Privacy policy
Last updated: 22 October 2026
This is how Botané handles your personal data when you visit botanestudios.com, buy from us online or in our Copenhagen store, write to us, or sign up for our emails. Section 6 explains which cookies we use. We have tried to keep it short and in plain words. If anything is unclear, write to us at info@botanestudios.com.
1. Who we are
Botané ApS
Højbro Plads 21, 2.
1200 København K, Denmark
CVR 44266695
info@botanestudios.com
Botané ApS is the data controller for everything described here. We have not appointed a data protection officer; the address above is where you reach us about your data.
2. What we collect, why, and for how long
2.1 When you buy from us online
What: name, email, phone number, billing and shipping address, what you ordered, payment method and the last four digits of your card (we never see the full card number), IP address and order history.
Why: to take your payment, pack and ship your order, send order and delivery updates, handle returns and claims, and keep the accounts the law requires us to keep.
Legal basis: performance of our contract with you (GDPR art. 6(1)(b)); legal obligation for bookkeeping (art. 6(1)(c)).
How long: order and invoice data is kept for the current year plus five years, as the Danish Bookkeeping Act requires. After that it is deleted or anonymised.
2.2 When you buy in our Copenhagen store
Our store at Højbro Plads runs on the same Shopify system as the webshop. If you pay by card we receive the same payment confirmation as online, without your card number. If you give us your email in the store, for a receipt or to hear from us, it is handled exactly as described in 2.1 and 2.4. Retention is the same as for online orders.
2.3 Your customer account
What: name, email, addresses, order history and login details.
Why: so you can see your orders, track deliveries and check out faster.
Legal basis: performance of our contract with you (art. 6(1)(b)).
How long: as long as the account exists. You can delete it at any time by writing to us; order data then stays in our books for the period in 2.1 only.
2.4 Newsletter and sign-up popup
What: your email address, your name if you give it, which emails you open and which links you click, and what you look at or buy on the site if you are signed in or arrived from one of our emails.
Why: to send you new collections, campaigns and the occasional story from the studio, and to make those emails relevant.
Legal basis: your consent (art. 6(1)(a)). You can withdraw it any time with the unsubscribe link in every email or by writing to us.
How long: until you unsubscribe. We then keep a record of your unsubscribe so we do not email you again.
Your sign-up is stored in our shop system, Shopify. We only send email; we do not send marketing by SMS.
2.5 Back-in-stock and pre-order notices
If you ask us to tell you when a piece is back, we store your email and the product you chose until we have sent that notice, or for 12 months, whichever comes first. If you pre-order, the data is handled as a normal order (2.1). Legal basis: consent for the notice (art. 6(1)(a)), contract for the pre-order (art. 6(1)(b)). Our tool for this is Restock Rocket (see section 3).
2.6 When you contact us
What: whatever you send us: your name, email, phone number, order number, photos of a piece or a parcel, and the conversation itself, whether by email, the contact form or the chat on the site.
Why: to answer you, solve the problem and keep a record of what was agreed.
Legal basis: performance of our contract with you (art. 6(1)(b)) when it concerns an order; otherwise our legitimate interest in answering people who write to us (art. 6(1)(f)).
How long: three years after the conversation is closed, which matches the general limitation period for claims in Denmark. Conversations about an open claim are kept until the claim is settled.
We run support in Gorgias (see section 3).
2.7 Returns
When you start a return through our return portal, we process your order number, email, the pieces you are returning and your reason, so we can send you a label and refund you. Legal basis: performance of our contract with you (art. 6(1)(b)). Kept with the order (2.1). The portal is run by AfterShip Returns.
2.8 Surveys
Now and then we show a short question on the site, for example how you heard about us. Answering is voluntary. We store the answer with a random session id, and with your order if you answer after buying, so we can see which channels bring people to us. Legal basis: our legitimate interest in understanding where our customers come from (art. 6(1)(f)). Kept for two years. The survey tool is Zigpoll.
