Privacy Policy
Last updated: 9 June 2026
This Privacy Policy applies to the personal data of customers, suppliers, visitors, job applicants, and business contacts.
1. Who Are We?
Plantion is an auction and trading platform within the floriculture sector. We facilitate the trade of flowers, plants, and floristry supplies between growers, buyers, and other business partners.
Plantion is the data controller within the meaning of the General Data Protection Regulation (GDPR).
2. What Personal Data Do We Process?
We process personal data that is necessary for our services, including:
General Information
- Name and company name
- Address details
- Telephone number
- Email address
Business Information
- Customer and supplier identification numbers
- Transaction and auction data
- Business payment information
Digital Information
- IP address
- Login and account details
- Usage data of our systems (e.g., MyPlantion)
Security and Access Information
- CCTV footage (visitors and site security)
- Access registration and badge usage
- Wi-Fi registration (where applicable)
3. For What Purposes Do We Process Data?
We process personal data for the following purposes:
- Providing auction and trading services
- Administration and invoicing
- Access control to buildings and site security
- Customer service and communication
- Account management and digital platforms
- Compliance with legal obligations (such as tax administration requirements)
- Marketing and communications, where permitted based on consent or an existing customer relationship under applicable legislation
- Analysis of the use of our services and systems
4. Legal Bases for Processing (GDPR)
We process personal data on the basis of:
- Performance of a contract
- Compliance with a legal obligation
- Legitimate interests (e.g., security and business operations)
- Consent (e.g., marketing cookies or newsletters)
5. Sharing Personal Data with Third Parties
We only share personal data when necessary with:
- IT and software providers
- Payment processors and financial service providers
- Logistics and operational partners
- Security service providers
- Government authorities where legally required
We enter into data processing agreements with all processors in accordance with the GDPR.
6. International Data Transfers
If personal data is processed outside the European Economic Area (EEA), we ensure appropriate safeguards, such as:
- EU Standard Contractual Clauses (SCCs); or
- Processing in countries covered by an adequacy decision.
7. Data Retention Periods
We do not retain personal data longer than necessary:
- Administrative data: 7 years (tax legislation requirements)
- CCTV footage: 7–30 days (unless required for an incident investigation)
- Account data: for as long as the account remains active
- Marketing data: until consent is withdrawn
- Recruitment data: a maximum of 4 weeks after completion of the recruitment process (unless consent is provided for longer retention)
8. Data Security
We implement appropriate technical and organizational measures, including:
- Encrypted connections (SSL/TLS)
- Access control and authorization management
- System logging and monitoring
- Physical security of locations
- Regular security updates and audits
9. Cookies and Tracking Technologies
We use cookies and similar technologies:
Functional Cookies
Necessary for the operation of our websites and systems.
Analytical Cookies
Used to gain insight into the use of our services (anonymized where possible).
Marketing Cookies
Used only with consent for communications and marketing campaigns.
Users can adjust their cookie preferences through the cookie banner or browser settings.
More information about our use of cookies is available in our separate Cookie Policy.
10. Data Subject Rights
You have the following rights:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to object
- Right to data portability
- Right to withdraw consent
Requests may be submitted using our contact details.
11. Data Breaches
In the event of a data breach:
- The incident will be internally recorded and investigated;
- Where required, it will be reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens);
- Data subjects will be informed if the breach poses a high risk to their rights and freedoms.
12. CCTV and Site Security
CCTV surveillance may be used at our locations for:
- The safety of individuals
- The protection of property
- The prevention of misuse and fraud
Footage is only reviewed when necessary and is deleted in accordance with applicable retention periods.
13. Job Applicants
For recruitment and selection purposes, we process:
- CVs and cover letters
- Contact details
- Interview notes
Data is deleted within 4 weeks after completion of the recruitment process unless consent is provided for a longer retention period.
14. Newsletter and Marketing
We only send marketing communications if:
- You have subscribed; or
- You have an existing business relationship with us (within applicable legal frameworks)
You may unsubscribe at any time using the unsubscribe link provided.
15. Automated Decision-Making
We do not make decisions based solely on automated processing that produce legal effects concerning individuals, unless explicitly stated otherwise.
16. Changes to This Privacy Policy
We may amend this Privacy Policy when legislation or our services change. The most recent version will always be available on our website.
17. Contact and Complaints
If you have any questions or complaints regarding privacy, you may contact Plantion.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).