1. Data controller
The data controller is GrandFlower Sp. z o.o., Księcia Witolda 49/15, 50-202 Wrocław, Poland, tax ID/NIP 8982313198, KRS 0001133179, REGON 529938314, share capital PLN 5,000.00.
Contact for privacy, account deletion, support and data subject requests: plantsmanager@pmcloud.pl. Polish e-Delivery address: AE:PL-49394-25210-VGVSG-20.
2. What PhytoPass is
PhytoPass is a mobile app for keeping a simple inventory of plant products, inspection records, treatment records, loss records, issued plant passport records and control-ready reports. The app uses the PlantsManagerApi backend. Users are responsible for the accuracy of their data, required authorisations and compliance with applicable plant health and documentation obligations.
3. Data we process
Account and Apple sign-in data
- stable Apple user identifier provided by Sign in with Apple,
- email address, including Apple private relay email if provided by Apple,
- first and last name if provided by Apple or entered in the app,
- internal user ID, Individual company ID and session token used to communicate with the API.
App data
- seller settings, PIORiN registration number, default country of production, translation mode and print mode,
- products, botanical and Latin names, batch numbers, countries of production and inventory levels,
- inspection, treatment, loss and issued plant passport records, including dates, quantities, comments, plant status, plant protection products and report data,
- generated PDF documents, document metadata, download history and data needed to re-open documents when available,
- public plant name translations loaded from Plants Manager translation tables.
Subscription and purchase data
- App Store product identifier, original transaction identifier, subscription status, environment and expiration date,
- technical data required to synchronize PRO access.
Payments, card details, invoices and refunds are handled by Apple. We do not receive full payment card details.
Technical and support data
- IP address, request date and time, API responses, error information and security logs,
- email content and contact data voluntarily provided when you contact support.
4. Purposes and legal bases
- Providing the service - account, products, registers, reports, passports and synchronization; legal basis: performance of a contract or pre-contractual steps.
- Subscription handling - PRO status and limits; legal basis: contract performance and legitimate interest in preventing abuse.
- Security and stability - diagnostics, API protection and abuse prevention; legal basis: legitimate interest.
- Support and complaints - handling requests and claims; legal basis: contract, legal obligation or legitimate interest.
- Legal obligations - keeping information required by law, for example for complaints, accounting or claims; legal basis: legal obligation.
5. Recipients
Data may be processed by service providers supporting the app, including Apple for Sign in with Apple, App Store and in-app purchases, API hosting providers, database and file storage providers, email providers and technical support providers.
If data is transferred outside the European Economic Area, we use available GDPR-compliant safeguards, in particular standard contractual clauses or other required safeguards.
6. Retention
- account and app data - until account deletion or termination of the service,
- subscription data - as long as needed to provide PRO access, handle complaints, security and legal obligations,
- generated documents and records - until account deletion or for the period required by law where retention is necessary,
- technical logs - as long as needed for diagnostics, security and claims,
- support correspondence - for the duration of handling the request and protecting claims.
7. Account deletion
You can delete your account in the app under Settings → Documents and account → Delete account. Account deletion removes or anonymizes the PhytoPass account, Individual company, products, registers, settings and subscription data stored by us, except for information we must keep for legal, security or claim-related reasons.
Deleting the account does not cancel an Apple subscription. You must cancel the subscription in Apple ID/App Store settings: https://apps.apple.com/account/subscriptions.
8. Your rights
You may request access, rectification, deletion, restriction of processing, data portability, objection to processing and withdrawal of consent where processing is based on consent. You may also lodge a complaint with the President of the Polish Personal Data Protection Office.
9. Children
PhytoPass is not directed to children. It is a tool for users keeping plant product and sales documentation.
10. Changes
We may update this policy when app features, providers or laws change. The current version is available at https://grandflower.pl/en/paszportownik/privacy/.