Privacy policy

Last updated: 1 November 2026. In case of discrepancy the Spanish version prevails.

This policy explains how we process your personal data when you use the U2flor app (Android, iPhone and web) to order flowers delivered to a specific place.

1. Controller

I MAS D GLOBAL TECHNOLOGIES SL, tax ID B67951897, Calle Isabel II, 1, 28660 Boadilla del Monte (Madrid), España. Contact: info@dteav.com.

2. Data we process

• Account: email, name, your password if you sign in with one (stored encrypted by Clerk; we never see it) and, if used, Google or Apple sign-in identifiers.
• Orders: chosen bouquet, card message, dates, time slot and repetition.
• Delivery place: address or GPS coordinates of the spot marked on the map, postcode, instructions and, if added, a reference photo of the place.
• Recipient (only if there is one): the name and phone number you give us, with their knowledge.
• Payments: amount, date, status and transaction reference. Card details are handled directly by the payment provider (Stripe or Redsys); we never see or store them.
• Proof of delivery: photos taken by the florist at the place, with the time and GPS position, and the distance to the marked spot.
• Phone location: only when you tap «Use my current location» and, for florists, when taking each delivery photo. The app does not use location in the background.
• Notifications: the phone's push token, to send reminders and the delivery notice.

3. Purposes and legal bases

We do not use your data for advertising or profiling, and we do not sell data.

4. Recipients

• Partner florists who prepare and deliver the order: they see the place, instructions, card message and, if any, the recipient's name and phone. They do not see your payment data or email.
• Technology providers acting as processors under contract: Clerk (sign-in), Neon (database, hosted in the EU, Frankfurt), Vercel (server), Cloudinary (private photo storage), Expo (push notifications), Stripe and Redsys (payments), OpenStreetMap Nominatim (address search) and the map imagery provider (Esri or Mapbox).
• Public authorities and courts where required by law.

Some providers may process data outside the European Economic Area (mainly in the United States) under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

5. Delivery photos

Photos are stored privately and are only visible to the customer who placed the order, the delivering florist and U2flor's administration, through signed temporary links. Florists are asked to frame the flowers and the place, avoiding people and number plates.

6. Retention

• Account data: while the account is active.
• Orders, payments and invoices: for the period required by commercial and tax law (generally six years).
• Delivery photos: up to 24 months after delivery, unless you ask for earlier deletion.
• When you delete your account we erase your email, name, recipient data and instructions; paid orders that the law requires us to keep are retained without that data.

7. Your rights

You can request access, rectification, erasure, restriction, portability or object to processing by writing to info@dteav.com. You can delete your account in the app (Account → Delete my account) or as explained on this page. You may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Children

U2flor is intended for adults aged 18 or over. Minors must not use it or place orders.

9. Security

Communications are encrypted, payments are processed by PCI-DSS certified providers, photos are private and access to data is limited by each user's role (customer, florist or administration).

10. Changes

We will let you know in the app if this policy changes. The current version is always the one published here.