Privacy policy

What we collect, and when

Only what you type in yourself, plus the ordinary technical records any web server keeps:

• When you order: your name, email address, phone number and delivery address (street, postcode, city, country), together with the plants ordered, the amount paid and the payment method chosen.
• When you write to us: the name, email address and message you enter in the contact form.
• Automatically: the server keeps standard access logs — IP address, time of request, page requested and browser user-agent — which is how the site is kept secure and working.

We never see or store your card or bank credentials. Payments are completed entirely inside Swish, PayPal or your own bank, and only the confirmation that a payment succeeded comes back to us.

Why we're allowed to use it

Under the GDPR every use of your data needs a legal basis. Ours are: performance of a contract for everything involved in taking, packing, shipping and supporting your order; a legal obligation for keeping accounting records of each sale; and legitimate interest for answering contact-form messages, keeping the site secure and preventing abuse of the forms. We also use Google Analytics to understand how the shop is used, which you can switch off at any time — see Cookies below.

Cookies

The first two cookies below are strictly necessary to make the shop function, and are set regardless — without them a basket or a form submission can't work at all. The Google Analytics cookies are optional:

Analytics cookies are optional. We use Google Analytics to see which plants get looked at and how people move through the basket and checkout, which is genuinely useful for deciding what to grow next. It's on unless you switch it off: choose "Essential only" and Google Analytics stops collecting and its cookies are removed. You can change your mind whenever you like with cookie settings, also linked at the bottom of every page. Withdrawing takes effect immediately.

The contact form is protected by Google reCAPTCHA, which may set its own cookies when the form is shown. It's there purely to stop automated spam — see below.

Who else sees it

Your data is never sold, rented or handed to anyone for marketing. It's shared only with the services needed to actually fulfil an order, each of which processes it on our instructions:

• Payments — Swish (Getswish AB, Sweden), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), or your own bank for a manual transfer.
• Delivery — PostNord within Sweden, UPS elsewhere in the EU. They receive the name, address and phone number needed to deliver the parcel.
• Email — Amazon Web Services (Amazon SES, Stockholm region) delivers order confirmations and replies.
• Hosting — the provider running the server this site is served from.
• Spam protection — Google reCAPTCHA on the contact form and admin login.
• Analytics — Google Analytics (Google Ireland Ltd), unless you've switched it off.
• Authorities — where we're legally required to disclose something, for example to the Swedish Tax Agency.

Order and customer data is stored on servers in the EU. Google's reCAPTCHA and Google Analytics may involve a transfer to the United States, which Google covers with the European Commission's Standard Contractual Clauses and its EU–US Data Privacy Framework certification.

How long we keep it

• Orders and invoices — seven years after the end of the calendar year of the sale, because Swedish bookkeeping law (bokföringslagen) requires it.
• Contact-form messages — up to two years, so a follow-up question about a plant you bought still has its history.
• Server logs — a short rolling window, then overwritten.
• An abandoned basket — nothing is stored on our side at all; it lives only in the cookie in your own browser.

Your rights

You can ask for a copy of the data we hold about you, have it corrected, have it deleted, have its use restricted, object to processing based on legitimate interest, or receive it in a portable format. Just write to info@jadmaplants.com — no particular form of words needed, and we'll answer within one month. The one limit is accounting data: while the seven-year retention above still applies, that specific record can't be deleted on request.

If you think we've handled your data badly, you're entitled to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se — though we'd appreciate the chance to sort it out directly first.

Changes to this policy

If how we handle data changes, this page is updated and the date at the top changes with it. There's no mailing list to notify, since we don't run one.