Privacy policy

PlantSpec is a UK marketplace that connects landscape professionals with wholesale plant nurseries. The website at plantspec.co.uk is run by PlantSpec's founders in the United Kingdom (“PlantSpec”, “we”, “us”).

We are the controller of the personal data described in this policy, which means we decide how it is used and are responsible for looking after it under UK data protection law (the UK GDPR and the Data Protection Act 2018).

If you have any question about this policy or your data, email us at sbplantspec@gmail.com.

When you create an account: your name, your business name, your email address and whether you are a buyer or a nursery. We can see these details so we can run your account and contact you. You also choose a password, which is stored only in encrypted form, so nobody at PlantSpec can ever see it. We may add a Companies House number and a verification status when we check your business.

When you use PlantSpec as a buyer: the plants you save, your specifications and basket, and the order requests you send, including project references, purchase order numbers, site addresses, delivery dates, access notes and notes to nurseries.

When you use PlantSpec as a nursery: your stock lists and prices, your location and delivery area, your VAT basis and discounts, and any invoice details you add, such as your business address, VAT number and bank details.

Messages: what you write to the buyers or nurseries you deal with through PlantSpec.

When you join the waitlist, contact us or book a demo: your name, email address, business name, the type of account you are interested in, your message, and the time you book.

Technical information: our hosting provider records basic technical details, such as your IP address, browser and the pages you request, to run the site and keep it secure. We do not use analytics or advertising tracking.

• To provide your account and the marketplace, including sending order requests, messages and invoices between buyers and nurseries. We do this to perform our contract with you.
• To send emails about your account, such as confirming your email address, resetting your password, and telling you about orders, messages and invoices. This is part of providing the service.
• To verify businesses before their stock goes live, and to keep the site secure and prevent misuse. This is in our legitimate interests, and yours, in running a trustworthy trade marketplace.
• To reply to you and tell you about our launch when you join the waitlist, contact us or book a demo. We rely on your consent or our legitimate interests, and you can ask us to stop at any time.
• To understand and improve the marketplace, such as which plants are in demand, how prices compare and how the market changes over time. We do this in our legitimate interests. Anything we share outside PlantSpec, such as market reports, is combined and anonymised so that no business or person can be identified.
• To keep business and tax records, such as order and invoice records. This is a legal obligation.

We never sell your data, and we do not use it for advertising.

Other PlantSpec users, only where needed for a trade. When a buyer sends an order request to a nursery, that nursery sees the buyer's business name, the order details, the delivery address and the notes written for it, and can message the buyer and send them invoices. Buyers see nurseries' business names, stock, prices and general location. Messages are seen only by the buyer and the nursery in that conversation.

The companies that run parts of our service for us, who only use your data on our instructions:

• Supabase: our database and account system. Your account data is stored in London.
• Vercel: hosts the website.
• Resend: sends our emails.
• Formspree: handles the waitlist and contact forms.
• Cal.com: handles demo bookings, if you choose to book one.

We will add payment providers to this list before taking payments on PlantSpec. We may also share data if the law requires it, or with professional advisers such as our accountant.

Some of these companies are based in, or use servers in, the United States or the EU. Where your data leaves the UK, we make sure it is protected as UK law requires, using UK adequacy regulations (including the UK extension to the EU–US Data Privacy Framework) or the standard contract terms approved by the Information Commissioner.

• Account details: for as long as your account is open, then deleted within 90 days of closing it.
• Order requests, invoices and the business records around them: six years from the end of the tax year they relate to, as UK tax law requires.
• Messages: for as long as either account in the conversation is open.
• Waitlist and enquiry details: until launch plus 12 months, or sooner if you ask us to remove them.

You have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct anything that is wrong
• ask us to delete your data, where we no longer need to keep it
• object to, or ask us to restrict, how we use it
• ask for your data in a format you can take to another service
• withdraw your consent at any time, where we rely on it

To use any of these rights, email sbplantspec@gmail.com. We will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we would like the chance to put things right first.

All traffic to PlantSpec is encrypted. Access to data is controlled in the database itself, so each user can only reach their own information and what has been shared with them for a trade. Passwords are never stored in readable form.

We only use the cookies the site needs to work, such as keeping you signed in. See our cookie policy for the details.

PlantSpec is a trade service for businesses and is not intended for anyone under 18.

We will update this page when the way we handle data changes, and change the date at the top. If a change is significant, we will tell account holders by email.