basis is Art. 6 Abs. 1 lit. c DSGVO.

5. Data relating to delivery recipients

If you have flowers or other products delivered to another person, we process the recipient data you provide, in particular their name, address, telephone number, delivery instructions and, where applicable, the content of a greeting card.

We use this data solely to fulfil the order, enable delivery and make contact if delivery problems arise. The legal basis is Art. 6 Abs. 1 lit. b DSGVO insofar as the processing is necessary to fulfil your order, as well as Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest is the proper delivery of the ordered goods.

Please do not include any particularly sensitive information in delivery instructions or greeting card texts unless this is necessary.

6. Customer account

If you create a customer account, we process the data required for this purpose, in particular your name, email address, password, address data, order history and account settings.

The data is processed to provide and manage the customer account on the basis of Art. 6 Abs. 1 lit. b DSGVO. You may have your customer account deleted at any time, provided that this does not conflict with statutory retention obligations.

7. Contact and customer service

If you contact us by email, contact form or another method, we process the data you send us in order to deal with your enquiry. This includes, in particular, your name, email address, order number, the content of your message and, where applicable, photographs submitted in connection with complaints.

The legal basis is Art. 6 Abs. 1 lit. b DSGVO if your enquiry relates to an order or a contract. In all other cases, the legal basis is Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest is dealing with customer enquiries and documenting communications.

8. Complaints

In the event of a complaint, we process the information you provide, in particular the order number, contact details, a description of the problem and photographs of the delivered goods.

The data is processed to review and deal with the complaint on the basis of Art. 6 Abs. 1 lit. b DSGVO. Insofar as processing is necessary for the establishment, exercise or defence of legal claims, it is additionally carried out on the basis of Art. 6 Abs. 1 lit. f DSGVO.

9. Payment processing

For payment processing, the data required for this purpose is transmitted to the relevant payment service provider. Depending on the payment methods offered and selected, these providers may include Shopify Payments, PayPal, credit card providers, Klarna or other payment service providers.

We do not store complete credit card details ourselves. The data is processed to carry out the payment on the basis of Art. 6 Abs. 1 lit. b DSGVO. Payment service providers may also process personal data under their own responsibility, in particular for fraud prevention, credit checks or compliance with legal obligations. The relevant payment service provider's privacy information also applies to this processing.

Please remove from this section any payment providers that are not actually used in the shop.

10. Delivery and shipping

To deliver your order, we disclose the data required for this purpose to shipping service providers, local delivery partners or partner shops. This includes, in particular, the recipient's name, delivery address, telephone number, delivery instructions and information about the order.

The legal basis is Art. 6 Abs. 1 lit. b DSGVO. Insofar as we use telephone numbers or delivery instructions to enable successful delivery, this is additionally carried out on the basis of Art. 6 Abs. 1 lit. f DSGVO.

11. Shopify

Our online shop is operated using Shopify. The provider is Shopify International Limited, Ireland, together with affiliated Shopify companies. Shopify provides us with the shop's technical infrastructure, including hosting, shopping basket, checkout, order management, security features and, where applicable, other shop functions.

When you use our shop, personal data is transmitted to and processed by Shopify. This may include, in particular, your IP address, device and browser data, usage data, order data, contact details, delivery data and payment information.

Insofar as Shopify processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 DSGVO. In certain cases, Shopify may also process data under its own responsibility, in particular to provide, secure and improve its own services, or when you use Shopify functions such as Shop Pay.

Further information is available in Shopify's Privacy Policy:
https://www.shopify.com/legal/privacy

12. Server logs and technical security

When you visit our website, technically necessary data is processed. This includes, in particular, your IP address, the date and time of access, pages accessed, the volume of data transferred, browser type, operating system, referrer URL and technical error logs.

The data is processed to provide, maintain the stability of and secure the website on the basis of Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest is the secure and functional operation of our online shop.

13. Cookies and similar technologies

Our website uses cookies and similar technologies. We distinguish between technically necessary technologies and optional technologies.

Technically necessary cookies and similar technologies are required for the shop to function. These include, in particular, the shopping basket, checkout, login, security, language settings and consent management. Such technologies are used on the basis of § 25 Abs. 2 TDDDG. The subsequent processing of personal data is carried out on the basis of Art. 6 Abs. 1 lit. b DSGVO or Art. 6 Abs. 1 lit. f DSGVO.

We use optional cookies and similar technologies, in particular for analytics, marketing, personalisation, retargeting or external media, only with your consent. The legal basis is § 25 Abs. 1 TDDDG and Art. 6 Abs. 1 lit. a DSGVO.

You may change or withdraw your consent at any time with effect for the future. You can find the relevant settings in the cookie banner or through the cookie settings link on our website.

Please ensure that this section corresponds to the cookie banner actually in use and the Shopify apps that are actually activated.

