Privacy policy

1. Who we are

Petala (“we”, “us”) is a website, app and CRM platform for flower wholesalers and florists, developed by the OXBOX web studio. Petala is the controller of the personal data described in this policy. You can reach us about anything related to your data at oxbox@oxbox.ru.

2. What data we collect

2.1. When you send a request. The request form asks for your name and phone number, and optionally your email address and a message. We also record the page you sent it from, the time, your IP address and your browser’s user agent.

2.2. When you use the chat. The messages you write in the chat window, any files you attach to them and, if you choose to leave it, your email address. We also record the page you wrote from, the time, your IP address, your browser’s user agent and time zone. A random chat ID is kept in your browser’s local storage so the conversation stays with you across pages; it is created only when you send your first message.

2.3. When you browse the site. Our web server keeps standard technical logs: IP address, date and time, requested address, referring page and browser user agent.

2.4. Analytics, only with your consent. If you click “Accept” in the cookie notice, Google Analytics 4 records how you use the site: pages viewed, scrolling, clicks on links, approximate location (country and city), device and browser, and how you arrived at the site. Google Analytics 4 does not store IP addresses.

2.5. We do not use advertising services, and we do not buy or receive data about you from third parties.

3. Why we use it and on what legal basis

3.1. To reply to your request or chat message, call you back, show you a demo and prepare an offer — steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and your consent given in the form (Article 6(1)(a)).

3.2. To keep the site secure and working: limiting repeated submissions, fighting spam and investigating errors — our legitimate interest (Article 6(1)(f)).

3.3. To understand how visitors use the site and improve it — your consent given in the cookie notice (Article 6(1)(a)). You can withdraw it at any time on the Cookie policy page.

3.4. We do not use your data for automated decision-making or profiling, and we do not send marketing emails without your separate consent.

4. Who receives your data

4.1. The site and the request form run on servers in Amsterdam, the Netherlands.

4.2. A new request is delivered to our team as a message in Telegram and by email. These providers may process data outside the European Economic Area; where they do, the transfer relies on the safeguards those providers offer, such as standard contractual clauses. Chat messages reach our team the same way, through Telegram; so that we can read and answer them in your language, the text of each message is sent to Google Translate.

4.3. If you accept analytics, usage data is processed by Google Ireland Limited (Google Analytics). Google may transfer it to the United States under the EU–US Data Privacy Framework.

4.4. We do not sell your data and do not share it with anyone else, unless the law requires us to.

5. How long we keep it

5.1. Requests — up to 24 months after our last contact with you, unless you become a client; client data is then kept for as long as the contract and the accounting rules require.

5.2. Chat conversations — up to 24 months after the last message, on the same terms as requests.

5.3. Server logs and the anti-spam counter — up to 30 days.

5.4. Analytics data — up to 14 months in Google Analytics.

6. Your rights

6.1. You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format.

6.2. Where we rely on your consent, you can withdraw it at any time; this does not affect processing carried out before the withdrawal.

6.3. To use any of these rights, write to oxbox@oxbox.ru. We reply within one month.

6.4. You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) — or with the authority of your own EU country.

7. Security

The site works only over an encrypted connection (HTTPS). Requests are stored outside the public part of the server, and access to them is limited to the people who handle them.

We may update this policy when the site or the law changes; the current version is always on this page. Last updated: 22 October 2026.

Related document: Cookie policy.