1. Who we are
Plantbrod AS, trading as Plantbrød (“Plantbrød”, “we”, “us”), is the controller of personal information used through plantbrod.com, our customer accounts and our direct customer communications.
For privacy questions or rights requests, email account@plantbrod.com. Postal correspondence may be sent to Plantbrød, Kiln Farm, Milton Keynes, Buckinghamshire, MK11 3EW, United Kingdom.
2. Information we collect
- Identity and contact details: name, email address, delivery and billing address, and telephone number if you provide one.
- Account details: login identifier, encrypted authentication information, account preferences and subscription status.
- Order information: products, plan, price, discounts, order history, delivery status, returns and customer-service records.
- Payment information: payment status, Stripe customer or transaction references, and limited card information such as brand and last four digits. Stripe processes full card details; Plantbrød does not store them.
- Marketing preferences: whether you asked to receive or stop receiving updates.
- Messages: information you send through our contact form, email or support conversations.
- Technical information: IP address, device/browser details, security logs and essential cookie or local-storage data.
We usually collect information directly from you. We may also receive payment information from Stripe, delivery updates from Royal Mail, and security or account events from Netlify.
3. How and why we use information
| Purpose | Typical information | Lawful basis |
|---|---|---|
| Take payment, fulfil orders and manage subscriptions | Contact, order, account and payment-reference data | Performance of our contract with you |
| Create and secure customer accounts | Identity, login and technical security data | Contract and our legitimate interest in protecting accounts |
| Deliver orders and handle returns, refunds and support | Contact, delivery, order and message data | Contract; legal obligations; legitimate interests in customer service |
| Maintain business, tax and transaction records | Order, payment-reference and correspondence data | Legal obligation and legitimate interests |
| Prevent fraud and protect the website | Payment, account and technical data | Legitimate interests and, where applicable, legal obligation |
| Send requested marketing | Name, email and preferences | Consent, or the UK “soft opt-in” where legally available; you can opt out at any time |
| Improve products and service | Feedback and aggregated order/support trends | Legitimate interests, using de-identified information where practical |
5. How long we keep information
We keep information only for as long as needed for the purposes above. Typical periods are:
- order, payment and tax records: up to seven years after the relevant transaction or financial year;
- account information: while the account is active and normally up to two years after closure, unless a longer period is needed for a dispute or legal duty;
- customer-service messages: normally two years after the enquiry closes;
- marketing records: until you opt out, followed by a minimal suppression record so we respect that choice; and
- security logs: normally up to twelve months unless an incident requires longer investigation.
We may keep information longer when reasonably necessary for a legal claim, regulatory enquiry, fraud prevention or another legal requirement.
6. Your data-protection rights
Depending on the circumstances, UK data-protection law gives you rights to:
- ask for a copy of your personal information;
- correct incomplete or inaccurate information;
- ask us to erase information;
- restrict or object to certain uses;
- receive information you supplied in a portable format;
- withdraw consent at any time, without affecting earlier lawful use; and
- complain to a supervisory authority.
These rights are not absolute. We may need to verify your identity and may retain information where law permits or requires it. We do not use solely automated decisions that produce legal or similarly significant effects.
Marketing
Use the unsubscribe link in a marketing email or contact us at any time. Service messages about orders, account security or subscriptions are not marketing and may still be sent when necessary.
Children
Our posters are made for families, but purchases and customer accounts are for adults. We do not knowingly create accounts for, or directly collect personal information from, children under 13.
7. Questions and complaints
Email account@plantbrod.com if you want to exercise a right or raise a concern. We will normally respond within one month.
You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to help first.
We may update this notice when our services, providers or legal duties change. The date above identifies the latest version. See our Cookie Notice for information about device storage.