14. Analytics, advertising and tracking

Insofar as we use analytics or marketing services, we use them only after obtaining your consent. Such services may help us understand the use of our shop, display advertising, measure campaigns or show interest-based advertisements.

In particular, the data processed may include your IP address, device information, browser data, usage behaviour, purchase or shopping basket information and cookie IDs.

The legal basis is your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You may withdraw your consent at any time through the cookie settings.

Please add the services actually used here, for example Google Analytics, Google Ads, Meta Pixel, TikTok Pixel, Pinterest Tag, Klaviyo, Mailchimp or other Shopify apps. Services that are not used must not be listed.

15. Newsletter and email marketing

If you subscribe to our newsletter, we use your email address to send you promotional information about our products, offers and campaigns. Subscription takes place only with your consent. The legal basis is Art. 6 Abs. 1 lit. a DSGVO.

We may use the double opt-in procedure to confirm and document your subscription. In doing so, we store the time of registration, the IP address and the confirmation.

You may withdraw your consent at any time with effect for the future, for example through the unsubscribe link in every newsletter email or by sending a message to info@therosarium.de.

Insofar as we inform existing customers by email about our own similar goods or services, this may be done subject to the conditions of § 7 Abs. 3 UWG. You may object to this use at any time without incurring costs other than the transmission costs at the basic rates.

16. Reviews

If you submit a review, we process the data you provide, in particular your name or display name, review text, star rating, reference to an order and, where applicable, other voluntary information.

The data is processed on the basis of your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO or on the basis of Art. 6 Abs. 1 lit. f DSGVO insofar as we have a legitimate interest in authentic customer reviews and quality assurance.

If reviews are handled by an external provider, please add the provider's name and privacy information here.

17. Social media and external links

Our website may contain links to external websites, social networks or platforms. If you click such links, you leave our website. The respective provider is responsible for processing personal data on external websites.

Insofar as social media plugins, embedded content or external media are loaded directly on our website, this occurs only with your consent if non-essential cookies or similar technologies are used in the process.

18. Recipients of personal data

We disclose personal data only insofar as this is necessary or legally permitted. Recipients may include, in particular:

Shopify and technical service providers, payment service providers, shipping service providers, local delivery partners, partner shops, IT and hosting service providers, email and newsletter service providers, analytics and marketing providers after consent has been given, tax advisers, legal advisers, public authorities and other recipients where there is a legal obligation.

Where required, we enter into data processing agreements pursuant to Art. 28 DSGVO with service providers that process personal data on our behalf.

19. International data transfers

The use of Shopify and other service providers may involve the transfer of personal data to countries outside the European Union or the European Economic Area, in particular to the USA or Canada.

Insofar as data is transferred to a country for which the European Commission has not issued an adequacy decision, the transfer takes place on the basis of appropriate safeguards, in particular the European Commission's standard contractual clauses, supplementary safeguards or your express consent, where required.

20. Retention period

We store personal data only for as long as necessary for the relevant purposes or for as long as statutory retention obligations apply.

We store order data, invoices and accounting-related records in accordance with retention obligations under commercial and tax law. We store customer account data for as long as the customer account exists. We store contact and support enquiries for as long as necessary to deal with and document the enquiry. We store newsletter data until consent is withdrawn or the recipient unsubscribes. We may store evidence of consent for longer insofar as this is necessary to document consent. We store technical log data only for as long as necessary for security, error analysis and operation of the website.

Insofar as data is required for the establishment, exercise or defence of legal claims, we may store it until the statutory limitation periods expire.

21. Your rights

Subject to the statutory provisions, you have the following rights:

You have the right to obtain information about the personal data we process pursuant to Art. 15 DSGVO.

You have the right to have inaccurate data rectified pursuant to Art. 16 DSGVO.

You have the right to have personal data erased pursuant to Art. 17 DSGVO.

You have the right to restriction of processing pursuant to Art. 18 DSGVO.

You have the right to data portability pursuant to Art. 20 DSGVO.

You have the right to object, on grounds relating to your particular situation, to processing based on Art. 6 Abs. 1 lit. f DSGVO pursuant to Art. 21 DSGVO.

You have the right to withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, you may contact us at any time at info@therosarium.de.

22. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

The following authority is expected to be responsible for us:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Wilhelmstraße 7
65185 Wiesbaden
Deutschland
Telephone: 0611 1408-0
Email: poststelle@datenschutz.hessen.de
Website: https://datenschutz.hessen.de

23. Obligation to provide data

Certain personal data must be provided in order to place an order, carry out a delivery, use a customer account or communicate with us. Without this data, we may be unable to perform the relevant contract or provide the requested service.

24. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Payment service providers or fraud prevention providers may conduct their own automated checks. The relevant provider's privacy information applies to this processing.

25. Changes to this Privacy Policy

We may amend this Privacy Policy if legal requirements, our website, the services used or our data processing change. The version published on our website at the relevant time applies.