Privacy policy

What we collect, and when

Only what you type in yourself, plus the ordinary technical records any web server keeps:

• When you order: your name, email address, phone number and delivery address (street, postcode, city, country), together with the plants ordered, the amount paid and the payment method chosen.
• When you write to us: the name, email address and message you enter in the contact form.
• Automatically: the server keeps standard access logs — IP address, time of request, page requested and browser user-agent — which is how the site is kept secure and working.

We never see or store your card or bank credentials. Payments are completed entirely inside Swish, PayPal or your own bank, and only the confirmation that a payment succeeded comes back to us.

Why we're allowed to use it

Under the GDPR every use of your data needs a legal basis. Ours are: performance of a contract for everything involved in taking, packing, shipping and supporting your order; a legal obligation for keeping accounting records of each sale; and legitimate interest for answering contact-form messages, keeping the site secure and preventing abuse of the forms. We don't run advertising or analytics, so we never ask for consent-based tracking.

Cookies

This site sets no advertising, analytics or tracking cookies. The only ones are strictly necessary to make the shop function, so there's nothing to opt in or out of — the small notice on your first visit is there to tell you they exist, not to ask permission:

The contact form is protected by Google reCAPTCHA, which may set its own cookies when the form is shown. It's there purely to stop automated spam — see below.

Who else sees it

Your data is never sold, rented or handed to anyone for marketing. It's shared only with the services needed to actually fulfil an order, each of which processes it on our instructions:

• Payments — Swish (Getswish AB, Sweden), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), or your own bank for a manual transfer.
• Delivery — PostNord within Sweden, UPS elsewhere in the EU. They receive the name, address and phone number needed to deliver the parcel.
• Email — Amazon Web Services (Amazon SES, Stockholm region) delivers order confirmations and replies.
• Hosting — the provider running the server this site is served from.
• Spam protection — Google reCAPTCHA on the contact form and admin login.
• Authorities — where we're legally required to disclose something, for example to the Swedish Tax Agency.

Order and customer data is stored on servers in the EU. Google's reCAPTCHA may involve a transfer to the United States, which Google covers with the European Commission's Standard Contractual Clauses and its EU–US Data Privacy Framework certification.

How long we keep it

• Orders and invoices — seven years after the end of the calendar year of the sale, because Swedish bookkeeping law (bokföringslagen) requires it.
• Contact-form messages — up to two years, so a follow-up question about a plant you bought still has its history.
• Server logs — a short rolling window, then overwritten.
• An abandoned basket — nothing is stored on our side at all; it lives only in the cookie in your own browser.

Your rights

You can ask for a copy of the data we hold about you, have it corrected, have it deleted, have its use restricted, object to processing based on legitimate interest, or receive it in a portable format. Just write to info@jadmaplants.com — no particular form of words needed, and we'll answer within one month. The one limit is accounting data: while the seven-year retention above still applies, that specific record can't be deleted on request.

If you think we've handled your data badly, you're entitled to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se — though we'd appreciate the chance to sort it out directly first.

Changes to this policy

If how we handle data changes, this page is updated and the date at the top changes with it. There's no mailing list to notify, since we don't run one.