Data Processing Agreement

Last updated November 9, 2026

For florists whose couples are covered by EU or UK data protection law. It is part of our Terms of service and applies automatically, with nothing to sign. If you would like a signed copy, write to hello@flowery.co.

1. Who this agreement is between

This agreement is between Hydrangea Bloom, LLC, an Iowa company that operates Flowery ("Flowery", "we"), and the florist or studio that holds a Flowery account ("the Studio", "you"). It applies when Flowery handles personal data for you and EU, EEA or UK data protection law applies to that data. If this agreement and the Terms disagree about personal data, this agreement wins.

2. What the words mean

"Data Protection Law" means the EU General Data Protection Regulation and the national laws that apply it, and the UK GDPR and the Data Protection Act 2018, wherever each applies. "Controller", "processor", "personal data", "personal data breach" and "data subject" have the meanings given in that law. "Couple Data" means the personal data described in Schedule 1. "Sub-processor" means another company we use to handle Couple Data. "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

3. Who is responsible for what

You are the controller of Couple Data: you decide why it is collected and how it is used. Flowery is your processor. You are responsible for having a lawful reason to collect Couple Data, and for telling couples about it, including that it is handled by Flowery and stored in the United States. Your calculator can show a privacy notice with a link to your own Privacy Policy by the Send button, and can ask couples to tick that they agree.

Flowery is the controller of the account and billing details of the Studio itself, as described in our Privacy Policy. This agreement does not cover those.

4. How we handle Couple Data

We only handle Couple Data on your documented instructions, unless the law requires otherwise, in which case we will tell you first unless the law forbids it. Your instructions are this agreement, the Terms, and what you do in Flowery. If we believe an instruction breaks Data Protection Law, we will tell you.

We do not sell Couple Data, share it with advertisers, or use it to train anything.

5. Our people

Everyone we allow to handle Couple Data is bound to keep it confidential. Access is limited to what is needed to run and support Flowery.

6. Sub-processors

You give us general permission to use Sub-processors, starting with those in Schedule 2. We will give you at least 30 days' notice by email before adding or replacing one. If you object on reasonable data protection grounds and we cannot resolve it, you may close your account and receive a refund of any prepaid, unused subscription fees.

We have a written contract with each Sub-processor that protects Couple Data to the same standard as this agreement. We remain responsible to you for what they do.

7. Security

We keep the measures in Schedule 3 in place and may improve them. No system is perfectly secure, and you are responsible for keeping your own sign-in safe.

8. Breaches

If we become aware of a personal data breach affecting Couple Data, we will tell you without undue delay, and within 48 hours, at your account email. We will tell you what we know: what happened, what data and how many people are likely affected, and what we are doing about it. We will give you further details as we learn them, so that you can meet your own duties, including telling a regulator within 72 hours where the law requires it. Telling you is not an admission of fault.

9. Data stored outside the EU and UK

Couple Data is stored and processed in the United States, and Sub-processors may handle it in the places listed in Schedule 2. You agree to this.

From the EU or EEA: the SCCs, Module Two (controller to processor), form part of this agreement, with the choices in Schedule 4. You are the data exporter and we are the data importer.
From the UK: the UK Addendum applies to those SCCs, with the choices in Schedule 4.

If the SCCs or the UK Addendum disagree with anything else in this agreement or the Terms, they win.

10. Helping you, and deleting data

We will give reasonable help with requests from couples to see, correct or delete their data, and with your own security and impact assessments. You can see, change, export and delete most Couple Data yourself in Flowery. If we receive a request directly from a couple, we will pass it to you and not answer it ourselves unless you ask us to.

When your account closes, you can export your data first. We then delete Couple Data from live systems within 30 days and from backups within 90 days, unless the law requires us to keep it.

11. Showing that we comply

On reasonable written request, we will give you the information you need to show this agreement is being followed, and will allow and contribute to audits by you or an independent auditor you choose, on reasonable notice, no more than once a year unless a breach or a regulator requires it.

12. Liability

Each party's responsibility under this agreement is subject to the limits in the Terms. Nothing here limits what cannot be limited by law, or either party's direct duties to couples or regulators under the SCCs.

13. How long this lasts, and the law that applies

This agreement lasts as long as we hold Couple Data for you. It is governed by the laws of the State of Iowa, except where the SCCs or the UK Addendum set their own law and courts, as in Schedule 4. We may update this agreement and will give notice by email of any significant change.

