Privacy Policy

1. Controller

Flora Connect is the controller for the personal data described here. Data protection contact: privacy@flora-connect.com.

2. Data we collect

• Account data: name, work email, business or nursery name, country, role (grower or buyer), password (stored hashed), language preference.
• Trade content: listings, wall posts, sourcing requests, photos, reviews and the messages you exchange with other members.
• Verification data: business registration, VAT number, address and facility photos submitted for the verified grower badge; purchase invoices and photo proof submitted for reviews.
• Billing data: plan, subscription status and payment references. Card details are handled by our payment provider and never stored by us.
• Technical data: log records, device and browser information and security events needed to run and protect the service.

3. Why we use it and on what legal basis

• To provide the account, wall, directory, messaging and notifications — performance of our contract with you.
• To take subscription and extras payments and issue invoices — contract and legal obligation.
• To verify growers and to check review proof — legitimate interest in a trustworthy trade platform.
• To send service and match notifications you have configured — contract; marketing emails only with your consent, withdrawable at any time.
• To prevent fraud, abuse and misuse, and to keep records for accounting — legitimate interest and legal obligation.

4. Who can see your data

Your business name, country, role, listings, posts, reviews and profile information are visible to other signed-in members — that is the purpose of the platform. Your messages are visible only to you and the member you write to. Payment identifiers and internal verification notes are never shown to other members. We share data only with processors who run the service for us: cloud hosting and database, email delivery and the payment provider. We do not sell personal data.

4a. Business Hub data

Flora Connect holds proprietary ownership of, and full access to, all company details entered in the Business Hub (clients and their contact details, sales, payments, stock, production, bills of lading and waste records). This data is stored in a private Flora Connect back office that only the platform administrator can view, and is used to operate, analyse and improve the service — legal basis: our contract with you and our legitimate interest. It is never shown to other members and never sold. If you enter personal data of your own customers, you confirm you are allowed to share it with us.

5. International transfers

Data is hosted in the European Union where possible. Where a processor operates outside the EEA, transfers are covered by an adequacy decision or the EU Standard Contractual Clauses.

6. How long we keep it

Account and trade content are kept while your account is active and for up to 12 months after closure, verification documents for up to 24 months after a decision, and billing records for the statutory retention period (normally 7–10 years). Messages are kept for the life of the account so both parties keep their trade history.

7. Your GDPR rights

You may request access to your data, correction, erasure, restriction, portability, and you may object to processing based on legitimate interest. You can withdraw consent at any time. Write to privacy@flora-connect.com and we will answer within one month. You also have the right to complain to your national data protection authority.

8. Cookies and local storage

We use strictly necessary storage to keep you signed in, to remember your language, and to keep the service secure. We do not use advertising cookies or cross-site tracking.

9. Security

Access to data is protected by authentication, row-level access rules, encryption in transit and restricted internal access. Photos and verification documents are stored in private buckets. No system is perfectly secure; tell us immediately if you suspect your account is compromised.

10. Changes

We will notify material changes to this policy in the app or by email. The date at the top shows the current version.