Privacy Policy

Introduction

Isan Flowers 2 respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit the Site, place an order, sign up for our newsletter, register for an account, or otherwise interact with us. It also explains the rights available to you under applicable privacy laws, including the European Union’s General Data Protection Regulation (“GDPR“), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA“), and the California Online Privacy Protection Act (“CalOPPA“).

Our customers are located around the world, including in Europe, North America, Asia, and Australia. By using the Site, you agree to the collection and use of information in accordance with this Privacy Policy.

Who We Are

Isan Flowers 2 (“Isan Flowers 2,” “we,” “us,” or “our“) operates the website located at https://isanflowers2.com (the “Site“), which allows customers to order flowers and gifts online. Isan Flowers 2 is a sole proprietorship based in Thailand, with its address at 39/8 Moo 2, Soi Siam Country Club, Pattaya, Chonburi, 20150, Thailand.

Data Controller

The organization responsible for processing your personal data (the “data controller” under GDPR) is:
Isan Flowers 2 39/8 Moo 2, Soi Siam Country Club, Pattaya, Chonburi, 20150, Thailand Email: admin@isanflowers2.com

The third-party service providers listed in the How We Share Your Information section of this policy (such as PayPal, Stripe, Brevo, Google Analytics, Google Ads, Mouseflow, Cloudflare, and Chemicloud) act as data processors, handling personal data on our behalf and under our instructions to provide their respective services.

Information We Collect

We collect personal information through several points on the Site, described below.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see and edit that information at any time via their Account page. Website administrators can also see and edit that information.

How We Use Your Information

We use the personal information we collect for purposes including:

• Processing and fulfilling your orders, including arranging delivery of flowers and gifts to you or your designated recipient
• Sending WooCommerce transaction emails (e.g., order status, payment confirmation) to customers who place orders
• Sending email newsletters to subscribers who have asked (via Sign Up form or Checkout form) to join our newsletter mailing list. You can withdraw your consent at any time by using the Unsubscribe link in any newsletter, or contacting us, and we will stop sending you the newsletter. If you unsubscribe from our newsletter, we will mark your details as consent withdrawn for as long as we produce and distribute our newsletter, so that you do not receive newsletters in future.
• Measuring whether our transaction emails and newsletters are opened and which links within them are clicked, so we can confirm delivery, understand engagement, and improve our communications
• Responding to inquiries submitted through our Contact Form
• Creating and managing your user (member) account
• Protecting the Site from spam, fraud, and abuse (via Google reCAPTCHA v3, Cloudflare Turnstile, and Wordfence)
• Analyzing how visitors use the Site to improve its content, layout, and performance (via Google Analytics and Mouseflow)
• Running and measuring the performance of our Google Ads (pay-per-click) advertising campaigns, which bring potential customers to the Site from Google search and other Google properties
• Complying with our legal obligations, resolving disputes, and enforcing our agreements

We send emails from the Site (including transactional emails and newsletters) using Brevo, our email service provider, which we also use to create and send newsletter campaigns.

How We Share Your Information

We do not sell personal information. We may share your personal information with the following categories of third parties, solely for the purposes described in this Policy:

• PayPal – Processing PayPal payments (their Privacy Policy is at https://www.paypal.com/us/webapps/mpp/ua/privacy-full)
• Stripe – Processing credit/debit card payments (their Privacy Policy is at https://stripe.com/gb/privacy)
• Brevo – Sending transactional emails and newsletters, and tracking email opens/clicks (their Privacy Policy is at https://www.brevo.com/legal/privacypolicy/)
• Google Analytics – Website analytics (their Privacy Policy is at https://policies.google.com/privacy?hl=en-US)
• Mouseflow – Website session/behavior analytics (their Privacy Policy is at https://mouseflow.com/legal/privacy-policy/)
• Google Ads – Running CPC advertising campaigns to bring visitors to the Site, and measuring their performance (their Privacy Policy is at https://policies.google.com/privacy?hl=en-US)
• Google reCAPTCHA v3 (their Privacy Policy is at https://policies.google.com/privacy?hl=en-US)
• Cloudflare Turnstile – Spam and bot protection (their Privacy Policy is at https://www.cloudflare.com/privacypolicy/)
• Wordfence – Website security and firewall protection (their Privacy Policy is at https://www.wordfence.com/privacy-policy/)
• Chemicloud – Website hosting (servers located in Portland, Oregon, USA) (their Privacy Policy is at https://chemicloud.com/privacy-policy)
• QUIC – CDN (Content Delivery Network worldwide) (their Privacy Policy is at https://quic.cloud/privacy-policy/)
• UpdraftPlus – Website backups (their Privacy Policy is at https://teamupdraft.com/privacy/)
• Isan Flowers 2 Staff – to help fulfill orders and support you
• Third-party delivery/courier providers – Fulfilling flower and gift deliveries

