Privacy policy

Privacy Policy

Pretty Plants – Céline Merkle

This is an English translation provided for your convenience. In case of any discrepancy, the German version ("Datenschutzerklärung") is legally binding, and German/EU data protection law (Datenschutz-Grundverordnung, DSGVO / GDPR) applies.

With the following information, we would like to give you, as a "data subject," an overview of how we process your personal data and of your rights under data protection law. The specific data processed and how it is used depends largely on the services you use or have agreed to.

1. Controller

Céline Merkle – Pretty Plants Schlesierstraße 6 89233 Neu-Ulm Germany

Phone: +49 174 4556696 Email: hello@pretty-plants.com

Competent supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

2. Access Data and Hosting

You can visit our website without providing any personal information. Each time you access a page, our hosting partner automatically stores so-called server log files, which your browser transmits to us. These include in particular:

  • the page accessed
  • the date and time of access
  • the amount of data transferred
  • the browser used and its version
  • the operating system
  • the IP address
  • referrer URL (the previously visited page)

This data is evaluated exclusively to ensure the smooth operation of the website and to improve our offering. This processing serves our legitimate interest in the correct presentation and optimization of our website. The legal basis is Art. 6 (1)(f) GDPR. This data is not combined with your personal data.

Hosting by Shopify

Our online shop is hosted on the servers of Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter "Shopify"). We have entered into a data processing agreement with Shopify pursuant to Art. 28 GDPR, obligating Shopify to protect our customers' data and not disclose it to third parties. Further information can be found in Shopify's privacy policy: https://www.shopify.com/legal/privacy

A transfer of data to the parent company Shopify Inc. in Canada, and, for certain processing activities, to the USA, cannot be ruled out. Canada has been recognized by the European Commission as a country with an adequate level of data protection (Art. 45 GDPR). For transfers to the USA, we have agreed on EU Standard Contractual Clauses with Shopify pursuant to Art. 46 (2)(c) GDPR; to the extent Shopify is certified under the EU-U.S. Data Privacy Framework, the transfer additionally takes place on this basis.

3. Data Collection and Use for Contract Processing and Customer Accounts

We collect personal data when you provide it to us as part of your order or when contacting us (e.g. via contact form or email). The data collected is evident from the respective input forms. Mandatory fields are marked as such. Required for the formation of the contract are, in particular, your name, billing and delivery address, email address, and – depending on the payment method chosen – the corresponding payment details.

This data is processed for the purpose of contract fulfillment on the basis of Art. 6 (1)(b) GDPR.

You may optionally create a customer account in our shop. Through the customer account, we can store your data for future purchases so you do not have to re-enter it. The creation of the customer account is based on Art. 6 (1)(b) GDPR or, where applicable, on your consent pursuant to Art. 6 (1)(a) GDPR. You may have your customer account deleted at any time by sending a message to hello@pretty-plants.com.

After the contract has been fully processed, your data will be restricted from further processing and deleted upon expiry of the statutory tax and commercial retention periods (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB) – depending on the type of document, 6, 8, or 10 years), unless you have expressly consented to further use of your data, or we reserve a further use of data that is permitted by law.

4. Disclosure of Data

To fulfill the contract, we disclose your data to the following recipients, to the extent necessary for processing. The legal basis is Art. 6 (1)(b) GDPR (contract performance).

4.1 Shipping Service Providers

To deliver the goods, we transmit your name and delivery address, as well as – where necessary for delivery – your email address and phone number, to the commissioned shipping company.

For shipping, we work in particular with Deutsche Post AG / DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, as well as with DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany. Information on data processing can be found at: https://www.dhl.de/de/toolbar/footer/datenschutz.html and https://www.dpd.com/de/de/datenschutz/

4.2 Payment Service Providers

For payment processing, we pass on the necessary payment data to the payment service providers or credit institutions selected by you during the checkout process. In some cases, the payment service providers also collect the data themselves. The data collected and processed is set out in the privacy notices of the respective provider.

5. Data Processing for Order Fulfillment and the Plant Passport

To process your order, we work with service providers who support us, in whole or in part, in fulfilling it. Personal data is disclosed to these providers only to the extent necessary for the respective service. We have entered into data processing agreements with these service providers pursuant to Art. 28 GDPR.

