Privacy notice

Botanisia is a marketplace. This notice explains what the platform collects, why, and the choices you have. Individual sellers may also be controllers of the data they need to fulfil an order; their own notice applies to that processing.

What we collect

• Account data: name, email, password hash (held by the authentication provider), locale and notification preferences.
• Order data: delivery and billing address, order lines, messages about an order, refunds and dispute records.
• Seller data: store details, shipping destinations, tax identifiers and the identity information the payment provider requires for payouts.
• Usage data: essential cookies, security logs and, only with consent, optional analytics. Personalised recommendations can be turned off.

Why we process it

To perform the contract with you, to meet legal obligations (consumer, tax, DAC7 and plant-health records), to prevent fraud and prohibited trade, and — where consent is required — for optional communications and personalisation. We do not sell personal data.

Payments

Botanisia never stores raw payment-card details. Card data is handled by the connected payment provider. Billing records, invoices and payout status are stored so both sides have a reliable record.

Retention

Account data is kept while the account is active. Order and tax records are retained for the period required by applicable law, even after deletion of the profile. Moderation evidence is kept only as long as needed for the investigation, appeal and legal-claims period.

Your rights

You can access, correct, export, restrict or delete your data, and object to processing based on legitimate interests. Signed-in customers can download their data. To request deletion or exercise another right, contact the privacy contact in the imprint. We respond within the period required by GDPR and may need to verify your identity.

Deletion removes your profile, sessions and preferences. Records that must be retained for tax, accounting, consumer-protection or dispute purposes are kept in a restricted archive and are not used for marketing.

International transfers

Where a processor is outside the EEA, transfers must rely on an adequacy decision or appropriate safeguards. The production deployment must document each processor, its region and the transfer mechanism before launch.

Complaints

You may complain to your local supervisory authority. The controller details and the lead authority will be confirmed in the imprint before the marketplace is launched.