Privacy policy

1....... What is this privacy policy about?. 1

2....... Who is responsible for processing your data?. 2

3....... What data do we process?. 2

4....... For what purposes do we process your personal data?. 2

5....... How do we process data in connection with our website?. 2

6....... How do we process data for social media appearances?. 2

7....... How do we process data for newsletters?. 2

8....... How do we use profiling?. 2

9....... How do the Planted-companies work together?. 2

10..... How do we work with service providers and distributors?. 2

11..... Can we disclose data abroad?. 2

12..... On what legal basis is data processing based?. 2

13..... How long do we process your personal data?. 2

14..... What rights do you have?. 2

What is this privacy policy about?

Planted Foods GmbH, Birkenstr. 22, 10559 Berlin, Germany (hereinafter "Planted" or "we") processes personal data concerning you or other persons in different ways and for different purposes. "Personal data" or hereinafter also referred to as "data" is information that can be associated with a specific person and "processing" means any handling of it, e.g. obtaining, storing, using, disclosing and deleting it.

This Privacy Policy explains our processing of such information when you

purchase products online from us,
Join our loyalty or referral program,
you are otherwise associated with us under a contract (e.g. as a distributor, restaurant, supplier or their contact person),
communicate with us,
you visit our website,
you register for services (e.g. our newsletter),
participate in contests, sweepstakes, or surveys,
in the context of all further data processing, which are in connection with our offers, have to do with us.

We have aligned this privacy statement with both the Swiss Data Protection Act(DPA) and the European General Data Protection Regulation(GDPR). If the privacy policy refers to "personal data" and "process", this also includes "personal data" and "process" according to the GDPR. Whether and to what extent the DPA or the GDPR is applicable depends on the individual case.

When you provide us with information about other people, we assume that you are authorized to do so and that the information is accurate. Please make sure that these persons have been informed about this privacy policy.

If you have any questions or would like further information about our personal data processing, please do not hesitate to contact us. You will find our contact details in section 2.

Who is responsible for processing your data?

For the data processing according to this privacy policy, Planted is the "responsible party", i.e. thepartyprimarily responsible under data protection law, unless otherwise communicated below and in individual cases.

If you have any questions about privacy, please feel free to contact us at the following address:

Planted Foods Ltd.

Birkenstr. 22

10559 Berlin

Germany

Email: shop@eatplanted.com

What data do we process?

We process different categories of personal data depending on the purpose. For your orientation, you will find the most important categories below, whereby this list is not exhaustive. Information on the purposes of this processing can be found in section 4.

Master data

We refer to master data as data that we require for the processing of our business relationships or for marketing and advertising purposes and that relates to your person. For example, we process the following master data and, if you provide us with additional master data, these as well:

Name;
Shipping and billing address;
E-mail address;
Phone number;
in the case of company contacts, also relationships with the company for which you work.
- Contract data

Contract data is information that arises in connection with the conclusion or execution of a contract. We conclude contracts primarily with business partners (especially suppliers) and customers. We process the following contract data, for example:

Date, application process, information on the type and duration and conditions of the contract in question;
Contact details and delivery addresses;
Information about accumulated loyalty points in our loyalty program; information about which customers were acquired through our referral program and who recommended us to them; information about use of services, receivables, invoices and payments, as well as chosen payment methods;
Information on financial matters such as the determination of creditworthiness (i.e. information that allows conclusions to be drawn about the likelihood that receivables will be paid) that may be processed by our service provider (see section 10), reminders, collection and enforcement of receivables;
Information on customer satisfaction, complaints, feedback, etc.
- Communication data

Communication data is data in connection with our communication with you, e.g. when you are in contact with us via e-mail or other means of communication. We collect the data exchanged between you and us, including your contact details and the peripheral data of the communication (e.g. time, type and place of communication).

To the extent necessary (e.g., if you submit a request for information), we also collect data to identify you, such as a copy of an identification document.

Technical data

Technical data is generated in connection with the use of our website. This includes, for example, the following data:

IP address of the end device and device ID;
Information about your terminal device, e.g. the operating system or language settings;
Information about your Internet provider;
accessed content or logs in which the use of our systems is recorded;
Date and time of access to the website and your approximate location;
Information about the accessed content and files in your user account.

We may also assign an individual code to your terminal device (e.g. by means of a cookie; see section 5). This code is stored for a certain period of time, often only during your visit. We cannot usually deduce who you are from technical data, unless you register on our website, for example. In this case, we can link technical data with master data - and thus with your person.