Plant Passport under the EU Plant Health Regulation

Pursuant to Regulation (EU) 2016/2031 (Plant Health Regulation) and Implementing Regulation (EU) 2017/2313, we, as an authorized operator, are required to keep records of the shipment of certain plants within the EU and to issue a plant passport. For this purpose, we process your name and delivery address for traceability purposes. Our plant passport registration number is DE-BY-117549. The legal basis is Art. 6 (1)(c) GDPR (compliance with a legal obligation).

6. Use of Your Data for Direct Marketing

6.1 Subscribing to Our Email Newsletter

If you subscribe to our newsletter, we use the data required for this purpose, or data you have separately provided, to regularly send you our email newsletter with information on new plants, care tips, and promotions.

Subscription takes place using the so-called double opt-in procedure: after you subscribe, you will receive an email with a confirmation link; by clicking this link, you confirm your subscription to the newsletter. Only after this confirmation will you receive our newsletter. This ensures that only the holder of the specified email address can subscribe to the newsletter.

You may unsubscribe from the newsletter at any time, for example via a link at the end of every newsletter email, or by sending a message to hello@pretty-plants.com. The legal basis for this processing is your consent pursuant to Art. 6 (1)(a) GDPR in conjunction with Section 7 (2) No. 3 of the German Act Against Unfair Competition (UWG).

6.2 Advertising for Our Own, Similar Products to Existing Customers

If you have provided us with your email address in connection with a purchase, we reserve the right to regularly send you offers for similar products from our range by email. The legal basis is Section 7 (3) UWG in conjunction with Art. 6 (1)(f) GDPR (legitimate interest in direct marketing).

You may object to this use of your email address at any time by sending a message to hello@pretty-plants.com or via the unsubscribe link contained in every email, at no cost other than the transmission costs according to the basic rates.

7. Cookies and Analytics

Our website uses cookies. Cookies are small text files stored on your device that store certain settings and data for exchange with our shop via your browser.

We generally use two types of cookies:

  • Technically necessary cookies: These are required for our website to function (e.g. shopping cart function, storing language settings, session management, checkout). The legal basis is Section 25 (2) No. 2 of the German Telecommunications-Telemedia Data Protection Act (TTDSG) as well as our legitimate interest in a functioning online shop pursuant to Art. 6 (1)(f) GDPR.
  • Analytics cookies and non-essential cookies: Our hosting partner Shopify collects aggregated information about the use of our website (e.g. page views, visit duration, devices used) to provide us with statistical analyses. We use this information to improve our offering. The legal basis is your consent pursuant to Section 25 (1) TTDSG in conjunction with Art. 6 (1)(a) GDPR.

You can configure your browser so that cookies are only set with your consent, only stored for the current session, or rejected entirely. Disabling cookies may limit the functionality of our website. You may withdraw your consent to the use of non-essential cookies at any time, with effect for the future, via the cookie settings on our website.

8. Use of Social Media

We do not use any active social media plugins on our website. We only link to our profiles on social networks. Only when you actively click on one of these links is data transmitted to the respective provider. The operators of the linked platforms are solely responsible for data processing on those platforms.

Our Instagram profile is subject to the privacy notices of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland: https://privacycenter.instagram.com/policy

9. How to Contact Us and Your Rights

As a data subject, you have the following rights with respect to your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw consent given, with effect for the future (Art. 7 (3) GDPR)
  • Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

To exercise your rights, or for any other questions regarding data protection, please contact:

Pretty Plants – Céline Merkle Schlesierstraße 6, 89233 Neu-Ulm, Germany Email: hello@pretty-plants.com

The competent data protection supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

10. Right to Object

Insofar as we process personal data as described above in order to safeguard our legitimate interests, which predominate within the context of a balancing of interests, you may object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time as described above. If the processing is carried out for other purposes, you have a right to object only for reasons arising from your particular situation.

After you exercise your right to object, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims. This does not apply if the processing is carried out for direct marketing purposes; in that case, we will no longer process your personal data for that purpose.

As of: July 2026