At Greenhouse AFL (“we,” “us,” “our”), accessible at https://greenhouseafl.web.id, your privacy is important to us. This Privacy Policy explains what personal data we collect, how we use it to fulfill your international plant orders, and your rights under Indonesian law and, where applicable, the EU General Data Protection Regulation (GDPR) and other privacy laws.
If you have questions, please contact us at hello@greenhouseafl.web.id or WhatsApp +62 895-3430-62163.
1. Data Controller
Greenhouse AFL, Bogor, West Java, Indonesia is the data controller for personal data collected via the Site, checkout forms, email, and WhatsApp. Our contact details are above. For GDPR purposes, our EU representative can be reached via the same email.
2. What Data We Collect
We collect only what is necessary to process your order, issue export documents, and ship via DHL Express. We collect data in two ways: directly from you and automatically via cookies.
2.1 Information You Provide Directly
| Source | Data Collected |
|---|---|
| Checkout / Quote Form (name, email, phone, address) | Full name, email address, phone number (with country code), shipping address (street, city, state/province, ZIP/postal code, country). We also collect your plant selections and any order notes. |
| Contact Form / WhatsApp / Email | Name, country, subject, message content, and any photos/videos you send (e.g., unboxing video for guarantee claims). |
| Payment Invoice (via WhatsApp) | We do not store your full bank/card details. Payments are processed via Wise, PayPal, or SWIFT bank transfer. We receive payment confirmation (name, amount, transaction ID) from the payment provider. PayPal/Wise handle your financial data under their own privacy policies. |
| Shipping & Export | The same checkout data plus DHL tracking info and, where required, ID/passport number only if your country’s customs strictly requires it for clearance (rare; we will ask explicitly). |
We do not intentionally collect sensitive personal data (health, biometrics, religion, etc.). Please do not send such information.
2.2 Information Collected Automatically
- Cookies & Similar Tech: see Section 6 below.
- Usage Data: IP address, browser type, device type, pages visited, referring URL, and approximate location (city/country level). This is collected via standard server logs and, if enabled, privacy-friendly analytics.
- Cart Storage: your cart is stored locally in your browser (localStorage) to remember items between pages; it is not sent to our server until you submit a quote.
3. How We Use Your Data
We use your data only for the following purposes, under the legal bases noted for GDPR:
| Purpose | Example | GDPR Legal Basis |
|---|---|---|
| Process & fulfill orders | Prepare plants, generate invoices, communicate via WhatsApp about your order | Contract performance |
| Shipping & export compliance | Provide name/address/phone to DHL Express for delivery; provide data to the Indonesian Agricultural Quarantine Agency for the Phytosanitary Certificate (and CITES agency if applicable); include commercial invoice in parcel | Contract + legal obligation |
| Customer support & guarantee | Respond to inquiries, handle Live Arrival Guarantee claims (review unboxing video) | Contract + legitimate interest |
| Improve our Site | Analyze aggregated usage to fix bugs and improve product pages | Legitimate interest |
| Legal compliance | Retain transaction records for tax/accounting, respond to lawful requests | Legal obligation |
We do not use your data for unsolicited marketing. We will only send you marketing messages if you explicitly opt in. You can opt out at any time via hello@greenhouseafl.web.id.
4. Who We Share Data With
- DHL Express (or domestic courier): name, phone, full address, email, and commercial invoice details for delivery and customs. DHL’s privacy policy applies to their handling: dhl.com/privacypolicy.
- Indonesian Agricultural Quarantine Agency / CITES Management Authority (if applicable): name, address, and plant details to issue the Phytosanitary Certificate / CITES permit.
- Payment Providers: Wise, PayPal, and our bank. They process your payment under their own privacy policies. We receive only confirmation.
- IT/Service Providers: website hosting, email provider — under data processing agreements, access limited to what is necessary.
- Legal Authorities: if required by Indonesian law or to comply with a lawful request from customs/law enforcement in your destination country.
We do not transfer data to other third parties without your consent, except as required by law.
5. International Data Transfers
Your data is primarily processed in Indonesia, where our nursery and servers are located. When we ship internationally, your shipping data is transferred to DHL and to customs/biosecurity agencies in your destination country to fulfill the contract (GDPR Art. 49(1)(b)). Payment data may be processed in the EU, US, or Singapore by Wise/PayPal. Where GDPR applies, we rely on contractual necessity and, where needed, standard contractual clauses with our processors.
6. Cookies
Our Site uses only essential cookies/local storage to function:
- Essential (no consent needed): cart persistence (localStorage `cart`), session, and load-balancing. Without these, the shop and checkout cannot work.
- No advertising/tracking cookies by default. If we add analytics (e.g., privacy-friendly Plausible/Google Analytics) in the future, we will update this section and, where required by GDPR, request consent via a cookie banner.
You can block cookies via your browser settings, but the cart and checkout may not function correctly.
7. Data Retention
- Order & shipping records: retained for 5 years for tax/accounting and guarantee reference, then deleted or anonymized.
- Contact/WhatsApp messages & guarantee videos: retained for 2 years after resolution, then deleted.
- Server logs: retained for 12 months, then anonymized.
If you request deletion earlier (see Rights below), we will delete where we are not legally required to retain.
8. Security
We take reasonable technical and organizational measures to protect your data: HTTPS encryption on the Site, access limited to authorized staff, and payment handling via reputable providers (Wise/PayPal) so we never store full card/bank numbers. However, no transmission over the internet is 100% secure; we cannot guarantee absolute security.
9. Your Rights (Including GDPR)
Depending on your location, you may have the following rights — contact us at hello@greenhouseafl.web.id to exercise them (we respond within 30 days):
- Access: request a copy of personal data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure (“right to be forgotten”): request deletion where no legal retention applies.
- Restriction & Objection: restrict or object to certain processing.
- Portability: receive your data in a structured, machine-readable format.
- Withdraw Consent: where processing is based on consent, withdraw at any time.
- Lodge a Complaint: with your local supervisory authority (e.g., EU Data Protection Authority) or the Indonesian data protection authority.
For Indonesia’s PDP Law (UU PDP No. 27/2022), you have similar rights to access, correct, and delete your personal data; contact us via the details below.
10. Children’s Privacy
Our Site and services are not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it promptly.
11. Third-Party Links
Our Site may link to external sites (e.g., our blog at blog.greenhouseafl.web.id, DHL tracking, PayPal/Wise). We are not responsible for their privacy practices; please review their policies.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. The “Last updated” date at the top will change, and the updated version will be posted at https://greenhouseafl.web.id/privacy.html. For material changes, we will notify you via email or a Site notice.
13. Contact Us
If you have questions, requests, or complaints about privacy:
Greenhouse AFL
Bogor, West Java, Indonesia
Email: hello@greenhouseafl.web.id
WhatsApp: +62 895-3430-62163
Website: https://greenhouseafl.web.id
We aim to resolve all inquiries within 30 days.
Related: Terms of Service | Shipping Policy | Live Arrival Guarantee