Terre de LavandeLegal
Privacy Policy
Last updated: October 13, 2026
This policy explains what personal data Terre de Lavande collects, why, on what legal basis, who receives it, how long we keep it and what rights you have.
1. Who we are (data controller)
The controller of your personal data is the operator of Terre de Lavande. Contact for all privacy matters: info@terredelavande.com.
2. Information we collect
We collect the information you give us (sections 3–4), limited payment information from our payment provider (section 5), and basic technical data when you use the website (section 6). We do not knowingly collect special categories of data, such as health information; please do not include them in names, labels or messages.
3. Information provided during purchase
- membership plan, plant name, label text and order history;
- your acknowledgement of our Terms and the time it was given;
- shipping name and US shipping address (collected at checkout by Stripe and passed to us);
- for gifts: the recipient’s name, email address (optional), personal message and reveal date.
4. Account information
Email address, name and password. Passwords are stored only in hashed form by our authentication provider; we cannot see them. We also keep records of the emails we send you and messages you send us.
5. Payment information
Payments are processed by Stripe, which collects your card details directly. We receive a customer and subscription reference, payment status, billing country and renewal dates. We never receive or store your full card number or security code.
6. Website and device data
When you visit the website, our hosting provider automatically processes technical data such as IP address, browser and device type, pages requested and time of request, in server logs used for security, fraud prevention and reliability.
8. Why we process information
- to create and manage your account and membership and process payments and renewals;
- to prepare and ship seasonal boxes and send certificates, gift notices, confirmations, renewal reminders and seasonal updates;
- to provide customer support and handle cancellations, refunds and complaints;
- to send marketing emails where permitted (section 10);
- to keep the website secure and prevent fraud;
- to comply with legal, tax and accounting obligations and to establish or defend legal claims.
9. Legal bases (GDPR)
- Contract (Art. 6(1)(b) GDPR): account, membership, payments, shipping, service emails and support;
- Legal obligation (Art. 6(1)(c)): tax, accounting and consumer-law records;
- Legitimate interests (Art. 6(1)(f)): website security, fraud prevention, improving our service, handling gift recipients’ data to deliver gifts, and limited email marketing to existing members about similar services;
- Consent (Art. 6(1)(a)): waitlist and newsletter emails to non-members. You can withdraw consent at any time.
10. Email marketing
We send newsletters and waitlist news only to people who asked for them, and occasional news to members about similar services where the law allows. Every marketing email contains an unsubscribe link, and you can also opt out by emailing info@terredelavande.com. Opting out does not affect service emails about your membership.
11. Service providers and recipients
- Supabase — database and authentication (processor; data hosted in the United States);
- Stripe — payment processing and subscription billing;
- Vercel — website hosting;
- email service providers — sending service and marketing emails;
- packing and fulfilment partners, partner farms and producers, and shipping carriers — name, address and order details needed to prepare and deliver boxes;
- professional advisers, and authorities where required by law.
We do not sell personal data and do not share it for cross-context behavioural advertising.
12. International transfers
Our database and hosting are located in the United States, and some providers may process data in other countries. Where personal data from the EEA, Switzerland or the UK is transferred to countries without an adequacy decision, we rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses (and the UK addendum). You can request a copy of the relevant safeguards by emailing info@terredelavande.com.
13. Retention periods
- account and membership data: for as long as your account is active and up to 3 years after your last membership ends, for customer service and legal claims;
- invoices and transaction records: as long as tax and accounting law requires (up to 10 years);
- waitlist and newsletter data: until you unsubscribe;
- gift recipient data: until the gift membership ends, then as for membership data;
- server logs: a short period set by our hosting provider, typically up to 30 days.
14. Security
We use encrypted connections (HTTPS), access controls, row-level database security and reputable providers to protect personal data. No system is completely secure; if a personal data breach occurs we will notify you and the relevant authorities where required by law.
15. Your rights (EEA, Switzerland and UK)
You have the right to access your data, rectify it, erase it, restrict or object to its processing (including objecting at any time to direct marketing), data portability, and to withdraw consent. To exercise these rights, email info@terredelavande.com; we will respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where the alleged infringement occurred.
16. California and other US state privacy rights
Depending on your state, you may have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell or share personal information and do not use it for targeted advertising or profiling. To make a request, email info@terredelavande.com; we will verify it and respond within the time required by law. You may use an authorised agent, and you may appeal a decision by replying to our response. We will not discriminate against you for exercising your rights. The categories of information we collect, their sources and purposes are described in sections 2–11.
17. Children’s privacy
Terre de Lavande is not directed to children, and memberships may be purchased only by adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
18. Changes to this policy
We may update this policy from time to time. The “last updated” date shows the current version. We will notify members by email of material changes.
19. Contact
Terre de Lavande · Email: info@terredelavande.com.