Privacy Statement
Version 2026-09-27
This text is a draft under review. Anything in square brackets is still to be filled in, and it is not yet in force.
1. Who we are
1.1 BYS Flora International B.V. in formation (in oprichting), Tilburg, the Netherlands, is the controller of the personal data described here.
1.2 You can reach us about privacy at info@bysflorainternational.com or by post at the address above. We have not appointed a data protection officer, as we are not required to.
2. Whose data we hold, and what we collect
| Who | What we collect |
|---|---|
| Visitors to our website | Pages viewed and approximate location, only if you accept analytics cookies. See our Cookie Statement |
| People who apply for an account | Company legal and trading name, address, country, VAT number, website and phone. Your name, position, email, phone and whether you use WhatsApp. For suppliers: production type, crops, sizes, capacity, certifications, export markets and how you track stock. For buyers: business type, volumes, plant types, sizes and when you expect to order |
| Users of the portal | Account details, the role you hold, sign-in records, and a record of what you created or changed |
| Contacts at our buyers and suppliers | Name, position and business contact details, and our correspondence with you |
| People who email or call us, or use the contact form on our website | Whatever the message contains, and our reply. Through the form: your name, company, email, phone, country and what you are interested in |
2.2 We do not ask for special categories of data, such as health or political opinions, and you should not send them to us.
2.3 Everything we hold is business information about people acting in a professional capacity. We do not sell personal data, and we do not profile people or make automated decisions about them.
3. Why we use it, and on what legal basis
| Purpose | Legal basis | How long we keep it |
|---|---|---|
| Assessing an application for an account | Our legitimate interest in knowing who we trade with, and steps before a contract | 2 years after a rejection; for the life of the account if approved |
| Running your account and the portal | Performance of our contract with your company | The life of the account, then 12 months |
| Quoting, ordering, shipping and invoicing | Performance of our contract with your company | 7 years from the end of the financial year, as Dutch tax law requires |
| Plant health, customs and phytosanitary records | A legal obligation | 7 years, or longer where plant health rules require |
| Answering questions and handling complaints | Our legitimate interest in running the business | 3 years after the matter closes |
| Sending availability updates and trade news | Your consent, or our legitimate interest where you are already a customer | Until you unsubscribe |
| Website analytics | Your consent | 26 months |
| Security, fraud prevention and keeping records of what happened | Our legitimate interest in protecting the business | 12 months for technical logs |
3.2 Where we rely on our legitimate interests, we have weighed them against your interests, and you can ask us for that assessment.
4. Who else sees it
| Recipient | What for | Where |
|---|---|---|
| Google (Google Cloud and Firebase) | Hosting, database, file storage and sign-in | Database and files in the EU region europe-west4, the Netherlands. Sign-in is a global Google service, and Google's support staff may access data from outside the EU under Google's own safeguards |
| Google (Google Analytics) | Website analytics, only if you accept analytics cookies | United States, under Google's own safeguards |
| Resend | Sending the emails the platform generates | United States, under the safeguards in its own terms |
| Meta (WhatsApp) | Messages you choose to send us on WhatsApp | Outside the EU, under Meta's own safeguards |
| Our suppliers and growers | Delivery and plant health documentation, where your details are needed to fulfil an order | Including Türkiye |
| Transport, customs and inspection authorities | Shipping and clearing consignments | As the route requires |
| Our accountant, auditors and advisers | Running the company | Netherlands |
4.2 We do not pass your data to anyone else unless the law requires it.
5. Data going outside Europe
5.1 Some of our suppliers and partners are in Türkiye, which the European Commission has not declared to provide adequate protection. Where we send personal data there, we do so under the European Commission's standard contractual clauses, and we keep a record of why the transfer is necessary. You can ask us for a copy of those clauses.
5.2 Our hosting provider's support teams may access data from outside the European Economic Area under the safeguards in that provider's own terms.
6. Your rights
6.1 You can ask us to give you a copy of your data, correct it, delete it, limit what we do with it, or send it to someone else. You can object to us using it on the basis of our legitimate interests, and you can withdraw consent at any time, which does not affect what we did before.
6.2 Write to info@bysflorainternational.com. We answer within one month. If we cannot do what you ask, we tell you why.
6.3 If you are not satisfied, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl, or to the authority in the country where you live.
7. Keeping it safe
7.1 The platform runs on Google Cloud in the European Union. Connections are encrypted, data is encrypted at rest, an account created when someone applies can see nothing until we approve the application, and what an approved account can see depends on the role it holds. Access to production data by our own people is limited to what support and maintenance require.
7.2 If a breach happens that is likely to put people at risk, we tell the Dutch Data Protection Authority within 72 hours of becoming aware of it, and we tell the people affected where the law requires.
8. Changes
8.1 We update this statement when what we do changes. The version and date at the top tell you which text applies, and we keep earlier versions available on request.