2.9 Visiting the site: analytics, personalisation and marketing
When you browse the site, Shopify collects technical data so pages load correctly and so we can see how the shop is used: IP address, browser, device, pages viewed, products viewed, where you came from. Shopify is our platform and this is needed for the site to work (legitimate interest, art. 6(1)(f)).
Everything beyond that runs only if you accept the matching category in our cookie banner, and you can change that choice at any time (legal basis: consent, art. 6(1)(a)):
- Analytics: Google Analytics, Reaktion and Triple Whale measure traffic and which campaigns lead to sales; Essential A/B Testing shows some visitors one version of a page and some another so we can see which works better.
- Personalisation: Clerk.io powers search and product recommendations on the site, and receives what you search for and view and, after a purchase, the order id.
- Marketing: the Meta (Facebook and Instagram), TikTok and Google Ads pixels let us measure our ads and show you our pieces on those platforms.
The full list, with what each tool stores and for how long, is in section 6 (Cookies).
2.10 Fraud screening and bot protection
Shopify checks every order for signs of fraud, for example an IP address with repeated failed payments. This is automated, but no order is refused on that basis alone; a person looks at anything flagged. We do not make any other automated decisions about you. Forms on the site are protected by hCaptcha, which processes your IP address and browser data to tell people from bots. Legal basis: our legitimate interest in preventing fraud and abuse (art. 6(1)(f)).
2.11 Job applications
If you apply for a role through the site or by email, we keep your application for six months after the position is filled, unless you ask us to keep it longer. Legal basis: our legitimate interest in recruiting (art. 6(1)(f)) and, for keeping it longer, your consent.
3. Who we share your data with
We do not sell your data. We share it with companies that work for us, and only what they need to do their job. Where a company is outside the EU/EEA, we rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as noted.
| Who | What they do for us | Where your data goes |
|---|---|---|
| Shopify International Ltd, Dublin | runs the webshop, the Copenhagen till, customer accounts, newsletter sign-ups, checkout and fraud screening | Ireland; stored in Canada and the USA (Data Privacy Framework and SCCs) |
| Shopify Payments (Stripe) | card payments: Visa, Mastercard, Maestro, American Express, Apple Pay, Shop Pay | EU and USA (Data Privacy Framework and SCCs) |
| PayPal (Europe) S.à r.l. | PayPal payments | Luxembourg |
| Compack ApS, Brande | our warehouse in Denmark: packs and ships EU orders, receives returns | Denmark |
| Alpi Logistics Inc. | our warehouse for orders shipped within the USA | USA (SCCs) |
| PostNord, GLS, DPD, UPS, DHL Express | deliver your parcel; receive name, address, phone and email for delivery notices | the carrier serving your country; UPS and DHL may route data through the USA (SCCs) |
| Gorgias Inc., San Francisco | our support inbox and the chat on the site | USA (Data Privacy Framework) |
| AfterShip Ltd | the return portal | Singapore and USA (SCCs) |
| Restock Rocket (A.N. Advisory) | back-in-stock and pre-order notices | EU (Microsoft Azure, France); usage statistics on US servers (SCCs) |
| Zigpoll (Argonautic Labs LLC) | short surveys on the site | USA (SCCs) |
| Consentmo | the cookie banner and your consent record | EU |
| Orbe | suggests the right country and currency from your approximate location | EU |
| Intuition Machines Inc. (hCaptcha) | bot protection on forms | USA (Data Privacy Framework) |
| Google Ireland Ltd | Google Analytics and Google Ads measurement — only with your consent | Ireland; USA (Data Privacy Framework) |
| Meta Platforms Ireland Ltd | Facebook and Instagram pixel — only with your consent | Ireland; USA (Data Privacy Framework) |
| TikTok Technology Ltd | TikTok pixel — only with your consent | Ireland; USA and Singapore (SCCs) |
| Reaktion ApS, Copenhagen | marketing and profit analytics — only with your consent | Denmark |
| Triple Whale Inc. | marketing attribution analytics — only with your consent | USA (SCCs) |
| Clerk.io ApS, Copenhagen | search and product recommendations — only with your consent | Denmark |
| Essential Apps | A/B testing of the site — only with your consent | a Shopify partner app, bound by Shopify's data-protection terms |
| Visma e-conomic A/S | our bookkeeping; holds invoices with your name and address | Denmark |
We may also share data where the law requires it, for example with tax authorities, or with our lawyers and auditors when needed to defend a claim.
