Privacy Policy

Privacy Policy

Fundamentals and legal basis

The Bushplanet Group is very concerned about data protection. We identify with the principles of the EU data protection regulation, i.e. we process your data as sparingly as possible, store it for as short a time as possible and ensure the greatest possible security. We process your data exclusively on the basis of the legal regulations (GDPR, DSG 2018, TKG 2003). In this privacy policy, we inform you about the most important aspects of data processing within our website.

Data controller:

Bushplanet Distribution GmbH & Co KG
Industriestraße D 5
A-2345 Brunn/Gebirge

Phone: +43 (0)1 609 1314
Fax: +43 (0) 1 609 1314-15

Purpose limitation, legal basis and duration of storage 

We need the collected personal data to ensure you have a technically smooth visit to our website, for fulfilment of the contract and billing for online shopping and to provide you with the best possible customer service. The data is collected, stored, processed and used for this purpose.

The legal basis for the processing of your personal data is contract fulfilment (online shopping), legitimate interests and the fulfilment of our legal or contractual obligations as well as your consent (contact form, newsletter, cookies). The non-provision of data can have different consequences.

As far as necessary, we process your data for the duration of the entire business relationship (from initiation until the complete execution of the purchase contract), in accordance with the statutory storage and documentation obligations, which can be found in the German Business Code (UGB), the Federal Tax Code (BAO), and until termination of any legal dispute, ongoing warranty and guarantee periods, etc.

Data recipient and transfer to third parties 

As part of the operation of our website and the underlying processing systems, we commission contractors (IT service providers, payment service providers, transport service providers, tax consultants) who may gain access to your data as part of their activities, if they need the data to perform their respective service. These data recipients have committed themselves to comply with the applicable data protection regulations. Commissioned processing contracts have been concluded in accordance with Art. 28 GDPR.

Furthermore, we exchange data with our parent company Grow City GmbH, Industriestraße D 5, A-2345 Brunn/Gebirge, insofar as this is necessary for the purpose of doing business, in particular for central accounting. Our IT systems and those of Grow City GmbH form an organisational unit and are subject to the same data protection concept and the same security precautions.

In addition, we will never share your data with third parties unless we are required to do so by law. We take the protection of your data very seriously. Regarding the actions we take to protect your privacy, see “Data security” below.

IP address

When you visit our website, your IP address will be recorded in our server logs but immediately pseudonymised by masking the last 8 bits. As a result, only a rough localisation is possible. The server log data will be kept for a period of 30 days.

Online shopping 

For the purpose of easier shopping and for later contract processing, we store your IP address in the context of the use of cookies. We also store the data that you give us in the course of your registration and/or your shopping (name, contact information, shipping method, etc., content of the order). Of course, the data transfer takes place exclusively via an encrypted connection.

Subsequently, for the purpose of contract processing in our systems, data on the status of the deliveries to you is stored.

The data provided by you is required to fulfil the contract or to carry out pre-contractual measures. Without this data we can not conclude the contract with you. Data transmission to third parties does not take place, with the exception of provision of the necessary data to the transport companies/shipping companies commissioned by us for the delivery of the goods, to our tax advisor to fulfil our tax obligations, and to our IT service providers to ensure smooth technical processes, as well as to the processing bank/payment service provider in case of payment by credit card for the purpose of debiting the purchase price. In this case, we only transfer the purchase price with an anonymised transaction ID, i.e. the payment service provider will not receive any further information about the order from us. These processors have undertaken to comply with applicable data protection laws. A commissioned processing contract was concluded in accordance with Art. 28 GDPR.

If you cancel the purchase before conclusion of the contract, no data will be stored with us. If a contract is concluded, all data from the contractual relationship is stored until the expiry of the tax retention period (seven years). The data name, address, purchased goods, date of purchase and payment method are also stored until the end of product liability (10 years).  Data processing takes place on the basis of the statutory provisions of § 96 para. 3 TKG and Art. 6 para. 1 let. a (consent) and/or let. b (necessary for fulfilment of the contract) of the GDPR.