Behavioral and transactional data

When you purchase our products or use our services, we often collect data about your behavior or purchases. This is the case, for example, when you assign purchases from our sales partners to your loyalty ID (e.g., for the crediting of points), make purchases in the online store or when you visit our website. Behavioral and transactional data includes, for example, the following information, insofar as it is available to us on a personal basis:

about your purchasing behavior (e.g., how often, what and at what prices you purchase, as well as the type of payment method and delivery method you choose);
about your behavior in the online store (ordered and abandoned shopping cart, watch lists, viewed items, search terms and results, submitted ratings and comments, etc.);
about participation in contests, sweepstakes and similar events;
about your use of electronic communications (e.g., whether and when you opened an email or clicked on a link).

You can also use many of our offers anonymously. For example, you can store with our business partners without providing your loyalty ID. If you have a user account, behavioral and transaction data may be assigned to your profile even if you are not logged in when you visit the website.

Preference data

We want to tailor our offers and services to our customers in the best possible way. We therefore also process data about your interests and preferences. For this purpose, we can link behavioral and transaction data with other data and evaluate this data on a personal and non-personal basis. This allows us to draw conclusions about characteristics, preferences and expected behavior, e.g. your preferences and affinities for certain products and services.

For what purposes do we process your personal data?

We process personal data in particular for the following purposes:

We process your data for the conclusion, execution and enforcement of contracts with you or with the company for which you work. In this context, we also process data to decide whether and how (e.g. with which payment options) we enter into a contract with you (including the credit check); for this purpose, we process in particular master data and contract data.
We process your data in connection with communication withyou, e.g. to respond to inquiries and assert your rights and to contact you in the event of queries. For this purpose, we use communication data in particular, and possibly also master data. We keep this data in order to document our internal communication with you and to be able to answer queries.
We also process data for statistical evaluations. Such evaluations support the improvement and development of products and business strategies. We may also use it on a personal basis for marketing purposes; see below.
We also process data for market research, marketing purposes and customer care. For example, we may send you information, advertisements and product offers from Planted or display them on third-party sites and platforms. Like most companies, we also personalize marketing and other communications so that we can provide you with information and offers that are relevant to you. For these purposes, we use in particular your behavioral and preference data and, if applicable, master data.
To ensure IT security and prevention: We process personal data to ensure IT security, to prevent fraud and abuse, and for evidentiary purposes.
To comply with laws, directives and recommendations from authorities and internal regulations ("Compliance"). For these purposes, we use in particular your master data and contract data.
Under certain circumstances, we also process personal data for the purpose of legal protection, i.e. to enforce claims in or out of court and before authorities in Switzerland and abroad, or to defend ourselves against claims. For these purposes, we use in particular your master data, communication data and contract data.
If we sell or acquire receivables, other assets, business units or companies, we process data to the extent necessary to prepare and execute such transactions, e.g. information about customers or their contact persons or employees, and also disclose corresponding data to buyers or sellers.
other purposes: Very many processes are not possible without processing personal data, including usual and even unavoidable internal processes. We process data to the extent necessary for other purposes such as training and education, administration (e.g. contract management, accounting, evaluation and improvement of internal processes and safeguarding other legitimate interests.

You can object to processing for marketing purposes by notifying us, also for individual communication channels (e.g. only advertising via e-mail) or for specific advertising campaigns (see section 14).

How do we process data in connection with our website?

Every time you use our website, technical data is generated (see section 3.4). We use this data so that our website can be used, to ensure system security and stability and to optimize our website, and for statistical purposes.

Our website also uses cookies, i.e. files that your browser automatically saves on your terminal device. This allows us to distinguish individual visitors, but usually without identifying them. Cookies may also contain information about pages viewed and the duration of the visit. Certain cookies ("session cookies") are deleted when you close your browser. Others ("persistent cookies") remain stored for a certain duration so that we can recognize visitors on a subsequent visit. We may also use other technologies, e.g. to store data in the browser, but also for recognition purposes, e.g. pixel tags. Pixel tags are invisible images or a program code that are loaded from a server and thereby transmit certain information.

In some cases, when you access our website, you have the option of activating or deactivating certain categories of cookies via a button displayed in the browser. Furthermore, you can configure your browser in the settings so that it blocks certain cookies or similar technologies or deletes cookies and other stored data. You can find more about this in the help pages of your browser (usually under the keyword "Privacy").

