Privacy Policy template

1. About this policy

[Your company], [Company number], of [Your address], is bound by the privacy law of [Jurisdiction]. This policy says what personal information we collect, why, who receives it and where it is held, and how you can access it, correct it or complain.

In plain words. We sell plants online. This policy covers our website, our store and our email, and it describes what we actually do, not what a template says.

In this policy, personal information means information about an identifiable person: your name, contact details, order history, payment records and the browsing data our site collects. It does not include the anonymous plant care questions we publish, which never carry a name.

2. What we collect

We do not collect sensitive information such as health, racial or political information, and we ask you not to include it in messages to us.

3. How we collect it

Directly from you, when you order, subscribe or write to us, and from our website through cookies as described in section 7. We never buy personal information from third parties, and we never collect it from social media profiles or data brokers. If someone else gives us your details, for example a gift delivery, we use them only for that delivery.

4. Why we use it

4.1 Fulfilling orders. Taking payment, packing plants, delivering them, and telling you where your order is. This is the use every other purpose hangs off, and it matches the first three rows of the collection table.

4.2 Customer service. Answering questions, handling returns and replacements, and keeping a record of what we agreed so a replacement promised in March is honoured in May.

4.3 Marketing, only with consent. Sending plant care tips and offers to people who opted in. Every email carries an unsubscribe link, and unsubscribing takes effect straight away.

4.4 Improving the site. Understanding which pages are used and where the checkout loses people, using aggregated browsing data. We look at patterns, not at what one named person did.

4.5 Complying with the law. Keeping the transaction records tax law requires, and responding to lawful requests from authorities.

4.6 Preventing fraud. Checking orders that look wrong before we ship, such as a mismatched delivery suburb on a large order, to protect customers and the business.

5. Who we share it with

No one else receives your information, and we never sell it.

6. Overseas disclosure

Three of the services in the table hold data in the United States. Before using each one we took reasonable steps to check how it protects personal information, and we rely on its contractual commitments to handle your data to the standard this policy describes.

What that means for you. Privacy law makes us responsible for what happens to your information when we send it overseas. If one of those services mishandles it, that is our problem to fix, not yours to chase.

7. Cookies and analytics

A cookie is a small file our site stores in your browser so it can remember your cart and recognise a return visit. Without the cart cookie the shop does not work; everything else is optional.

We use one analytics service to count visits and see which pages are read. You can opt out with the service’s browser add on, or by blocking third party cookies in your browser, and the shop keeps working either way. We use no advertising cookies and no social media tracking pixels.

8. Security

Customer records live in our store platform and are encrypted in transit and at rest. Only the two owners and the store manager can access them, each with their own login and two factor authentication, and access ends the day a role does.

If something goes wrong, we assess the breach quickly, contain it, and fix the cause. Where a breach is likely to cause you serious harm, we will notify you and the [Privacy regulator] under the applicable data breach rules, and tell you what happened, what we did and what you can do.

9. How long we keep it

10. Access, correction and deletion

Email us to see the information we hold about you, correct it, or ask us to delete what we are not required to keep. We respond within 30 days, and we may ask you to confirm your identity first, usually by replying from the email on the order, so we never hand your information to someone else. Access is free; we only pass on a cost if you ask for something unusual, and we tell you the cost before doing anything.

11. Complaints

If you think we have mishandled your information, email the owner at [Email]. We will respond within 30 days. If you are not satisfied with our answer, you can complain to the [Privacy regulator].

12. Changes

When this policy changes, the new version is posted on our website with a new effective date. Significant changes are also noted in our email news.

Contact

Version history