Privacy statement

Esverde B.V. is responsible for the processing of personal data as described in this privacy statement.

We only process data that you give us yourself, or that is needed to keep the website secure:

• Contact details: name, company name, email address and phone number.
• The content of your request: subject, selected items and quantities, preferred delivery week, type and your message.
• Data needed for quotes, orders and invoices, such as billing and delivery address and VAT number.
• The IP address and time at which the contact form was sent, to prevent spam and abuse.

We do not ask for or process special categories of personal data. The website is aimed at businesses and is not intended for people under the age of 16.

We use your data for the following purposes, each based on a legal ground under the GDPR:

• Answering your request and making you a proposal or quote (your consent via the contact form, and steps prior to entering into a contract).
• Processing, delivering and invoicing orders (performance of the contract).
• Meeting legal obligations, such as tax record-keeping and the rules on plant health and traceability (legal obligation).
• Protecting the website and the contact form against spam and abuse (legitimate interest).

We do not use your data for automated decision-making or profiling, and we do not sell it to third parties.

We do not keep personal data longer than necessary:

• Messages sent via the contact form, with the related IP address: twelve months after receipt. They are then deleted automatically.
• Data of customers and suppliers: for as long as the business relationship lasts, and after that for as long as our records require.
• Invoices and other accounting records: seven years, as required by law.

We only share your data when this is needed for the purposes above, or when the law requires us to. For the website we work with the following service providers (processors):

• Vercel: hosting of the website.
• Supabase: the database in which messages from the contact form are stored.
• Cloudflare: storage of the photos on the website, and Turnstile, a spam check on the contact form.
• Our email provider: forwarding messages from the contact form to us.

We have agreements with these parties about the security and confidentiality of your data. Some of them may process data outside the European Economic Area. Where they do, this is based on the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.

To carry out orders, we share the necessary data with carriers and, where required by law, with the authorities that supervise imports and plant health.

Esverde does not use cookies for advertising, statistics or tracking visitors. We only set functional cookies that are needed for the website to work:

• A cookie that remembers your language choice.
• Cookies for the secure management area and for preview links. These are only set for administrators and for people who received such a link from us.

These functional cookies do not require consent. The spam check (Cloudflare Turnstile) works without tracking cookies.

We take appropriate technical and organisational measures to protect your data against loss and unauthorised use. The website uses an encrypted connection (HTTPS), the management area is protected with two-step verification and only authorised staff have access to your data.

If you feel your data is not properly secured, or if there are signs of misuse, please contact us at info@esverde.nl.

You have the right to:

• access your data;
• have incorrect data corrected;
• have your data deleted;
• have the processing restricted;
• object to the processing;
• receive your data in a common format or have it transferred;
• withdraw any consent you have given.

Send your request to info@esverde.nl. We may ask you to identify yourself, so we can be sure the request comes from you. We will respond within one month.

Not happy with how we handle your data? Let us know and we will work with you to find a solution. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

We may update this privacy statement, for example when our services or the law change. The latest version is always on this page; the date at the top shows when it was last updated.