Schedule 1: The data we handle

Subject matter and purpose: providing Flowery to the Studio: calculators, inquiries, leads, proposals, contracts, payments, invoices and messages.

What we do with it: store, organise, display, email, export and delete it, as the Studio directs.

How long: while the Studio's account is open, as in section 10.

Whose data: couples and customers of the Studio, and any delivery recipients the Studio or its customer enters.

Where it comes from	What is collected
Calculator and inquiry form	Name, email, phone, wedding date, venue, Pinterest link, notes, items chosen, estimate range, and, if the Studio turns on its privacy notice tick box, that the couple ticked to agree
Calculator session	Items tried and the page used, not linked to a person until they send an estimate
Proposal link	When it was opened, and messages sent through it
Signing	Typed name, time, internet address, browser, a copy of what was signed
Payments	Amount, date, Stripe's reference. Card numbers go only to Stripe
Invoices	Customer name and email, items, photo, and for deliveries who it is to, address, phone, card message, date and time
Studio's own entries	Private notes and anything else the Studio types or uploads, including photos

Flowery is not designed for special category data, such as health or religious beliefs. Please do not enter it.

Schedule 2: Sub-processors

Company	What it does	Where
Supabase	Database, sign-in, photo storage	United States (Ohio)
Netlify	Website, the code behind it, weekly backups	United States
Resend	Sends emails such as estimates, proposals and receipts	United States
Stripe	Card payments and payouts	United States
Google (Workspace)	Our support email and any couple details that reach it	United States
Google Fonts	Typefaces on Flowery pages, which receives a visitor's internet address	United States
Apple and Google push services	Carry phone alerts to the Studio, encrypted so they cannot read them	United States
Anthropic	AI assistant the Flowery team uses to run and support Flowery, which can see Couple Data while helping with support or fixing a problem	United States

Schedule 3: Security measures

Connections to Flowery are encrypted.
Access rules in the database keep each Studio's data separate from every other Studio's.
Passwords are stored only as one-way hashes by our sign-in provider.
Card numbers never touch Flowery. They go directly to Stripe.
Proposal and invoice pages are reached only through long private links, and are hidden from search engines.
Database copies are made weekly and kept for 12 weeks. Photo copies are removed from backups within 11 weeks of being deleted in Flowery. Supabase also keeps its own recent backups.

Schedule 4: Transfer terms

EU Standard Contractual Clauses, Module Two (controller to processor)

Clause 7 (docking clause): does not apply.
Clause 9(a) (sub-processors): Option 2, general written authorisation, with at least 30 days' notice of changes, as in section 6.
Clause 11(a) (complaints): the optional independent dispute resolution wording does not apply.
Clause 13 (supervisory authority): the authority of the EU member state where the Studio is established. Where the Studio is not established in the EU, the authority of the member state where the couples whose data is transferred are located.
Clause 17 (governing law): Option 1, the law of Ireland.
Clause 18 (courts): the courts of Ireland.
Annex I.A (parties): data exporter: the Studio, as a controller, with the name and contact details in its Flowery account. Data importer: Hydrangea Bloom, LLC, operating Flowery, Tiffin, Iowa 52340, United States, hello@flowery.co, as a processor. The Studio accepting the Terms counts as both parties signing.
Annex I.B (the transfer): Schedule 1 of this agreement. Transfers are continuous while the Studio uses Flowery.
Annex I.C (supervisory authority): as in Clause 13 above.
Annex II (security): Schedule 3 of this agreement.
Annex III (sub-processors): Schedule 2 of this agreement.

UK Addendum (version B1.0, issued by the UK Information Commissioner)

Table 1 (parties): as in Annex I.A above. Start date: the date the Studio first stores Couple Data in Flowery.
Table 2 (the SCCs): the Approved EU SCCs as they form part of this agreement, Module Two, with the choices above.
Table 3 (appendix information): Annexes I.A, I.B, II and III as above.
Table 4 (ending the Addendum when it changes): the importer may end it as set out in its Section 19.
The UK Addendum is governed by the law of England and Wales, and disputes about it go to the courts of England and Wales.

Contact

Hydrangea Bloom, LLC, Tiffin, Iowa 52340. Email hello@flowery.co.

Data processing agreement