4. Your rights
You can at any time:
- ask what data we hold about you and get a copy,
- have it corrected,
- have it deleted, unless we must keep it (bookkeeping, an open claim),
- ask us to limit how we use it,
- receive the data you gave us in a machine-readable format,
- object to processing based on legitimate interest, including any direct marketing,
- withdraw a consent you have given, with effect from then on.
Write to info@botanestudios.com. We answer within a month. We may ask you to confirm who you are first.
If you think we have got something wrong, you can complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk, dt@datatilsynet.dk. If you live elsewhere in the EU/EEA, you can also contact the authority in your own country.
5. If you are outside the EU
We ship to the UK, Switzerland, Norway, the USA and a number of other countries. Everything above applies to you too. Two things specific to some of these countries:
- UK and Switzerland: your rights under the UK GDPR and the Swiss FADP match those in section 4. Complaints go to the ICO (UK) or the FDPIC (Switzerland).
- USA: the Meta and TikTok pixels can count as "sharing" or "selling" personal information under some US state laws. They only run if you accept marketing cookies in our banner; rejecting them is your opt-out. We do not knowingly collect data from anyone under 16.
6. Cookies
Like almost every website, botanestudios.com uses cookies. This section tells you which ones, what they do, how long they stay, and how to change your mind.
6.1 What a cookie is
A cookie is a small text file the site stores on your device. Some are set by us (first-party), some by companies whose tools we use (third-party). Some last for the visit only (session), others for a set time (persistent). Several of the tools below use your browser's local storage or a pixel instead of a cookie; the same rules apply, and we call them all cookies here.
6.2 Your choice
When you first visit, a banner from Consentmo asks which categories you accept. Only strictly required cookies run before you answer. You can change or withdraw your choice at any time: open cookie settings, or clear cookies in your browser and the banner will ask again. If you reject a category, the tools in that category do not run.
The banner has four categories:
- Strictly required — the shop does not work without them: cart, checkout, login, security, your cookie choice itself. These need no consent.
- Functional — remember choices such as your country and currency, and keep the chat open.
- Analytics & statistics — tell us how the site is used and which campaigns lead to sales, so we can improve.
- Marketing & retargeting — let our advertising partners recognise your browser, so we can show you our pieces on their platforms and measure our campaigns.
6.3 Strictly required
Set by Shopify, which runs our shop, by Consentmo, which stores your cookie choice, and by hCaptcha, which protects our forms. Shop Pay checkout uses the Shopify cookies marked below.
