Privacy policy

HSMN, trading under the name HSMN Planten, attaches great value to protecting your personal data. This privacy policy describes how we process personal data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Dutch AVG Implementation Act. We only process the personal data necessary for fulfilling your order and managing your account.

1. Controller

The controller for your personal data is:

• HSMN (trading as HSMN Planten)
• Registered address: A.G. Wijersweg 23, 6733 AR Wekerom, Netherlands
• Chamber of Commerce number: 88667189
• VAT identification number: NL004642005B25
• Email: administratie@hsmn.nl
• Phone: +31 (0)6 57819705

Do you have questions about the processing of your personal data or want to exercise one of your rights? Then contact us at administratie@hsmn.nl.

2. Which personal data we process

We may process the following categories of personal data:

• Contact and account data: name, email address, (optional) phone number and profile details you fill in.
• Order data: chosen products, quantities, sizes, the delivery address and any remarks with your order.
• Payment data: payment status and transaction ID. Your card details are processed by our payment service (Stripe) and not stored by us.
• Communication: messages you send us by email or via the contact form.
• Technical data: IP address, browser type and pages visited within our website, for security and website improvement.
• Gift card and recipient data: name and email address of the beneficiary you specify for a gift card.
• Community data: your first name (we never show other members your full name or email address), messages and images you share in communities.
• Reviews: your rating and experience story for a product, under your display name.
• Reward points (loyalty): your points balance and transaction history, linked to your account.
• Wishlist: the products you add to your wishlist.

3. Purposes and legal grounds

We process personal data for the following purposes:

• Performance of the contract (delivering your order, processing payment, sending the invoice and providing customer service). Legal basis: Art. 6(1)(b) GDPR.
• Compliance with legal obligations , such as keeping financial records and invoices for tax and customs legislation. Legal basis: Art. 6(1)(c) GDPR.
• Legitimate interest : securing our services, preventing fraud and abuse, and being able to respond to questions. Legal basis: Art. 6(1)(f) GDPR.
• Consent : if you have indicated you want to receive newsletters, offers or seasonal news. Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe at any time via the unsubscribe link or by emailing us.

4. Retention periods

We do not keep personal data longer than necessary for the purpose for which they were collected, or longer than legally required:

• Order and financial data (invoices, payment data): 7 years, based on tax retention legislation.
• Account data: as long as your account is active, and thereafter for the period needed to settle any liability or complaints.
• Communication and customer service: 1 to 2 years, unless a longer period is legally required.
• Marketing data: until you unsubscribe or object.

5. With whom we share data

We share your personal data only insofar as necessary for the provision of our services or to comply with legislation:

• Processors who provide services on our behalf: our payment service (Stripe), hosting and platform provider (Base44) and carriers (such as PostNL, DHL, GLS) for plant delivery.
• Government authorities , including the Tax and Customs Administration, when we are legally obliged to provide data.
• We never sell your personal data to third parties.

Our processors have a processing agreement with us stipulating that they use and secure your data only for the agreed purposes.

Logging in with Google

When you choose to log in with Google, we receive via Google only the data needed to recognise and secure your account, such as your email address, unique Google account identifier and possibly your name and profile photo. We use this data solely for creating, securing and managing your HSMN Planten account. We do not post messages on your behalf, do not get access to your Google password and do not sell this data to third parties. You can have your account and associated data deleted by contacting administratie@hsmn.nl.

6. Transfer outside the European Economic Area (EEA)

Transfer of personal data outside the EEA only takes place if the recipient offers an adequate level of protection (for example an adequacy decision by the European Commission) or when Standard Contractual Clauses of the European Commission have been agreed. Where required, we ask for your consent in advance. You can withdraw your consent at any time.

Community, reviews and user-generated content

The following specific arrangements regarding your personal data apply to our community and review features:

• Only your first name visible: in communities we show other members only your first name. Your full name and email address are never visible to other members.
• Visibility of content: messages and images you share in a community are visible to the members of that community. Reviews you post are visible to all visitors of the website.
• Moderation: we moderate user-generated content. Swear words and inappropriate language are automatically blocked. In addition, owners and co-owners of a community, as well as the entrepreneur, may remove messages and remove members in case of abuse.
• Own responsibility: you are yourself responsible for the content you post and may not infringe the rights of third parties (such as copyright on images) or post unlawful texts.
• Deletion: when a community is deleted, all associated messages are permanently erased. You can delete your own messages and your membership at any time.
• Retention period: community messages are kept as long as the community exists; after deletion they are immediately erased. Reviews are kept as long as the product is active, unless they are deleted.
• Legal basis: the processing is based on performance of the contract (community and account functionality, Art. 6(1)(b) GDPR) and our legitimate interest in providing a safe, respectful environment (Art. 6(1)(f) GDPR).

7. Your rights (GDPR)

Under the GDPR you have the following rights:

• Access to the personal data we process about you (Art. 15 GDPR).
• Rectification of incorrect or incomplete data (Art. 16 GDPR).
• Erasure / right to be forgotten , unless there is a legal retention obligation (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Objection to processing (Art. 21 GDPR) and objection to direct marketing (Art. 21(2) GDPR).
• Data portability of the data you have provided to us (Art. 20 GDPR).
• Withdrawal of consent for processing based on consent, without affecting the lawfulness of earlier processing (Art. 7(3) GDPR).

You can exercise these rights by sending an email to administratie@hsmn.nl, stating your name and email address. We will identify you for security and respond within one month of receiving your request (extendable by two months for complex requests).

8. Security

We take appropriate technical and organisational measures to secure your personal data against loss, misuse and unauthorised access — including encrypted connections (HTTPS), access restrictions and secure storage via our platform and hosting partners. Should a data breach nevertheless occur, we will report it — where applicable — to the Dutch Data Protection Authority and, if necessary, to you.

9. Cookies and similar techniques

Our website uses functional cookies that are necessary for the website to work properly (such as remembering your shopping cart and your language and VAT preference) and, where applicable, analytical cookies to measure website usage. Functional cookies cannot be freely refused; we only ask for analytical cookies with your consent. You can manage or delete cookies at any time via your browser settings.

10. Children and minors

Our services are not aimed at children under 16. We do not knowingly collect personal data from children under 16. Unsure whether you are too young? Then contact us at administratie@hsmn.nl.

11. Filing a complaint

Do you believe we do not handle your personal data carefully? Then first raise this with us. In addition, you always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

12. Changes to this privacy policy

We may adjust this privacy policy from time to time, for example due to changes in legislation or our services. The most current version is always on this page.

13. Questions?

Do you still have questions after reading this privacy policy? Feel free to contact us at administratie@hsmn.nl or +31 (0)6 57819705. We are happy to help.