Privacy Policy

Plant Provenance and Inside Plant Provenance are products by Hortikult Digital Solutions, s.r.o.

1. Introduction

Hortikult Digital Solutions s.r.o., IN: 21833133, with its registered seat at Na Vršku 1007, Kolín IV, 280 02 Kolín, Czech Republic, a company existing and incorporated under Czech laws and registered in the Commercial Register maintained by the Prague Municipal Court under sec. C 407124 (the “Provider”) treats any personal data it processes as strictly confidential and uses it in compliance with applicable data protection laws.

This Privacy Policy applies to personal data processing related to:

Use of the website available at https://plantprovenance.com, https://hortikult.com, and related sites (the “Websites”);
communication with the Provider via email, customer account, social media accounts, or phone;
performance of a contract concluded with the Provider’s customers and/or with other contractors;
fulfillment of the Provider’s legal obligations;
necessary protection of the legitimate interests of the Provider.

2. Data controller and contact details

Hortikult Digital Solutions s.r.o., IN: 21833133, with its registered seat at Na Vršku 1007, Kolín IV, 280 02 Kolín, Czech Republic, a company existing and incorporated under Czech laws and registered in the Commercial Register maintained by the Prague Municipal Court under sec. C 407124 is within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679), a controller of your personal data.

Address: Na Vršku 1007, Kolín IV, 280 02 Kolín, Czech Republic
Email: hello@hortikult.com
Phone: +420727874181

3. What kind of data is processed?

3a. Processing of personal data in the case of your request

If you request our services, we will work with the personal data you provide in your request, usually sent to our email or via a customer form. Most often, it is an email address, name, surname, possibly a phone number, and your more detailed requirements.

We will use this data for the processing of your enquiry, for as long as necessary. If we do not start our cooperation, we will process your personal data for a maximum of 3 months from our last communication.

This processing is permitted by the GDPR (Article 6(1)(b) – contract negotiations).

3b. Processing of personal data in the case of the provision of services

If you are our client, we will work with your billing and contact details. We work with this data to provide you with services according to the contract and to comply with our legal obligations (mainly in the field of tax and accounting).

We are entitled as well to keep your personal data based on our legitimate interest (i.e., protection of our services, know-how, to prove the existence of the contract, and other interests).

We will process this data for the duration of the provision of the services and for the period specified by the relevant legislation (most commonly 10 years from the last provision of the service, which is required by tax legislation).

In the event of protection of the legitimate interests of the Provider, we will keep the data for a maximum of 10 years from the end of our contract, unless separate laws require otherwise (such as the laws on legal profession and tax advisory services), or unless it is necessary in justified cases to retain data for a longer period in connection with a particular case.

This processing is permitted by the GDPR (Article 6(1)(b) – performance of contract and Article 6(1)(c) – compliance with legal obligations, Article 6(1)(f) – legitimate interest (protection of the Provider’s rights and fraud prevention)).

3c. Commercial communication

If you become our client, we are entitled to use your name, surname, email address and telephone number to send you commercial communications by electronic means (email, SMS, customer account), i.e., to inform you about the goods or services we provide, unless you have refused such communications, based on legitimate interest and an exemption under Section 7(3) of Act No. 480/2004 Coll., on certain information society services.

If you give us your consent, we can prepare special offers for you according to the category of services we have previously provided to you. In this case, we will send you commercial communications regarding our services and those of our partners, taking into account your purchases, preferences, or otherwise tailored to select the services that best meet your needs.

You can withdraw your consent, refuse, or modify the sending of commercial communications at any time by sending a message to hello@hortikult.com. You may also opt out of receiving commercial communications by using the link provided in each of our commercial communications.

We will process personal data to send commercial communications based on legitimate interest (direct marketing) for the duration of our contractual relationship and a maximum of 12 months after its termination or until you refuse such processing.
We will process personal data to send commercial communications based on your consent for as long as you have given your consent.

The legal basis for this processing is your consent and our legitimate interest, which is primarily to promote the sale of our services to clients and improve our services.

3d. Performing marketing analyses and statistics

If you give us your consent to do so on our website, we will also process the personal data you provide, including your browsing and purchase history, to conduct marketing analyses and statistics. This consent is completely voluntary, and you can withdraw your consent at any time, whereby the withdrawal of your consent does not affect the lawfulness of the processing of your personal data prior to its withdrawal.

We will process personal data disclosed based on your consent for as long as the consent is given.

The legal basis for this processing is your consent.

4. Recipients of personal data

The Provider will disclose your personal data only to its authorised employees, tax/legal advisors or to individual data processors engaged by the Provider under relevant contracts such as IT and marketing providers, or to other controllers if applicable, but in any case within the scope necessary to achieve the purposes of the processing and based on the relevant legal title for the processing of the personal data.

In some cases defined by legislation, the Provider is authorised, or even obligated, to transfer certain personal data under applicable laws to criminal prosecution authorities or other public authorities.

5. Data transfer to third countries

Personal data is not usually transferred to third countries, i.e., to countries outside the European Union, and in the case of their storage on cloud servers/other places outside the European Union, their adequate protection is ensured under applicable legislation.
Data may also be made available outside the EU (in the US) via Google Analytics. Both Google and Google Analytics have joined the Data Privacy Framework programme.

6. Cookies

When you visit and use the Website, cookies or other technologies such as pixels will be activated on your device. Cookies are small files designed to store and receive identifiers and other information about computers, telephones, and other devices you use to access the Website, that help provide, protect, and improve the services the Provider offers.

Cookies enable the Provider to offer you the content and services most suitable to your needs and interests. Cookies enable the Provider to record information regarding your visit to the Website and will thus make your next visit easier and quicker.