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
| _secure_session_id | Shopify | keeps your session as you move through the shop | 24 hours |
| cart, cart_sig, cart_ts, cart_ver, cart_currency | Shopify | your shopping cart | 2 weeks |
| checkout, checkout_token, checkout_session_lookup, checkout_session_token_*, previous_step, tracked_start_checkout | Shopify | checkout | 3 weeks to 1 year |
| localization, _shopify_country, keep_alive, c | Shopify | country, language and currency | session to 2 weeks |
| shopify_pay, shopify_pay_redirect, hide_shopify_pay_for_checkout, dynamic_checkout_shown_on_cart | Shopify (Shop Pay) | accelerated checkout with Shop Pay | 30 minutes to 1 year |
| secure_customer_sig, storefront_digest, _storefront_u, identity-state, identity-state-*, identity_customer_account_number, remember_me | Shopify | customer login and account | 1 minute to 2 years |
| _tracking_consent, _shopify_m, _shopify_tm, _shopify_tw | Shopify | stores your privacy and tracking choice on Shopify's side | 30 minutes to 1 year |
| _ab, master_device_id | Shopify | staff login to the shop admin | 2 years |
| cookieconsent_preferences_disabled, cookieconsent_status, csmConsentIdentifier (local storage) | Consentmo | remembers which categories you accepted or rejected | 1 year |
| hCaptcha (set on hcaptcha.com) | Intuition Machines | tells people from bots on our forms | up to 1 year |
6.4 Functional
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
| mdApp_countryCodeDomain, mdApp_showRecommendationLang | Orbe | remembers the country and currency you chose, so we do not ask again; the first suggestion comes from your approximate location (IP address) | up to 1 year |
| gorgias.* (local storage) | Gorgias | keeps your chat conversation open while you browse | until you close the chat or clear your browser |
| restockrocket_production_* (local storage) | Restock Rocket | shows the right "notify me" and pre-order buttons on product pages; holds no personal data | until you clear your browser |
6.5 Analytics & statistics
Only with your consent.
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
| _shopify_y, _y, _shopify_s, _s, _shopify_d, _shopify_sa_p, _shopify_sa_t, _shopify_evids, _landing_page, _orig_referrer | Shopify | Shopify's own analytics: visits, pages, where you came from, which sales came from which campaign | 30 minutes to 1 year |
| _ga, _ga_5W1770CKXR | Google Analytics 4 — policy | counts visitors and tracks the path from first visit to purchase, with IP addresses truncated | 2 years |
| reaktion_session_id, reaktion_cs, reaktion_mds, reaktion_consent (local storage) | Reaktion — reaktion.com | connects visits and orders to the campaign that brought you here, so we can see which marketing pays off | session id until the visit ends; the rest until you clear your browser |
| TW_EXT_* (local storage) | Triple Whale — policy | marketing attribution: which ad or channel led to a visit or a purchase | until you clear your browser |
| Essential A/B Testing | Essential Apps | keeps you in the same version of a page while we test two versions against each other; stores a random visitor id only while a test runs | duration of the test |
| zigpoll-sessions, zigpoll-session-storage, persist:zigpoll (local storage) | Zigpoll | remembers whether you have already seen or answered a survey | until you clear your browser |
| clerkPixelContext (local storage) | Clerk.io — policy | personalised search and recommendations; ties a purchase back to what was searched and viewed | until you clear your browser |
6.6 Marketing & retargeting
Only with your consent. These let Meta, TikTok and Google recognise your browser and connect what you do here with your account on their platform, so we can show you our pieces there and see which campaigns work. Each of them is an independent controller for what they do with the data on their own platform; their policies are linked.
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
| _fbp, _fbc; fr (on facebook.com) | Meta Platforms — policy | Facebook and Instagram pixel: measures our ads and builds audiences | 3 months |
| _ttp, _tt_enable_cookie, ttcsid, ttcsid_*; ttwid (on tiktok.com) | TikTok — policy | TikTok pixel: measures our ads and builds audiences | 13 months |
| _gcl_au, _gcl_aw | Google Ads — policy | measures whether a Google ad led to a purchase | 3 months |
6.7 Tools that do not set cookies on this site
AfterShip Returns (our return portal) only processes the details you type into its form; it does not set tracking cookies while you browse.
6.8 Managing cookies in your browser
Besides our banner, every browser lets you see, block and delete cookies under settings or preferences. Blocking strictly required cookies will stop the cart and checkout from working. allaboutcookies.org explains the steps for each browser.
7. Children
You must be 18 to buy from us. We do not knowingly collect data from children, and we delete it if we learn we have.
8. Changes
We update this policy when our tools or the law change. The date at the top tells you when. If a change matters to you, for example a new purpose for your data, we will tell you by email or on the site before it takes effect.