These cookies and other technologies may also come from third-party companies that provide us with certain functions. These may also be located outside of Switzerland and the EEA (see section 11 for details). For example, we use analytics services so that we can optimize our website. For this purpose, the corresponding third-party providers may record the use of the website and combine their recordings with further information from other websites. In this way, they can record user behavior across multiple websites and end devices in order to provide us with statistical evaluations on this basis. The providers may also use this information for their own purposes, e.g. for personalized advertising on their own website or other websites. If a user is registered with the provider, the provider can assign the usage data to the relevant person.

Two examples of third-party providers are Google and Meta. You can find more information about them below. Other third parties generally process personal and other data in a similar manner.

We use Google Analytics on our website, an analysis service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA, USA) and Google Ireland Ltd (Google Building Gordon House, Barrow St, Dublin 4, Ireland). Google collects certain information about the behavior of users on the website and about the terminal device used. We have configured Google Analytics in such a way that IP addresses of visitors are anonymized before being forwarded to the USA. Google provides us with analyses based on the recorded data, but also processes certain data for its own purposes. Information about the privacy policy of Google Analytics can be found here, and if you have a Google account, you can find more information here.

Our website also uses the "Meta Pixel", an analytics tool from Meta Platforms Ireland Ltd (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). This allows us to control ads on Meta and Meta's partners so that they are displayed only to users for whom ads are likely to be of interest. We may also measure the effectiveness of such ads for statistical and market research purposes. We are jointly responsible with Meta for sharing data that Meta receives as a result, for displaying personalized ads, improving ad delivery, and personalizing content. The data is stored on servers in the EU/EEA and the USA. Users can send requests for information and other inquiries directly to Meta. You can find more information about data protection at Meta and the corresponding settings options here.

How do we process data for social media appearances?

We may operate our own presences on third-party platforms (especially social networks) (e.g. Instagram, TikTok, Facebook, YouTube, Linkedin). If you communicate with us there or comment on content, we collect and process corresponding data. Please make sure on the respective platform to share your content only with the group of people you want. When you visit our social media sites, data may be transmitted directly to or collected by the relevant provider (e.g. data on your user behavior), and the provider may process this data together with other data known to it. For more information on data processing by social network providers, please refer to the privacy policies of the relevant social networks. Insofar as we are jointly responsible with the provider, we will enter into a corresponding agreement, about which you can obtain information from the provider.

How do we process data for newsletters?

When you order our newsletter, you give us your consent to send you electronic newsletters by e-mail in accordance with this privacy policy. The newsletters may contain advertisements for our offers (in particular also for contests and our loyalty program), but also offers from other companies with which we cooperate. You can unsubscribe at any time via a link in the relevant emails.

In this context, we also process information about which services you have already used, whether you open our newsletter and which links you click on. For this purpose, our e-mail delivery service provider provides a function that essentially works with invisible image data that is loaded from a server via a coded link and thereby transmits the corresponding information. This is a common method that helps us assess the effect of newsletters and optimize our newsletters. You can avoid this measurement by setting your email program accordingly (e.g. by switching off the automatic loading of image files).

How do we use profiling?

"Profiling" means the automated processing of personal data in order to evaluate personal aspects or make predictions, e.g. the analysis of personal interests, preferences and affinities or the prediction of likely behavior. Profiling can be used in particular to derive preference data (for more information, see section 3.6).

Profiling is a common process, e.g., in automated processing

of master data, contract data, behavioral data and transaction data for purchases in our online store;
of behavioral, transactional, and technical data in connection with our website;
from other behavioral and transactional data.

Profiling helps us do this, for example,

continuously improve our offerings and better align them with individual needs;
to present you our contents and offers according to your needs;
as far as possible, only present you with advertisements and offers that are likely to be relevant to you;
to better support you in customer service;
to decide which payment options are available based on a credit check.

We perform profiling by evaluating your shopping behavior and assigning you to certain customer segments based on this. These are groups of people who have similarities with regard to certain characteristics. This profiling enables us, for example, to offer you relevant rewards in connection with the loyalty program.

Profiling also takes place, for example, in connection with the user account, e.g. by evaluating your usage and shopping behavior in our online store and on our website, for example in order to offer you an individual user experience and to provide you with offers tailored to your interests and preferences.

If you do not want us to analyze personal aspects or make predictions, you can opt out of participating in the loyalty program or make your purchases without using your loyalty ID, from creating a user account and registering for other services. You can also object to profiling in certain cases as described in section 14.

How do the Planted companies work together?