6a. The following cookies are used on the Website:

A) Functional cookies

When you visit and use the Website for information purposes only, we collect personal data received by our server from your Internet browser. We need these cookies to display the Website and ensure it can be used stably and securely.

We collect these cookies based on the GDPR (Article 6(1)(b) – performance of contract and Article 6(1)(c) – compliance with legal obligations, and Article 6(1)(f) – legitimate interest (provision of the functional and safe Website)).

B) Basic analytics cookies

These cookies are used to enhance the functioning of the Website. They enable us to recognise and count the number of visitors and see how visitors are using the Website. They help us improve the way the Website is functioning, e.g., by enabling users to easily find what they are looking for. These cookies do not collect information that could identify you, but they help us to enhance the functionality of the Website.

C) Marketing cookies

These are used to track Website user preferences to target advertising, i.e., to display relevant marketing and advertising information (also on third-party websites) matching these preferences.

Marketing cookies use external company tools. These marketing cookies will only be used with your consent, which you can withdraw at any time.

You can view the list of cookies currently enabled by clicking on the cookie tool installed on the Website, and you can find there as well information on purpose and data retention.

Cookies may be disabled in your Internet browser settings, or you can only enable certain types of cookies (depending on your Internet browser type). However, if you disable basic (functional) cookies, certain functions of the Website may not work the way they should.

6b. More information

The following list is not complete. For more details, please check our cookie tool.

Alfahosting

Our website is hosted by our processor, Alfahosting GmbH, based in Germany.
Connection data is processed to provide and deliver the website. Data are not stored beyond access for the mere purpose of delivering and providing the website.
Connection data and other personal data are also processed in connection with various other functions or services to operate the website. Detailed information is provided in this Data Privacy Statement and the individual functions or services.

Server log files

Connection data is processed to monitor the technical function and to increase the reliability of our web hosting. The duration of processing is limited to 7 days.

CDN provider – Cloudflare CDN

Parts of our website are hosted by our processor, Cloudflare Germany GmbH, Rosental 7, 80331 München, Germany.
Connection data is processed to provide and deliver the website. Data are not stored beyond access for the mere purpose of delivering and providing the website. However, our processor keeps connection data for security purposes. The duration of processing for security purposes varies and ends with the necessity of the security measures. Furthermore, our processor anonymizes collected data immediately after such data is collected and provides us with statistics for analysis, containing anonymous data. We use these statistics for debugging and the sophistication of our website.

Contact form

You can contact us by using the contact form provided on our website.
You have no legal or contractual obligation to provide personal data. If you do not provide such data, you are simply not able to submit, and we are not able to process your request.

Security services

On our Website, we use the offer of security service providers such as Captcha services to avoid non-human and automated input.

Google reCAPTCHA

If you give your consent, we will process your personal data in cooperation with the service Google reCAPTCHA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as joint controllers for the avoidance of nonhuman and automated inputs. We will enable the service to set third-party cookies, to collect connection data, and data of your web browser. Furthermore, we enable the service to build a personal user ID to conclusively identify the user within the scope of the advertising network operated by Google. The data will be stored on your device for up to two years.
You can revoke your consent by changing the settings in the Privacy settings.
The Google group transfers your personal data to the USA. The legal basis for data transfer to the USA is your consent under Art. 49 Para. 1 a in conjunction with Art. 6 Para. 1 a GDPR.

6c. Your rights

As a data subject, you have certain rights in connection with the processing of personal data, which result from applicable laws and which you may exercise at any time:

Right of access to personal data: If you wish to know whether the Provider processes personal data, you have the right to obtain information as to whether or not your personal data are being processed and, where that is the case, you also have the right to obtain access to your personal data.
Right to rectification of inaccurate personal data and completion of incomplete personal data: If you think that the Provider is processing personal data about you which are inaccurate or incomplete, you have the right to request their rectification and/or completion. The Provider will rectify or complete the date without undue delay, always taking technological capacities into account.
Right to erasure: If you request erasure, the Provider will erase your personal data if (i) the personal data are no longer necessary concerning the purposes for which they were collected or otherwise processed, (ii) the personal data have been unlawfully processed, (iii) you object to the processing and there are no overriding legitimate grounds for the processing of your personal data, or (iv) the legal obligation in EU or national law to process personal data no longer applies.
Right to restriction of processing: If you request restriction of processing, the Provider will make your personal data unavailable, or will temporarily remove or store it, or will perform any other processing activities as may be necessary for the proper exercise of that right.
Right to data portability: If you wish the Provider to transfer to a third party your personal data processed by the Provider electronically based on a contract or your consent, you may exercise your right to data portability. If the exercise of this right adversely affects the rights and freedoms of others, the Provider will not be able to act on your request.
Right to object: The right to object to the processing of personal data for the performance of a task carried out in the public interest or the exercise of official authority, or for the protection of the Provider’s legitimate interests. Unless the Provider demonstrates that compelling legitimate grounds for the processing exist that override the interests, rights, and freedoms of the data subject, the processing will be discontinued without undue delay.

Where requests to exercise the above rights are repetitive or manifestly without legal basis, the Provider may either charge a reasonable fee for the exercise of the relevant right or refuse to act on the request. In that event, you will be informed accordingly.

7. Data protection officer

The Provider is not obliged to appoint a data protection officer.

8. Complaints

You can file a data protection complaint to the Provider via hello@hortikult.com, and you have a right to contact/file a complaint to the Czech Personal Data Protection Office (www.uoou.cz):

Address: Pplk. Sochora 27 170 00 Praha 7, Czech Republic
Email: posta@uoou.cz

9. Final provisions

This Privacy Policy came into effect as of November 1, 2025, and it will be updated regularly.