This policy explains what personal data we collect when you use this website, order from us, request a quote or subscribe to our newsletter, what we do with it and the choices you have. We collect only what we need to answer you, fulfil orders and keep the site secure.
Last updated: October 11, 2026
On this page
Who is responsible
MycoRova is responsible for your personal data (the “controller” or “personal information controller”). For anything about your data, contact us at privacy@mycorova.com. Our data protection officer is MycoRova — Privacy Office (privacy@mycorova.com).
What we collect
| When you… | We collect |
|---|---|
| Request a quote | Name, company and job title, email, phone and WhatsApp number if given, city and country, delivery destination, product requirements, your message, any file you attach, how you heard about us, and the language you used. |
| Place an order | Name, billing and delivery address, email, phone, items ordered, payment status and order history. Card details are entered on the payment provider’s secure form and are not stored by us. |
| Create an account | Your email, name and an encrypted password, plus your orders, quotes and the messages exchanged with our team. |
| Subscribe to the newsletter | Your email, first name if you give it, the lists you joined, where you signed up, your language, confirmation date and any promo code issued to you. |
| Browse the site | Technical data needed to deliver pages and protect forms: your IP address and browser type. Our forms keep the IP address only as a one-way hash for a short time to limit spam; the shop records the IP address with each order to help prevent payment fraud. Also the cookies and browser storage described in our Cookie Policy. |
Please do not send us sensitive information (such as health data) that we have not asked for.
Why we use it and on what basis
- To answer quote requests and messages, and to fulfil and deliver orders: because it is necessary to take steps you asked for or to perform our contract with you.
- To keep accounting and tax records and meet import/export rules: because the law requires it.
- To keep the site and forms secure and prevent fraud and spam: our legitimate interest in running a safe service.
- To send newsletters and promo codes: your consent, which you give by confirming your subscription and can withdraw at any time.
- To improve our products and service from the feedback and order patterns we see: our legitimate interest, never overriding your rights.
We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
Who we share it with
We share personal data only with service providers who need it to do their job for us, under contracts that require them to protect it:
- payment providers, to take payment and prevent fraud;
- carriers, freight forwarders and customs brokers, to deliver your order and clear it through customs (customs authorities may also receive data on export and import declarations);
- our website host and email delivery service, which store and send data on our behalf;
- a spam-protection service on our forms, if enabled, which checks that a form was sent by a person;
- professional advisers such as accountants and lawyers, where needed;
- authorities, when the law requires it.
International transfers
We source mushrooms from several countries in Asia, Europe and North America and sell to buyers in other countries, so your data may be processed outside the country where you live, for example by our sourcing partners or by a carrier in the destination country. Where the law requires it, we use recognised safeguards such as standard contractual clauses, and we ask for your separate consent where a law (such as China’s Personal Information Protection Law) requires it for cross-border transfers.
How long we keep it
- Orders and invoices: as long as tax and accounting law requires.
- Quote requests and messages: while the enquiry is open and for a limited period afterwards to handle follow-up questions and repeat orders; then deleted or anonymised.
- Accounts: until you ask us to close the account, apart from order records we must keep.
- Newsletter: until you unsubscribe. We keep a minimal record of the unsubscription so we do not email you again.
Your rights
Depending on where you live, data protection laws such as the EU and UK GDPR, US state privacy laws such as the CCPA, and China’s Personal Information Protection Law give you rights over your data. These include the right to:
- be informed about how your data is used (this policy);
- access the data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased or blocked when it is no longer needed or was processed unlawfully;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- restrict processing in some circumstances;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- complain to a supervisory authority, such as the data protection authority where you live.
To use any of these rights, email privacy@mycorova.com. We may ask you to confirm your identity, and we reply within the time the law sets. You can also see and update your details yourself in your account.
Newsletters and promotions
We send newsletters only to people who asked for them and confirmed their email address. Every email has a one-click unsubscribe link. Popups and banners on this site remember in your browser whether you closed them, so they do not keep reappearing; this stays on your device (see the Cookie Policy). We count how often each popup is shown and used, without linking those counts to you.
Security
The site uses encrypted connections, passwords are stored encrypted, and files attached to quote requests are kept outside the public part of the site and are available only to you and our team. No system is perfectly secure; if a breach affected your data, we would tell you and the authorities as the law requires.
Children
This site and our products are intended for adults. We do not knowingly collect data from anyone under 18.
Changes to this policy
We update this policy when our practices change. The date at the top shows the latest version. Significant changes will be announced on the site or by email.