Privacy Policy

Last updated: 17 September 2026

Florence Flower School respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains what personal information we collect when you visit our website, contact us, enquire about our courses, register for a course or purchase a course, why we collect it, how we use it, how long we keep it and how you can ask us to access, correct or delete your information.

This Privacy Policy applies to [www.florenceflowerschool.com] and any related forms, booking or payment pages operated by Florence Flower School.

1. Who is responsible for your data?

The data controller responsible for your personal data is:

Florence Flower School
Legal name: FunkyBird di Sonja de Graaf
Address: Via Erbosa 117, 50126, Firenze, Italy
Email: funkybirdfirenze@gmail.com
VAT / tax identification number: IT06096660482

For privacy-related questions or requests, you can contact us at funkybirdfirenze@gmail.com

2. What personal information do we collect?

Depending on how you use the website and our services, we may collect:

When you contact us or make an enquiry

Your name
Email address
Telephone number, if you provide it
The content of your enquiry and any other information you choose to include

When you apply for or register for a course

Your name and contact details
Billing and invoicing information
Course and booking details
Information relevant to your participation in the course
Information you voluntarily provide about your experience, background or professional interests

When you make a payment

Information needed to process your purchase and issue an invoice
Transaction details such as the amount paid, date and course purchased

We do not normally receive or store your full payment card details. Payments are processed through the payment provider used on our website.

When you use our website

IP address
Browser and device information
Pages visited and interactions with the website
Approximate location based on technical information
Information collected through cookies and similar technologies

The exact information collected depends on the cookies, analytics and other services currently installed on the website.

We ask you not to send us sensitive personal information unless it is necessary for a specific purpose and we have provided you with an appropriate way to do so.

3. Why do we collect your information?

We use your personal information for the following purposes:

To respond to enquiries and requests
To provide information about our courses and services
To process course registrations and payments
To manage your participation in a course
To communicate with you about your course, including practical information, schedules and updates
To issue invoices and maintain accounting records
To provide certificates or other course documentation where applicable
To arrange course-related administration, including placements or other activities where relevant to the course
To improve our website, courses and services
To send marketing communications where you have given us permission to do so, or where otherwise permitted by law
To comply with legal, tax and accounting obligations
To protect our website, business and users against fraud, misuse or security incidents

We only collect and use personal data that is relevant and necessary for these purposes. This reflects the GDPR principle of data minimisation.

4. Legal basis for processing your data

Depending on the circumstances, we process your personal data on one or more of the following legal bases under the GDPR:

Contract: when processing is necessary to provide a course or service you have purchased or to take steps at your request before entering into a contract.

Legal obligation: when we are required to keep information for tax, accounting or other legal purposes.

Legitimate interests: when processing is necessary for the operation, security and improvement of our business and website, provided that your rights and interests do not override those interests.

Consent: where you have specifically agreed to a particular use of your information, such as certain marketing communications or non-essential cookies.

Where we rely on consent, you can withdraw that consent at any time.

5. Who may receive your information?

We do not sell or rent your personal information.

Your information may be shared with trusted service providers where this is necessary to operate Florence Flower School, process your booking or provide the services you have requested.

Depending on how the website and school are operated, these may include:

Website hosting and website management providers
Payment processors
Email and communication providers
Accounting and invoicing providers
Course administration or booking platforms
IT, security and technical service providers
Professional advisers where necessary
Public authorities where disclosure is required by law

These providers may process personal data only for the purposes for which they have been engaged and, where applicable, under appropriate data-processing agreements.

We may also disclose information where necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

6. International transfers

Some of the service providers we use may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we take appropriate steps to ensure that the transfer is made in accordance with applicable data protection law, including where appropriate the use of an adequacy decision or appropriate safeguards such as Standard Contractual Clauses.

7. How long do we keep your information?

We keep personal information only for as long as it is necessary for the purpose for which it was collected, unless a longer period is required by law. GDPR requires organisations to limit retention to what is necessary for the relevant purpose.

Our general retention periods are:

Course enquiries:
We normally keep enquiry information for up to 24 months after our last communication with you, unless you become a customer or there is another reason to retain it.

Course registration and student information:
We normally retain information relating to your course participation for as long as reasonably necessary to administer the course and provide appropriate follow-up documentation, generally for up to 5 years after completion.

Invoices and financial records:
We retain these for the period required by applicable Italian tax and accounting legislation.

Marketing information:
If you have subscribed to receive marketing communications, we retain your contact details until you unsubscribe or withdraw your consent. We may retain a minimal record of your request to unsubscribe so that we can respect it in the future.

Website and technical information:
Retention depends on the specific analytics, hosting and cookie services used on the website.

When information is no longer required, we will delete it or anonymise it where appropriate.

8. Cookies

Our website may use cookies and similar technologies.

Some cookies are necessary for the website to function correctly. Other cookies may be used for analytics, website performance, preferences or marketing, depending on the services currently installed on the website.

Where required by law, we will ask for your consent before placing non-essential cookies on your device.

You can manage or withdraw your cookie preferences through the cookie settings provided on the website and through your browser settings.

For more information, please see our [Cookie Policy / Cookie Settings].

9. Your rights

Under the GDPR, you have a number of rights concerning your personal data.

Depending on the circumstances, you may have the right to:

Ask what personal information we hold about you
Request a copy of your personal information
Ask us to correct inaccurate or incomplete information
Ask us to delete your personal information
Ask us to restrict how we use your information
Object to certain types of processing, including direct marketing
Withdraw consent where processing is based on consent
Request portability of certain personal information
Lodge a complaint with the relevant data protection authority

The right to deletion is not absolute. For example, we may need to retain certain information where we have a legal obligation to do so or where it is necessary to establish, exercise or defend legal claims.

10. How to request deletion or access to your information

You can request access, correction, deletion or restriction of your personal data by contacting us at:

[privacy email address]

Please write "Privacy Request" in the subject line and tell us what you are requesting. For a deletion request, you can simply write:

I would like to request the deletion of the personal data Florence Flower School holds about me.

We may need to ask for reasonable information to verify your identity before completing a request.

We will respond to your request without undue delay and, in principle, within one month. In certain circumstances, this period may be extended by up to two further months where permitted by the GDPR.

11. Marketing communications

If you choose to receive news, course announcements or other marketing communications from Florence Flower School, we may use your name and email address for this purpose.

You can unsubscribe at any time by clicking the unsubscribe link included in our emails or by contacting us directly.

You do not need to give a reason for unsubscribing.

12. Security

We take reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.

However, no method of transmitting or storing information online can be guaranteed to be completely secure.

13. Children's privacy

Our courses and services are intended for adults unless otherwise stated.

We do not knowingly collect personal information from children for the purpose of providing services without appropriate consent where such consent is legally required.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, technology or legal requirements.

The latest version will always be published on this page, with the date of the latest update shown at the top.

15. Complaints

If you believe that your personal data has been handled in a way that does not comply with applicable data protection law, please contact us first so that we can try to resolve the issue.

You also have the right to lodge a complaint with the Italian data protection authority

Last updated: 17 September 2026