These third parties process personal information according to their own privacy policies, and only to the extent necessary to provide their services to us. We may also disclose your information where required by law, to protect our rights, or in connection with a business transfer (such as a merger, acquisition, or sale of assets).

CDN and Caching

This site uses QUIC.cloud services as a CDN to process & cache your data temporarily. For their Privacy Policy, see https://quic.cloud/privacy-policy/ for more details.  A CDN is a Content Delivery Network (or Content Distribution Network). It is a geographically distributed group of servers that work together to speed up the delivery of internet content – like web pages, images, and videos – by bringing that data closer to where users are physically located.

Caching enables a faster response time and better user experience. Caching potentially stores a duplicate copy of every web page that is on display on this site. All cache files are temporary, and are never accessed by any third party, except as necessary to obtain technical support from the cache plugin vendor.  Cache files expire on a schedule set by the site administrator, but may easily be purged by the admin before their natural expiration, if necessary.

Cookies and Email Tracking Technologies

The Site uses cookies and similar technologies (via Google Analytics, Mouseflow, Google Ads, Google reCAPTCHA v3, and Cloudflare Turnstile) to operate the Site, remember your preferences, analyze traffic, protect against bots, and measure the performance of our advertising campaigns. You can control cookies through your browser settings; however, disabling cookies may affect the functionality of the Site, including your ability to complete a purchase.

Separately, our transactional and newsletter emails (sent via Brevo) contain tracking pixels and tagged links, as described in the Email Open and Link Tracking section above, which allow us to see whether an email was opened and which links were clicked.

For more information about Cookies, see our Cookie Policy.

Advertising

We do not display third-party advertisements on the Site. Instead, we run our own pay-per-click (CPC) advertising campaigns through Google Ads to bring potential customers to the Site from Google search results and other Google properties. As part of these campaigns, Google may use cookies and similar technologies to help us measure ad performance (for example, tracking when someone who clicked one of our ads later completes an order on the Site) and to inform how our ads are shown to users on Google’s own platforms. You can learn more about how Google uses this information, and managing your ad preferences, at Google’s My Ads Center.

International Data Transfers

We are based in Thailand, our website is hosted with Chemicloud on servers located in Portland, Oregon, USA. and we use QUIC.cloud services as a CDN and for caching. If you are located outside of Thailand or the United States — including in the European Economic Area (EEA), the United Kingdom, Canada, Asia, or Australia — your information will be transferred to, stored, and processed in the USA and Thailand, and potentially other countries where our service providers operate. These countries may have data protection laws that differ from those of your home country. Where required by applicable law, we take steps intended to ensure that appropriate safeguards are in place to protect your personal information when it is transferred internationally.

Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including to process your orders, comply with our legal and tax obligations, resolve disputes, and enforce our agreements. When personal information is no longer needed for these purposes, we take reasonable steps to delete or anonymize it.

Data Security

We use reasonable administrative and technical measures designed to protect your personal information, including the use of a Wordfence firewall to help protect the Site from malicious activity, and regular website backups via UpdraftPlus. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Children’s Privacy

The Site is not directed at children, and we do not knowingly collect personal information from children under the age of 13. If you believe we have inadvertently collected information from a child under 13, please contact us using the details in the Contact Us section of this policy so that we can delete it.

