Privacy policy

Last updated: 26 October 2026

This notice explains how PlantScraper handles personal data when you visit plantscraper.com, order products, create an account, subscribe to marketing, contact us or otherwise interact with our business. It applies alongside applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

1. Data controller and contact details

Data controller: Plant Coma s.r.o., trading as PlantScraper.
Registered office: Michelská 1594/9a, 141 00 Prague 4, Czech Republic.
Company identification number (IČO): 04695275.
VAT identification number: CZ04695275.
Privacy enquiries and rights requests: hello@plantscraper.com.

2. Personal data we process

  • Contact and identity details: your name, email address, telephone number, delivery and billing addresses, and business or VAT details where relevant.
  • Order information: products, order value, payment status, chosen payment method, invoicing, shipping and tracking details, discounts, returns, refunds and complaints. Payment card details are ordinarily processed by the payment provider, rather than stored by PlantScraper in full.
  • Account and support details: customer account identifiers, saved preferences, correspondence, contact form submissions, reviews and other information you send us.
  • Device and website information: IP address, browser and device information, approximate region, page views, shopping-cart interactions, cookies and similar identifiers, and security and performance data.
  • Marketing information: subscription and consent choices, campaign interactions and advertising or conversion information where permitted.

We generally collect information from you or through your use of our store. Relevant details may also reach us from Shopify, payment and delivery providers, marketplaces, customer support tools or advertising partners.

3. Why we use personal data and the legal grounds

  • Orders, accounts and delivery: placing and fulfilling orders, collecting payments, arranging delivery, providing tracking and processing returns. Legal basis: Article 6(1)(b) GDPR, performance of a contract or steps requested before a contract.
  • Tax, accounting and consumer-law records: invoicing, statutory record-keeping and regulatory compliance. Legal basis: Article 6(1)(c), legal obligation.
  • Customer care: responding to questions, handling complaints and investigating delivery issues. Legal basis: Article 6(1)(b) where related to an order; otherwise Article 6(1)(f), our legitimate interest in supporting customers and resolving issues.
  • Security and fraud prevention: protecting accounts, detecting misuse, securing transactions and asserting or defending legal claims. Legal basis: Article 6(1)(f), our legitimate interests, and Article 6(1)(c) where required by law.
  • Performance and improvements: troubleshooting and improving the store and understanding customer experiences. Legal basis: Article 6(1)(f) for essential or otherwise permitted operations; Article 6(1)(a), consent, for non-essential analytics technologies where required.
  • Promotions and advertising: newsletters, relevant product information, campaign measurement and personalized advertising. Legal basis: Article 6(1)(a), consent, where required. Limited existing-customer marketing may rely on Article 6(1)(f) when permitted by applicable electronic-marketing law and subject to an effective right to opt out.

Information such as your name, delivery details and the information required for payment is necessary to complete a purchase. Optional marketing subscriptions and non-essential tracking are not required to place an order.

4. Shopify, website cookies and privacy preferences

Our online store is hosted by Shopify, which processes information to provide storefront, checkout, accounts, hosting and security services. Depending on which Shopify features are enabled, and subject to applicable privacy rights and lawful choices, Shopify may also use information concerning activity on our store for enhanced shopping experiences, advertising and measurement. For Shopify's own processing and privacy choices, consult its Consumer Privacy Policy and privacy portal.

Essential cookies and similar storage technologies help operate the shopping cart, checkout, customer sessions, fraud prevention and necessary site features. We may also use optional analytics, advertising and personalization technologies, including services from Google and Meta. Where the law requires consent, non-essential technologies must not be used unless you have given valid consent. You can accept, refuse or change choices through the available website cookie or privacy-preference controls, and can contact us at hello@plantscraper.com for assistance. You can also control cookies through your browser, although blocking necessary storage may affect certain functions.

5. Emails and direct marketing

If you choose to subscribe to marketing, or if applicable law otherwise permits us to contact you as an existing customer, we may email plant-care advice, product news, promotions and relevant recommendations. We use services such as Klaviyo to manage campaigns and subscription preferences. Where lawfully permitted, campaign emails may include measurements of opens and link clicks.

Every marketing email provides an unsubscribe option. You can also opt out by emailing us. We may retain a limited suppression record so your preference is respected. Essential communications about your orders or account are not marketing communications.

6. Service providers and other recipients

We disclose personal data only as reasonably necessary for the activities described in this policy and with the legal or contractual safeguards applicable to each recipient. Depending on the service you use, these recipients may include:

  • Store and website: Shopify, together with tools supporting contact forms, translations and storefront functionality, such as Pify and Langify where in use.
  • Order and business operations: BaseLinker, Fakturoid and customer-care or CRM providers used for processing orders, inventory, invoices and enquiries.
  • Carriers: GLS, PPL/DHL and their delivery partners, for shipping, tracking and investigating delivery issues.
  • Payment services: payment providers presented at checkout, potentially including PayPal, Shopify payment partners and other supported processors, for payment authorization and fraud checks.
  • Communications, analytics and marketing: services such as Klaviyo, Google, Meta and Trustpilot, where activated and used with the required legal basis.
  • Professional or legal recipients: accountants, advisers, insurers, regulators and courts when justified or required by law.

Some providers process data on our instructions, while others act as independent controllers for their services. Their own privacy notices may also apply.

7. Transfers outside the European Economic Area

Some providers and their infrastructure may operate outside the European Economic Area. Where international transfers require safeguards, those transfers must be supported by a valid legal mechanism, such as an EU adequacy decision or the European Commission's standard contractual clauses with additional measures where appropriate. Contact us for information about safeguards relevant to your data.

8. How long we keep information

We use retention periods appropriate to the purpose of processing and any applicable legal requirements:

  • Orders, payments, invoices and tax documents: for the periods required by Czech tax, accounting and other applicable laws, and where necessary for legal claims.
  • Accounts: for the duration of the account relationship and afterwards only as needed for lawful business, security or legal purposes.
  • Support cases: until the issue has been resolved and any relevant claim or limitation period has expired.
  • Marketing: until you unsubscribe, object or withdraw your consent, together with limited records needed to honor your choice.
  • Technical information and analytics: according to the purpose, security needs, the applicable provider configuration and legal requirements.

When personal information is no longer needed and retention is not required by law, it is deleted or anonymized.

9. Your GDPR rights

Subject to applicable conditions and exceptions, you may request access, correction, deletion, restriction of processing or portability of your personal information, and you may object to processing based on legitimate interests. You may object to direct marketing at any time. If processing relies on consent, you can withdraw consent at any time without affecting processing carried out lawfully before withdrawal.

To exercise these rights, email hello@plantscraper.com. We may take reasonable steps to verify your identity and will respond within the deadlines required by law.

You may lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ), or another competent data protection authority, particularly in the EU or EEA country where you live or work.

10. Automated tools and security

Automated tools may be used for fraud and security risk detection, checkout support and marketing personalization where permitted. If a decision with legal or similarly significant effects is made solely by automated means, we will provide the information and safeguards required by law. You may contact us about a decision affecting an order.

We use reasonable technical and organizational safeguards to help protect personal data and limit access to people and providers who need it. No internet-based service can guarantee complete security.

11. Children

Our online store is not specifically directed at children. We do not intentionally solicit personal data from children for marketing. Please contact us if you believe a child has provided personal information improperly.

12. Changes to this policy

We may update this policy when our tools, processing activities or legal obligations change. The current version will be published on this page with the latest update date. Where legally required, we will provide further notice of material changes.