Planted exist in Switzerland and the EEA, where we have planted (founded) Planted companies. In addition to us (Planted Foods GmbH, see also section 2), there is currently also Planted Foods AG in Switzerland. Together we form the Planted group. We obtain certain services from the group, e.g. accounting and IT services (further information on service providers can be found in section 10). However, the Planted companies also support each other in other matters and may also exchange personal data for this purpose. Planted The Planted companies may also use data that they receive from other companies for their own purposes, as described in section 4. We assume that such disclosures do not conflict with any confidentiality interests, unless you inform us otherwise. We often work with Planted companies under joint responsibility in terms of data protection law. For your rights as a data subject, you are welcome to contact us (in this case, we will coordinate with other Planted companies), but you can also contact them directly.

How do we work with service providers and distribution partners?

We use various services from third parties, especially IT services (examples are providers of hosting, data analysis services, webshops and newsletter delivery services), logistics services and services from payment service providers, banks, the postal service, consultants, etc. You can find information about service providers for our website under section 5. These service providers may also process personal data to the extent necessary. As a rule, these service providers process personal data on our behalf as so-called "order processors". Our order processors are obliged to process personal data exclusively in accordance with our instructions and to take appropriate data security measures. Certain service providers are also jointly responsible with us or independently (e.g. debt collection companies).

Our distribution partners include, for example, retailers and restaurants. We generally do not share any personal customer data with them. Insofar as you pass on your personal data to our sales partners or have them pass on your personal data, e.g. by using a loyalty card of the sales partner or ordering on the website of the sales partner, the sales partners are independently responsible for this data processing. Under certain circumstances, distributors may also be service providers of us (according to the section above).

Can we disclose data abroad?

The recipients of data are not only located in Switzerland or the EEA. This applies in particular to certain IT service providers. These sometimes also have locations in other countries worldwide, e.g. in the USA. We may also transfer data to authorities and other persons abroad if we are legally obliged to do so or, for example, in the context of a company sale or legal proceedings (see section 4). Not all of these countries have adequate data protection. We compensate for the lower level of protection through appropriate contracts, in particular the so-called standard contractual clauses of the European Commission, which can be accessed here. In certain cases, we may also transfer data without such contracts in accordance with data protection requirements, e.g. if you have consented to the corresponding disclosure or if the disclosure is necessary for the performance of the contract, for the establishment, exercise or enforcement of legal claims or for overriding public interests.

On what legal basis is the data processing based?

Depending on the applicable law, data processing is only permitted if the applicable law specifically allows it. This does not apply under the Swiss Data Protection Act, but does apply under the GDPR, for example. In this case, we base the processing of your personal data on the fact that it is necessary for the preparation and execution of contracts, that it is necessary for legitimate interests of us or third parties, e.g. for statistical analysis or for marketing purposes, that it is required or permitted by law, or that you have separately consented to the processing. You can find the relevant provisions in Art. 6 and 9 of the GDPR.

You are not obligated to disclose data to us, with the exception of individual cases (e.g. if you have to fulfill a contractual obligation and this results in the disclosure of data to us). However, for legal and other reasons, we must process data when we conclude and execute contracts. Also the use of our website is not possible without data processing.

How long do we process your personal data?

We store and process your personal data as long as it is necessary for the purpose of processing, as long as we have a legitimate interest in storing it (e.g. to enforce legal claims, for archiving or to ensure IT security) and as long as data is subject to a legal retention obligation. If there are no legal or contractual obligations to the contrary, we will destroy or anonymize your data after the storage or processing period has expired as part of our normal processes.

What rights do you have?

You have certain rights under applicable data protection law to obtain more information about, and act on, our data processing:

Right of access: You have the right to request certain information about our processing of your personal data and a copy of personal data.
Correction: You can request that we correct or complete inaccurate or incomplete data if, for example, it is incorrect.
Deletion: You have the right to request the deletion or anonymization of data.
Objection and revocation: You can object to our processing for certain purposes (e.g. processing for marketing purposes, in particular profiling). You have the right to revoke consent with effect for the future, insofar as processing is based on consent.
Transfer: You have the right to receive personal data that you have provided to us in a structured, common and machine-readable format or to have it transferred to a third party, provided that the corresponding data processing is based on your consent or is necessary for the performance of the contract.

If you wish to exercise such a right or have suggestions for improvements to our data processing, we will be happy to help (using the contact details in section 2). You are also free to file a complaint against our processing of your data with the competent supervisory authority, in Berlin the Berlin Commissioner for Data Protection and Freedom of Information.