Privacy Policy
Last updated: 14 October 2026
This Privacy Policy explains how Well&trees Development LLC (“Well & Trees”, “we”, “us”), 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States, collects, uses, shares and protects your personal data when you visit wellandtrees.com (the “Website”), place an order, contact us or receive our emails. It is written to meet the requirements of the UK General Data Protection Regulation and the Data Protection Act 2018 (United Kingdom), the EU General Data Protection Regulation (European Union), the California Consumer Privacy Act as amended by the California Privacy Rights Act and other US state privacy laws (United States), PIPEDA (Canada) and the Privacy Act 1988 (Australia).
Well&trees Development LLC is the data controller (or “business” under US law) for the personal data described here. For any question or request, write to contact@wellandtrees.com with the subject line “Privacy request”.
1. What personal data we collect
- Identity and contact data: first name, last name, email address, phone number, billing address, country.
- Order data: the products you order, the country chosen, the name or dedication to be written on the plaque (which may be the name of a third person, for example a deceased relative), order amount and currency, order history, communications about your project.
- Payment data: payments are processed by Stripe and PayPal. We receive only a confirmation of payment, the payment method type, the last four digits of the card and the payment reference. We never see or store your full card number.
- Account data if you create an account: login, password (encrypted), order history.
- Communications: messages sent through the contact form, by email or on social media, and our replies.
- Technical and usage data: IP address, browser and device type, pages viewed, approximate location, source of your visit (advertising campaign, search engine), items added to the basket, and cookie identifiers – see section 7 and our Cookie Policy.
- Marketing preferences: whether you have subscribed to or unsubscribed from our emails.
We do not knowingly collect data revealing religious beliefs. A dedication such as “Sadaqah Jariyah for…” that you choose to write is used solely to produce the plaque and is not used to profile you. We do not collect data from children: the Website is intended for adults aged 18 and over, and we do not knowingly collect personal data from children under 13 (United States, COPPA) or under 16.
2. Why we use your data and on what legal basis
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Processing and delivering your order: arranging the project with our local partners, producing the plaque, sending you the GPS coordinates, photos and videos, order confirmations and project updates | Performance of the contract |
| Taking payment, preventing fraud, handling refunds and chargebacks | Performance of the contract; legitimate interest (fraud prevention); legal obligation |
| Answering your questions and providing customer support | Performance of the contract; legitimate interest |
| Reminding you of a basket you left without completing the order | Legitimate interest (you started an order with us); you can opt out at any time |
| Sending you news, offers and project updates by email | Consent, or the “soft opt-in” for existing customers for similar services (UK PECR); you can unsubscribe at any time |
| Measuring the audience of the Website and improving it (analytics, heat maps, A/B tests) | Consent (cookies); legitimate interest for cookie-less aggregated statistics |
| Advertising on Google, Meta (Facebook, Instagram), TikTok and similar platforms, measuring conversions and showing you ads based on your interests | Consent (cookies and pixels) |
| Keeping accounting and tax records, complying with legal obligations, responding to lawful requests from authorities | Legal obligation |
| Establishing, exercising or defending legal claims; protecting the Website against abuse | Legitimate interest |
We do not use your personal data for automated decision-making producing legal or similarly significant effects.
3. Who we share your data with
We share personal data only with providers who need it to deliver our services, under contracts that require them to protect it:
- Payment providers: Stripe (Stripe Payments Europe Ltd / Stripe, Inc.) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A. / PayPal, Inc.), who act as independent controllers for the payment itself.
- Local field partners: the partner organisations and contractors who build the wells and plant the trees receive only the text to be written on the plaque (name or dedication) and the country or location chosen; they do not receive your contact or payment details.
- Hosting and email: Hostinger (hosting of the Website and sending of our transactional emails, servers in the European Union).
- Analytics and advertising: Google (Google Analytics, Google Ads, Google Tag Manager), Meta Platforms (Facebook and Instagram pixel and Conversions API), TikTok, Hotjar (behaviour analytics) – only if you accept the corresponding cookies.
- Consent management: Cookiebot by Usercentrics (cookie banner and consent records).
- Well Solidarity (France), the company that created Well & Trees and whose teams help us operate the Website, customer support and field projects.
- Professional advisers and authorities: accountants, lawyers, courts and regulators where required by law.
We do not sell your personal data for money. Under the CCPA/CPRA, the use of advertising cookies and pixels may be considered “sharing” for cross-context behavioural advertising: you can opt out at any time as explained in section 8.