Your Rights Under GDPR (European Users)

If you are located in the European Economic Area or the United Kingdom, you have the following rights regarding your personal information, subject to applicable legal exceptions:

• Right of access — to obtain confirmation of, and access to, the personal information we hold about you
• Right to rectification — to request correction of inaccurate or incomplete information
• Right to erasure (“right to be forgotten”) — to request deletion of your personal information
• Right to restrict processing — to request that we limit how we use your information
• Right to data portability — to receive your personal information in a structured, commonly used format
• Right to object — to object to our processing of your personal information, including for direct marketing purposes
• Right to withdraw consent — where processing is based on consent, at any time
• Right to lodge a complaint with your local data protection supervisory authority

Our legal bases for processing your personal information include:

• Contractual necessity (e.g., processing your order)
• Consent (you explicitly give your consent to a specific kind of processing of their personal data, like Newsletter Sign Up)
• our Legitimate interests (legitimate, expected behavior of a business, like sending emails, website security, analytics)
• Compliance with legal obligations

To exercise any of these rights, please contact us using the details in the Contact Us section of this policy.

Your Rights Under CCPA/CPRA (California Residents)

If you are a California resident, the CCPA, as amended by the CPRA, gives you the following rights regarding your personal information:

• Right to know/access — the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom it is shared
• Right to delete — request deletion of personal information we have collected from you, subject to certain exceptions
• Right to correct — request correction of inaccurate personal information
• Right to opt out of sale/sharing — we do not sell personal information for monetary consideration. However, our use of Google Analytics and Google Ads conversion tracking may be considered “sharing” of personal information for cross-context behavioral advertising under the CPRA, even though we do not display third-party ads on the Site. You may opt out of this sharing by adjusting your cookie/browser settings or by contacting us using the details in the Contact Us section of this policy.
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes beyond what is necessary to provide our goods and services
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA/CPRA rights

To exercise any of these rights, please contact us using the details in the Contact Us section of this policy. We may need to verify your identity before processing your request.

CalOPPA Disclosures

In accordance with the California Online Privacy Protection Act (CalOPPA):

• This Privacy Policy is publicly accessible on our homepage and on each page where personal information is collected
• We identify the categories of personally identifiable information collected in the Information We Collect section of this policy.
• We describe our process (where applicable) for reviewing and requesting changes to your personal information in the Your Rights Under GDPR (European Users) and Your Rights Under CCPA/CPRA (California Residents) sections above
• We state how we notify users of material changes to this Privacy Policy in the Changes to This Privacy Policy section of this policy.
• We disclose our effective date of this Privacy Policy at the top of this page

To exercise any of these rights, please contact us using the details in the Contact Us section of this policy. We may need to verify your identity before processing your request.

Do Not Track Signals

Some browsers offer a “Do Not Track” (DNT) signal. Because there is not yet an accepted industry standard for recognizing and implementing DNT signals, our Site does not currently respond to browser DNT signals.

Your Choices

• Newsletter: You may unsubscribe from our email newsletter at any time by clicking the “unsubscribe” link included in every newsletter email sent via Brevo.
• 1 Year Reminder: You may cancel the 1 Year Order Reminder email at any time by contacting us.
• Account: You may review, update, or request deletion of your account information by contacting us.
• Email Tracking: Most email clients allow you to block remote/tracking images by default, which will prevent open tracking; link-click tracking can generally be avoided by not clicking links within the email.
• Cookies: You may manage or disable cookies through your browser settings and also our Cookie Banner popup. See our Cookie Policy page for more information.
• Marketing/Advertising: You can learn more about how Google uses this information, and managing your ad preferences, at Google’s My Ads Center.

Contact Us

If you have any questions or requests regarding this Privacy Policy or your personal information, please contact us at:

Isan Flowers 2 39/8 Moo 2, Soi Siam Country Club, Pattaya, Chonburi, 20150, Thailand. Email: admin@isanflowers2.com Contact Form: https://isanflowers2.com/contact-us

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the revised Privacy Policy on this page with an updated “Last Updated” date. We encourage you to review this Privacy Policy periodically. If you are a registered customer, we will notify you by email of any material changes to this Privacy Statement.