Privacy
Privacy Policy
Last updated: 3 September 2026
1. About This Privacy Policy
This Privacy Policy explains how personal data is collected and processed in connection with botanical-supply.com (the "Website") and communications with Botanical Supply.
The Website operates under the trading name Botanical Supply and is based in Nicosia District, Republic of Cyprus.
The legal identity of the data controller responsible for the processing described in this Privacy Policy is provided in our Legal Notice.
For privacy-related enquiries or requests, please contact:
Email: info@botanical-supply.com Telephone: +357 22 000516
We process personal data in accordance with the General Data Protection Regulation, Regulation (EU) 2016/679 ("GDPR"), and applicable data protection laws of the Republic of Cyprus.
2. Personal Data We Collect
We collect only personal data that is reasonably necessary for operating the Website, responding to enquiries and conducting our business activities.
Depending on how you interact with us, this may include:
- your name;
- company or organisation;
- job title or business role;
- business email address;
- telephone number;
- country or business location;
- products or services you are interested in;
- information contained in enquiries, requests for quotations, sample requests or other communications;
- correspondence between you and Botanical Supply.
When you use the Website, certain technical information may also be processed automatically, including:
- IP address;
- browser and device information;
- operating system;
- date and time of access;
- pages accessed;
- referring website;
- basic server, security and diagnostic information.
For information about essential security technologies used by the Website, see our Cookie Notice.
We do not request sensitive personal data through the Website and ask that you do not provide such information unless it is genuinely necessary for a specific purpose.
3. How We Use Personal Data
We may use personal data to:
- respond to enquiries;
- provide requested product or technical information;
- prepare and discuss quotations;
- respond to requests for samples;
- communicate regarding potential or existing business relationships;
- process and administer commercial transactions;
- provide customer or supplier support;
- maintain and secure the Website;
- prevent fraud, misuse and security incidents;
- maintain appropriate business records;
- comply with legal, regulatory, tax or accounting obligations;
- establish, exercise or defend legal claims;
- send commercial communications where permitted by applicable law.
We will not use personal data for purposes that are incompatible with the purposes for which it was collected unless permitted or required by law.
4. Legal Bases for Processing
We process personal data only where there is a lawful basis for doing so.
Enquiries and Commercial Requests
When you contact us in your personal capacity regarding a possible transaction, processing may be necessary to take steps at your request before entering into a contract or to perform a contract.
Where you contact us as an employee, representative or contact person of another company or organisation, processing will generally be based on our legitimate interests in responding to business enquiries and managing legitimate business relationships.
Existing Business Relationships
We may process personal data where necessary to manage communications, orders, documentation and other aspects of an existing commercial relationship.
Depending on the circumstances, processing may be based on contractual necessity, compliance with a legal obligation or our legitimate business interests.
Website Operation and Security
Technical information may be processed where necessary for our legitimate interests in operating, maintaining and protecting the Website and associated systems.
Legal and Regulatory Requirements
We may process personal data where necessary to comply with applicable legal, regulatory, accounting or tax obligations.
Website Security and Similar Technologies
The Website uses only technologies needed for secure operation and protection of enquiry forms. We do not currently use analytics, advertising or personalization cookies.
Direct Marketing
We may send direct marketing communications only where permitted by applicable law.
Where consent is required, such communications will only be sent after consent has been obtained.
Where the law permits communications to existing customers regarding our own similar products or services without separate prior consent, recipients will be provided with a clear and easy way to object or unsubscribe.
You may opt out of marketing communications at any time.
5. Cookies and Similar Technologies
The Website does not currently use analytics, advertising or personalization cookies.
Cloudflare services, including Turnstile, are used to deliver and protect the Website and its enquiry forms. They may process technical security signals and use strictly necessary storage when required to distinguish legitimate visitors from abuse.
Because no non-essential cookies are active, the Website does not display a consent banner. If non-essential technologies are introduced, they will be disabled until the required consent has been obtained.
Further details are provided in our Cookie Notice.
6. Sharing Personal Data
We do not sell personal data.
Personal data may be shared only where reasonably necessary with service providers or other recipients supporting our Website or business activities.
These may include:
- website hosting and infrastructure providers;
- email and communication service providers;
- IT, cybersecurity and website maintenance providers;
- cloud storage or business software providers;
- professional advisers such as accountants or legal advisers;
- logistics, laboratory or other service providers where necessary in connection with a particular enquiry, sample or transaction;
- public authorities, regulators or courts where disclosure is required by law.
Where third parties process personal data on our behalf, appropriate data protection arrangements will be used where required by applicable law.
7. International Data Transfers
Some service providers may process personal data outside Cyprus or outside the European Economic Area ("EEA").
Where personal data is transferred to a country outside the EEA that is not covered by an applicable European Commission adequacy decision, appropriate safeguards will be used where required by the GDPR.
These may include European Commission Standard Contractual Clauses or another legally recognised transfer mechanism.
You may contact us for further information about safeguards applicable to international transfers of your personal data.
8. How Long We Keep Personal Data
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to comply with applicable legal obligations.
As a general rule:
- enquiries that do not result in an ongoing business relationship may be retained for up to 24 months after the last relevant communication;
- information relating to an active business relationship may be retained for the duration of that relationship;
- contractual, accounting, transaction and related business records may be retained for the period required by applicable legal, tax, accounting and limitation requirements;
- marketing information may be retained until consent is withdrawn or you object to marketing, subject to retaining minimal information where necessary to record and respect your opt-out;
- technical security and diagnostic information is retained only for as long as reasonably necessary for security and service operation.
We may delete or anonymise personal data earlier where it is no longer reasonably necessary.
9. Data Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, destruction, alteration, unauthorised access or disclosure.
Access to personal data is restricted to persons and service providers who reasonably require access for legitimate business purposes.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
10. Your Rights
Subject to the conditions and limitations of applicable data protection law, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete personal data;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- object at any time to processing for direct marketing;
- request data portability where applicable;
- withdraw consent at any time where processing is based on consent;
- lodge a complaint with a competent data protection supervisory authority.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise any of these rights, contact:
We may request reasonable information necessary to confirm your identity before responding to a request.
11. Right to Lodge a Complaint
If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.
In Cyprus, the supervisory authority for personal data protection is the Office of the Commissioner for Personal Data Protection.
You may also contact us directly at info@botanical-supply.com so that we can address your concern.
12. Automated Decision-Making
We do not use personal data collected through the Website for solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects individuals.
13. Children
The Website is intended primarily for business and professional users and is not directed at children.
We do not knowingly seek to collect personal data from children through the Website.
14. External Websites
The Website may contain links to third-party websites.
Botanical Supply is not responsible for the privacy practices or content of websites operated by third parties.
We recommend reviewing the relevant privacy information before providing personal data to a third-party website.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to the Website, our business activities, service providers or applicable law.
The current version will be published on the Website and the "Last updated" date will be updated accordingly.
Where required by law, we will provide additional notice or obtain consent before materially changing how personal data is processed.
16. Contact
For questions concerning this Privacy Policy, your personal data or the exercise of your data protection rights, please contact:
Botanical Supply Nicosia District, Republic of Cyprus Email: info@botanical-supply.com Telephone: +357 22 000516