4. International transfers
Well & Trees is based in the United States and our teams are also located in France and Indonesia; the Website is hosted in the European Union. Your data may therefore be transferred outside the country in which you live. For data of UK and EU residents, we rely on the UK International Data Transfer Agreement or Addendum, the European Commission’s Standard Contractual Clauses, adequacy decisions (including the EU-US and UK-US Data Privacy Framework for providers certified under it) and, where appropriate, your explicit consent. You can ask us for a copy of the safeguards in place.
5. How long we keep your data
- Orders, invoices and payment records: 7 years after the order, to comply with accounting and tax obligations and to defend legal claims.
- Project proof (photos, videos, GPS coordinates with the plaque): for as long as the project exists, as part of the history of the projects we have carried out.
- Customer account: until you delete it or after 3 years of inactivity.
- Marketing emails: until you unsubscribe or after 3 years without any interaction.
- Abandoned basket data: 30 days, unless you complete the order.
- Contact form messages and support emails: 3 years after our last exchange.
- Cookies and analytics data: see the Cookie Policy (maximum 13 months for consent, 14 months for Google Analytics data).
- Consent records (cookie banner): 12 months.
6. How we protect your data
We use technical and organisational measures appropriate to the risks: HTTPS encryption of the Website, payment pages operated by PCI-DSS certified providers, access restricted to staff who need it, strong passwords and two-factor authentication on our tools, regular backups and updates. No system is completely secure; if a breach affecting your data occurs, we will notify you and the relevant authority where required by law.
7. Cookies and similar technologies
When you first visit the Website, a banner asks for your consent before any non-essential cookie is placed, as required by the UK Privacy and Electronic Communications Regulations 2003 and the EU ePrivacy Directive. Strictly necessary cookies (basket, checkout, security, consent choice) are placed without consent. You can change your choice at any time through the “cookie settings” link in the Cookie Policy. The full list of cookies, their providers and their lifetimes is available in our Cookie Policy.
8. Your rights
United Kingdom and European Union (UK GDPR, EU GDPR)
You have the right to: access your personal data; have it corrected; have it erased; restrict its processing; receive it in a portable format; object to processing based on legitimate interests, including profiling; object at any time to direct marketing; and withdraw your consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with a supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113); in the European Union, the authority of your country of residence (for example the CNIL in France).
United States (California and other states)
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another state with a consumer privacy law, you have, subject to the thresholds and exceptions of your state’s law, the right to: know what personal information we collect, use and share and for what purposes; access it; correct it; delete it; obtain a portable copy; opt out of the “sale” or “sharing” of personal information and of targeted advertising; limit the use of sensitive personal information; and not be discriminated against for exercising your rights. We do not sell personal information for money. To opt out of sharing for targeted advertising, reject “marketing” cookies in the cookie banner (link in the Cookie Policy) or email us; we also honour opt-out preference signals (Global Privacy Control) where our consent tool detects them. You may designate an authorised agent to make a request on your behalf; we will verify the request. California residents may also request a list of the categories of personal information disclosed for business purposes in the preceding 12 months. We respond within 45 days (extendable once by 45 days).
Canada (PIPEDA) and Australia (Privacy Act 1988)
You have the right to access and correct the personal information we hold about you, to withdraw consent, and to complain to us and then to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Australian Information Commissioner (oaic.gov.au). Your data is likely to be disclosed to recipients in the United States, the European Union and the countries where our projects are carried out, as described above.
How to exercise your rights
Email contact@wellandtrees.com (subject “Privacy request”) or write to Well&trees Development LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States. We may ask you to confirm your identity (for example by replying from the email address used for the order). We answer within one month (UK/EU) or 45 days (US), free of charge, unless requests are manifestly unfounded or excessive. Every marketing email we send contains an unsubscribe link, in accordance with PECR and the US CAN-SPAM Act.
9. Photos, videos and the name on the plaque
The name or dedication you provide is written on the well’s plaque and appears in the photos and videos of the project, which we send to you. We may use photos and videos of completed projects, including the plaque, in our communications and advertising (Website, social media, ads), unless you tell us in writing before the project is completed that you object. If the name belongs to another person, you confirm that you are entitled to use it.
10. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or in the law. The date at the top indicates the latest version. If the changes are significant, we will inform you by email or by a notice on the Website.
11. Contact
Well&trees Development LLC – 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States – contact@wellandtrees.com.