Contact form 

If you contact us via the contact form on this website or by e-mail, your request will be transmitted to us via our own mail server, processed and stored by us. This data will not be collected or shared without your consent. We cannot process your request without this data. We store inquiries via contact form for seven years just as we do for all our business correspondence.

Data processing takes place on the basis of the legal regulations of § 96 para. 3 TKG as well as of Art. 6 para. 1 let. a (consent) of the GDPR.

Cookies and web analysis 

Our website uses so-called cookies. These are small text files that are stored on your device using the browser.

They allow for the recognition of the user and an analysis of the use of our website. The information generated thereby is transmitted to the server of the provider and stored there. They help us make our website more user-friendly, effective and secure overall. In addition, cookies are used to measure the frequency of page views and for general navigation.

By using our website, you consent to our setting cookies. Some cookies remain stored on your device until you delete them. You can decline to accept cookies in your browser settings. You can also set up your browser so that it informs you about the setting of cookies and only allows this in individual cases; or you can deactivate the setting of cookies. You can delete cookies that have already been set at any time in the settings of your browser. Since the corresponding procedure is browser-specific, we ask that you to inform yourself about this using your browser instructions. However, we expressly point out that the functionality of the website may be limited, in particular, an online purchase is unfortunately not technically possible with us, as it is not possible to put items in the cart without allowing cookies.

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”), 1600 Amphitheater Parkway, Mountain View, California, 94043, USA. Data processing takes place on the basis of the legal regulations of § 96 para. 3 TKG as well as Art 6 para. 1 let. a (consent) and/or f (legitimate interest) of the GDPR. Our interest in the sense of the GDPR (legitimate interest) is the improvement of our offer and our website.

Google Analytics uses cookies that allow an analysis of the use of the website by you. The information generated by the cookie about your use of this website such as

  • Browser type/version
  • Operating system used
  • Referrer URL (the previously visited page)
  • Host name of the accessing computer (IP address)
  • Time of the server request

are usually transmitted to a Google server in the US and stored there. The IP address transmitted by Google Analytics within the framework of Google Analytics will not be merged with other data provided by Google. In addition, we use IP anonymisation on this site by using Google Analytics with the extension “_anonymizeIp ()” because your privacy is important to us. This means that your IP address will already be shortened by Google within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the US and shortened there.

Google will use this information on behalf of us as the operator of this website to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator.

You can prevent the storage of cookies by a corresponding setting in your browser. In addition, you may prevent the collection by Google of the data generated by the cookie and related to your use of the website (including your IP address) as well as the processing of this data by Google by downloading and installing the browser plug-in available under the following link:

For more information about terms of use and privacy, please visit Google directly at and and /partners.

We have a commissioned data processing contract with Google. Google has undertaken to comply with applicable data protection laws.

The relationship with Google is based on standard contractual clauses approved by the European Commission and, for the transfer of data from the EEA to the US and other countries, as appropriate, on the adequacy decisions issued by the European Commission with regard to the US.

Consent and right of revocation 

If your consent to the processing of your data is necessary, we will process it only with your explicit consent.

We do not process data of minors and are not authorised to do so. By submitting your consent, you confirm that you have reached the age of 18.

You can revoke your consent at any time at the following e-mail address: In such a case, the data previously stored about you will be anonymised and subsequently used only for statistical purposes without personal reference. The revocation of consent will not affect the legality of the processing effected on the basis of the consent until the revocation.

Data security

The Bushplanet Group uses technical and organisational security measures to protect the stored personal data against accidental or intentional manipulation, loss or destruction and against access by unauthorised persons.

  • Our websites are encrypted using SSL.
  • Our databases are backed up regularly.
  • Our servers are equipped with anti-virus measures.

Our security measures are continually being improved in line with technical progress.

Your rights

You have the right to information by us about your personal data at any time. Insofar as there is no statutory storage obligation, you have the right to delete this data and object to its processing. You also have the right to correct the data and to limit processing, the right to data portability and the right to lodge a complaint with the data protection authority. In Austria, this is the Austrian Data Protection Authority [] (Wickenburggasse 8-10, 1080 Vienna, e-mail:

If you have any questions or concerns about privacy that are not answered in this Privacy Policy, please contact our data protection officer

Version 1.0, last update: 14/05/2018