PlantXPrivacy Policy
What personal data the operator of PlantX collects for its own purposes, why, who it is shared with, how long it is kept, and the rights you have.
1.Who We Are And What This Covers
PlantX is provided by the operator of PlantX ("we", "us", "our"). This Policy explains how we handle personal data for which we decide the purposes and means - as a "controller" under the GDPR and a "data fiduciary" under India's Digital Personal Data Protection Act, 2023.
It covers: the people at our customers who buy, administer or contact us about PlantX; people who receive a setup link or an invitation from us; anyone who visits these pages or writes to us; and the security and usage records we keep about everyone who signs in.
It does not cover the personal data a customer company puts into PlantX about its own employees, contract workers, visitors, vendors and other people. For that data the customer is the controller and we process it on the customer's behalf under our Data Processing Addendum; the customer's own privacy notice explains it, and requests about it should go to that company.
2.What We Collect
- Identity and contact details: name, business email address, telephone, job title and the company you act for.
- Account details: your username, the seats you hold, your sign-in sessions, the devices you have linked, and your settings such as language and appearance.
- Billing details: the company's legal name, address, tax registration and place of supply; the Orders, invoices and payments; and the payment method's type and reference as the payment gateway reports it. Card numbers and bank credentials are entered at the payment gateway and are not received or stored by us.
- Communications: what you write to us in support requests, emails and messages, and our replies.
- Security and usage records: the address a request came from, the browser or app and its version, the time, the page or programming interface called, errors, and the sign-in attempts made.
- Cookies: only those the Services need to work, as the Cookie Notice describes.
3.Why We Use It And On What Basis
| Purpose | Basis |
|---|---|
| To provide the Services under our agreement with your company: setting up its account, signing you in, delivering what was ordered, and supporting you. | Performance of a contract, and our legitimate interest in serving the companies we contract with. |
| To invoice, collect payment, keep accounts and meet our tax obligations. | Compliance with a legal obligation, and performance of a contract. |
| To keep the Services secure: preventing fraud and abuse, detecting and investigating incidents, and limiting sign-in attempts. | Our legitimate interest in the security of the Services and of our customers' data, and compliance with a legal obligation. |
| To tell you about changes to the Services, these documents, your Orders and renewals. | Performance of a contract, and our legitimate interest in keeping customers informed. |
| To understand how the Services are used and to improve them, from records that do not identify you wherever that is enough. | Our legitimate interest in improving the Services. |
| To meet a demand of a court or a competent authority, and to establish, exercise or defend legal claims. | Compliance with a legal obligation, and our legitimate interests. |
Where India's law applies, we process your personal data for the purpose for which you gave it to us, or for a legitimate use that the Digital Personal Data Protection Act, 2023 permits, including compliance with the law. Where we rely on your consent, you may withdraw it at any time, without affecting what was done before.
We do not sell personal data, do not use it for advertising, and do not send marketing messages without your consent where the law requires it.
5.Transfers Between Countries
Some of our service providers process personal data outside the country where you are, as the Subprocessors list states. Where the law requires a safeguard for such a transfer, we use one - such as the European Commission's Standard Contractual Clauses - and we do not transfer personal data to a country to which India's Central Government has restricted transfers.
6.How Long We Keep It
We keep account and contact details for as long as the account they belong to exists, and for a reasonable period afterwards to answer questions and resolve disputes. We keep invoices, records of payment and the accounts they form part of for eight (8) years, or longer where a law requires it. We keep security records for as long as they are needed to protect the Services and to investigate incidents. When personal data is no longer needed, we delete it or make it anonymous.
7.Your Rights
Depending on the law where you are, you may have the right to: access the personal data we hold about you and information about how we use it; have it corrected, completed or updated; have it erased; restrict or object to its use, including use based on our legitimate interests; receive it in a portable form; withdraw a consent you gave; and, under India's law, nominate another person to exercise your rights in the event of your death or incapacity and have a grievance redressed.
To exercise a right, write to our Grievance Officer at the address below. We may need to verify your identity first. We respond within thirty (30) days, and tell you if we need longer and why.
If you are not satisfied with our response, you may complain to the authority that protects personal data where you are - in India, the Data Protection Board of India; in the European Union, the supervisory authority of your country; in the United Kingdom, the Information Commissioner's Office.
8.How We Protect It
We protect personal data with the measures described in Annex 2 of our Data Processing Addendum, including encryption in transit, hashed passwords, short-lived sessions, limits on sign-in attempts, separation between companies and controls on who may see what. No system is completely secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.
9.Children
PlantX is a service for businesses and is not intended for anyone under eighteen (18) years of age. We do not knowingly collect personal data of children; if we learn that we have, we delete it.
10.Changes To This Policy
We may change this Policy. Each version is numbered and dated, and every earlier version remains available at https://app.plantx.si/legal. We will tell your company's administrator in the Services of a significant change before it takes effect.
11.Contact And Grievance Officer
| Grievance Officer's email | support@plantx.si |