Privacy Policy

This Privacy Policy describes what personal data Buketeria (hereinafter "we", "the store", "the operator") collects when you use the buketeria.az website (hereinafter "the Site"), how we process, store, and protect it.

By using the Site or placing an order, you confirm your agreement with this Policy.

Operator details:

• Name: Buketeria
• Address: Alicabbar Orucaliyev street, 27
• Email: hello@buketeria.az
• Phone: +994 50 505 55 50

We only collect data necessary to provide our services:

• Contact details: name, phone number, email address
• Delivery details: recipient's address, name, preferred delivery time, courier comment
• Order data: items, total, payment method, postcard text
• Payment data: when paying by card, the full card details are processed by the payment gateway and are not shared with the store; when you save a card, we store only the masked number (last 4 digits), the payment scheme and a technical gateway token
• Authentication data: when signing in via third-party services (e.g. Google, Facebook) — public identifier and email from the respective service
• Technical data: IP address, browser type, cookie identifiers, pages visited
• Analytics and advertising data: analytics and advertising identifiers (e.g. Google Analytics client_id, Meta fbp/fbc), your actions and behaviour on the Site. Shared with Google and Meta as described in sections 7–8 (in the EU — with your consent; in other regions — by default, with the right to opt out).
• Geolocation: coordinates of the delivery address, determined when placing an order or when adding an address via the map

We do not collect biometric data, health data, political views, religion, or other special categories of personal data.

Processing is based on one of the following grounds:

• Performance of contract — to place, deliver, and pay for orders
• Consent — for marketing communications, as well as for analytics and advertising technologies for visitors from the EU/EEA
• Legal obligation — to retain accounting and tax records as required by Azerbaijani law
• Legitimate interest — to ensure Site security, prevent fraud, and improve service quality, as well as analytics and advertising for visitors outside the EU — by default, with the right to opt out at any time

We use your data to:

• Process and deliver orders
• Communicate with you about your order (calls, SMS, email)
• Create and manage your account
• Operate the loyalty programme and bonus system
• Send order status notifications
• Improve the Site and service quality
• Send marketing and informational messages (only with your consent)
• Comply with legal requirements

We retain data only as long as necessary to provide services and comply with legal requirements:

• Active account — your profile data and order history are retained indefinitely while you continue to use the Site. This allows you to view your purchase history, accumulate bonuses, and quickly repeat orders.
• Account deletion — you can delete your account yourself at any time in your Account settings; your personal data (name, email, phone, addresses) is anonymised immediately upon confirmation. A deletion request can also be sent to hello@buketeria.az. Order information (amounts, dates, items, without personal identifiers) is retained for an additional 5 years in accordance with the accounting and tax legislation of the Republic of Azerbaijan, after which it is fully deleted.
• Marketing consent — until consent is withdrawn (withdrawal is possible at any time).
• Security logs and cookies — from 30 days to 12 months depending on type.

After anonymisation, the data no longer permits identification and is used only in aggregated statistical form.

Under the Law of the Republic of Azerbaijan "On Personal Data" and the GDPR (for EU customers), you have the right to:

• Access your data and find out how it is processed
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten") — subject to the limitations in Section 5
• Restrict processing or object to it
• Receive your data in a machine-readable format (right to portability)
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority: in Azerbaijan — the State Register of Personal Data under the Ministry of Digital Development; in the EU — your local data protection authority

Send requests to hello@buketeria.az. We respond within 30 calendar days.

The Site uses cookies and similar technologies. Categories:

Managing consent:

• Visitors from the EU/EEA are shown a consent banner — analytical and marketing cookies are enabled only after your consent.
• In Azerbaijan and other regions outside the EU, analytical and marketing technologies are active by default; you can disable them at any time via the "Cookie settings" link at the bottom of the Site.
• Necessary cookies always work — the Site cannot function without them.
• You can change your choice at any time in "Cookie settings" or in your browser settings.

To operate the Site, we use the following data processors:

We do not sell your personal data. For analytics and advertising we share a limited set of data with Google and Meta (hashed identifiers, behaviour data on the Site) — only with active consent (for the EU/EEA) or by default with the right to opt out (for other regions, see section 7).

Some of our processors (Google, Facebook, Mapbox, Posiflora) are located outside Azerbaijan. We transfer data abroad on the basis of:

• Standard contractual data protection clauses (SCCs / Data Processing Agreements) signed with the processors;
• Compliance of the processors with applicable data protection legislation (GDPR, the Law of the Republic of Azerbaijan "On Personal Data", and equivalent regulations);
• Encryption of data in transit (HTTPS/TLS) and at rest where supported by the processor.

We minimise the volume of data transferred abroad and select processors offering robust privacy protections regardless of the customer's country.

We apply technical and organisational data protection measures:

• Connection encryption (HTTPS/TLS)
• Hashing of staff passwords (bcrypt); customers sign in without passwords — via external authentication services
• Restricted employee access on a least-privilege basis
• Regular backups
• Logging of administrator actions
• Authentication using JWT tokens

In the event of a data breach, we will notify affected users and competent authorities within the time limits set by law.

We reserve the right to update this Policy. Material changes will be published on the Site at least 30 days before they take effect. The date of the last update is shown at the top of the page.