Privacy policy

Controller

INVESTME - FZCO, IFZA / DSO, Dubai Digital Park, Dubaï, Émirats arabes unis, is the controller of your personal data. Contact: info@getorchids.com.

EU representative (Article 27 GDPR): being appointed.

Optional store analytics

With your consent, we count clicks to checkout. A Shopify pixel records checkout starts and completions subject to your Shopify privacy choices. Declining analytics does not prevent a purchase.

Events contain a timestamp, a coarse device type and a pseudonymous session identifier. No name, email, address or bank details are sent to the tracker. Checkout references are hashed before transmission to prevent duplicates.

Your analytics choice (os-analytics-choice-v1) is stored for 180 days. The analytics session (os-analytics-session-v1) expires after 30 minutes without a tracked click. Your basket and functional preferences stay in your browser. You may withdraw consent through Analytics preferences in the footer.

Analytics hosting and transmission

After consent, events are sent to our analytics service hosted by Cloudflare Workers and D1. Events are retained for up to 90 days with daily deletion. IP addresses are not stored in the database; a short-lived keyed hash limits abuse. Cloudflare processes connection data to deliver and secure requests.

This international provider may process data outside the European Union under its data processing terms. Analytics relies on consent. Fonts and videos are hosted with the store. Shopify handles checkout under its own privacy policy.

Order data

When you order, Shopify collects on our behalf:

• your name and delivery address — to ship the plant and to draw up the export documents, which name the recipient;
• your email — for confirmation and tracking;
• your phone number — required by international carriers;
• order details and amount.

We never see your card details.

Legal basis: performance of the sales contract, and compliance with legal obligations (CITES, customs, accounting).

Your rights

You have rights of access, rectification, erasure, restriction, objection and portability. Write to info@getorchids.com; we answer within one month.

Some data cannot be erased on request while a legal obligation requires keeping it — the recipient's name on an issued CITES permit, for instance.

You may lodge a complaint with the data protection authority of your country of residence.