Version 1.0 — Effective date: 09/06/26 — GDPR compliant
Data Controller
The data controller responsible for your personal data is Helio, operated by [Your Legal Name], [address], [registration number], [email]. You can contact us at any time at the address above regarding your data.
Contents
When you create an account and use the Service, we collect the following information:
When you use the Service, we may collect limited technical and usage data, including:
This data is collected to improve the reliability and performance of the Service and is not used for advertising purposes.
As a florist using Helio, you may enter personal data about your own customers (names, contact details, order history) into the platform. In this context, you are the data controller for your customers' data, and Helio acts as a data processor on your behalf.
You are responsible for ensuring you have a lawful basis for storing your customers' data in the Service, and for informing your customers that their data is held in a third-party system where required.
We process your personal data for the following purposes and on the following legal bases:
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Provide and operate the Service | Email, shop name, customer & order data | Contract performance (Art. 6(1)(b)) |
| Manage your account and billing | Email address, shop name | Contract performance (Art. 6(1)(b)) |
| Send service notifications | Email address | Legitimate interest (Art. 6(1)(f)) |
| Improve the Service | Usage data, technical data | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal obligations | Account and billing data | Legal obligation (Art. 6(1)(c)) |
Your data is stored on the infrastructure provided by Base44, the platform on which the Helio Service is built. Base44's servers are located within the European Economic Area (EEA). If you require specific information about Base44's data hosting and security practices, please contact us and we will provide the available details.
We retain your account data for as long as your subscription is active. Following cancellation, your data is retained for 30 days to allow for data export requests, after which it may be permanently deleted.
Customer data you have entered into the platform is retained for as long as your account is active, unless you request earlier deletion.
We do not sell, rent, or share your personal data with third parties for marketing purposes.
We may share data with the following categories of third parties, strictly for the purpose of providing the Service:
Any third party with whom we share data is required to process it only for the specified purpose and in accordance with applicable data protection law.
As a data subject under the GDPR, you have the following rights in relation to your personal data:
| Your right | What it means |
|---|---|
| Right to access | Obtain a copy of your personal data held by Helio |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Request deletion of your personal data |
| Right to portability | Receive your data in a structured, machine-readable format |
| Right to object | Object to processing based on legitimate interests |
| Right to restriction | Request that we limit how we use your data |
To exercise any of these rights, please contact us at the email address provided in this policy. We will respond to your request within 30 days.
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the relevant supervisory authority. In Germany: the Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI). In France: the Commission Nationale de l'Informatique et des Libertés (CNIL).
Helio uses only the cookies and local storage strictly necessary for the operation of the Service, such as maintaining your login session. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
No personal data is shared with advertising networks or data brokers through cookies or any other tracking mechanism.
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include secure access controls, encrypted data transmission (HTTPS), and restricted access to personal data within our systems.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and will notify affected users without undue delay where required by law.
The Service is intended for use by adult business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.
We may update this Privacy Policy from time to time. Where changes are material, we will notify active users by email at least 30 days before the changes take effect. The updated policy will always be available on the Helio website.
Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the changes.
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:
We aim to respond to all data-related requests within 30 days.