Privacy Policy
How Bloematelier Merlijn handles personal data under the AVG (GDPR).
Last updated: 25 July 2026
Bloematelier Merlijn (“we”, “us”) operates the website rappepiage.autos and the florist shop at Haarlemmerstraat 84, 2312 GD Leiden, Netherlands. We respect your privacy and process personal data in accordance with the General Data Protection Regulation (AVG / GDPR) and Dutch law.
1. Data controller
Bloematelier Merlijn
Haarlemmerstraat 84, 2312 GD Leiden, Netherlands
Email: [email protected]
Phone: +31 71 512 38 46
2. Which data we process
Depending on how you contact us, we may process:
- Name, email address, phone number, and message content from contact or order forms
- Delivery address and order details when you request flowers or a subscription
- Technical data such as IP address, browser type, and pages visited (if analytics cookies are accepted)
- Cookie preference choices stored in your browser
3. Purposes and legal bases
- Responding to enquiries and fulfilling orders — performance of a contract or steps prior to a contract (Art. 6(1)(b) GDPR)
- Running the website and remembering cookie choices — legitimate interest / consent for non-essential cookies (Art. 6(1)(f) and 6(1)(a))
- Optional analytics — only with your consent (Art. 6(1)(a))
- Legal obligations — for example bookkeeping where applicable (Art. 6(1)(c))
4. Sharing of data
We do not sell your personal data. We may share data with service providers who help us operate email, hosting, or delivery, only as needed for those services and under appropriate agreements. We may disclose data if required by law.
5. Retention
Contact messages are kept as long as needed to handle your request and for a reasonable follow-up period (typically up to 12 months, unless a longer period is needed for an ongoing order or legal duty). Order and invoice data may be retained for the statutory retention period under Dutch law (generally up to 7 years for financial records).
6. Your rights
Under the AVG you may request access, rectification, erasure, restriction of processing, data portability, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.
To exercise your rights, email [email protected]. You also have the right to lodge a complaint with the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens
Website: autoriteitpersoonsgegevens.nl
Postal address: Postbus 93374, 2509 AJ Den Haag, Netherlands
7. Security
We take appropriate technical and organisational measures to protect personal data against loss and unlawful processing. No method of transmission over the internet is completely secure; please avoid sending highly sensitive information by unencrypted email.
8. Children
Our services are aimed at adults. We do not knowingly collect personal data from children under 16 without parental authority.
9. Changes
We may update this policy from time to time. The latest version will always be published on this page with an updated date.