Personal inquiry data remains protected under explicit privacy standards.
Our garden center processes visitor contacts solely to clarify plant orders, coordinate seasonal nursery stock, and manage active advertising signals transparently.
Effective Date & Scope
This Privacy Policy took effect on November 12, 2026 and governs all information collected through johnsongardenscenter.com. We operate as a commercial plant nursery and garden center serving Cookeville and surrounding Middle Tennessee communities. This notice explains what records we create when you browse our plant catalogue, submit an inquiry for seedlings or trees, or contact our nursery team.
Data Controller & Operator
The data controller responsible for personal information processed on this website is Johnsongardenscenter, trading at johnsongardenscenter.com:
Johnson Gardens Center
1717 E Spring St, Cookeville, Tennessee 38506, Cookeville, Tennessee, United States
Telephone: 931-528-8000
Direct Email: [email protected]
Our nursery has operated continuously in Cookeville since 2018 under operator Ivan Petrov and maintains active membership in the TN Nursery Association since 2018.
Categories of Data Collected
Our website operates strictly on an inquiry basis. We do not maintain customer accounts, we do not require passwords, and we do not process financial transactions, debit cards, or credit cards online. The data we collect is limited to the following operational categories:
- Inquiry Form Submissions: When you submit a quote request via our inquiry form, our backend script records your full name, telephone number (optional), email address (optional, provided one contact method is supplied), physical delivery address if provided, the category of plant stock requested (such as container plants, bare-root seedlings, trees and shrubs, or garden kits), specific project notes, plant specifications, and your affirmative consent confirmation.
- Automated Transmission Metadata: With every form submission, our server logs the client IP address, browser user-agent string, referring URL, the exact timestamp when the form interface rendered, and the timestamp of submission.
- Support Messaging Records: When you initiate a conversation via our nursery chat interface, the message content and an associated random session token are transmitted to our server and stored locally in your browser storage so you can resume the conversation.
- Technical Server Logs: Standard HTTP request logs recording access timestamps, requested file paths, HTTP response codes, and network IP addresses.
- Consent Status: Your choice to permit or decline non-essential storage keys is stored on your device under the local key
site_consent_v2. - Paid Campaign Identifiers: Advertising campaign click parameters attached to incoming landing URLs from active marketing channels.
Specific Purposes of Processing
We process personal records strictly for concrete nursery business operations:
- Formulating non-binding pricing estimates for plants and seedlings ($7.99 to $97.90 per unit), trees and shrubs ($15 to $100 per unit), or garden kits ($1.70 to $3 per unit).
- Verifying physical availability of seasonal container seedlings, bare-root rootstocks, and balled-and-burlapped landscape trees.
- Responding to questions regarding on-site customer pickup at 1717 E Spring St or potential local delivery scheduling across Cookeville and the Upper Cumberland region.
- Providing customer support and technical troubleshooting through direct email, telephone consultations, or nursery messaging.
- Preventing malicious script abuse, automated form spam, and unauthorized server load.
- Measuring advertising channel effectiveness across paid search and social campaigns without creating invasive behavioural profiles.
Lawful Bases for Processing
For visitors subject to statutory privacy regimes requiring designated legal bases, we process your information under the following grounds:
- Pre-Contractual Steps & Contract Performance: Processing inquiry form submissions, contact information, and plant specifications is necessary to provide price estimates and confirm product availability at your direct request before entering into a commercial purchase.
- Consent: Storing non-essential cookies, persisting optional chat tokens in your browser, and passing enriched advertising attribution parameters depend upon your voluntary, affirmative consent given through our consent banner.
- Legitimate Interests: Maintaining server security logs, detecting spam via hidden honeypot fields, and ensuring our Cookeville web infrastructure operates reliably fall under our legitimate commercial interests, balanced against visitor privacy rights.
- Legal Obligation: Retaining core commercial communications and accounting records to comply with Tennessee commercial codes and federal tax regulations.
Advertising Platforms & Click Identifiers
Our website actively receives incoming traffic from paid digital advertising campaigns. Specifically, Google Ads, Microsoft Advertising, and Meta Ads drive targeted visits to our nursery offerings. Each platform appends a dedicated click identifier to our landing page URLs when a prospective gardener clicks an ad:
- google ads: Appends the
gclid(Google Click Identifier) parameter to measure campaign relevance and ad conversions. - microsoft advertising: Appends the
msclkid(Microsoft Click Identifier) parameter for Bing and partner network performance attribution. - Meta Ads: Appends the
fbclid(Facebook Click Identifier) parameter for referral verification from Meta platforms.
These click identifiers are processed in real time. We do not sell personal data, nor do we exchange customer inquiries with data brokers.
Google Consent Mode v2 Signals
To ensure rigorous compliance with international privacy mandates, this site implements consent mode (specifically Google Consent Mode v2) across all advertising and analytical scripts. By default, before a visitor makes a selection on our consent banner, the four foundational tracking signals are strictly held in a denied state:
ad_storage: Denied by default; no advertising cookies or storage keys are created.ad_user_data: Denied by default; personal data associated with online advertising is withheld from third-party networks.ad_personalization: Denied by default; remarketing and personalized audience features remain inactive.analytics_storage: Denied by default; measurement identifiers and analytical cookies are blocked.
Only if you explicitly click “Allow storage” are these four parameters updated to granted. If you decline storage or later reopen your preferences to revoke consent, all four signals immediately revert to denied, and non-essential tracking ceases instantly.
Authorized Processors & Service Providers
We share personal information only with vetted third-party service providers who assist in operating our website, managing nursery communications, and measuring marketing campaigns:
- Google LLC & Google Ireland Limited: Providers of Google Ads measurement infrastructure and advertising technology.
- Microsoft Ireland Operations Limited & Microsoft Corporation: Providers of Microsoft Advertising services. Review Microsoft data practices at privacy.microsoft.com (https://privacy.microsoft.com/en-us/privacystatement).
- Meta Platforms Ireland Limited & Meta Platforms, Inc.: Providers of Meta advertising and attribution services.
- Web Hosting & Infrastructure Providers: Managed server facilities hosting johnsongardenscenter.com and storing local PHP inquiry records within secure domestic data centers.
- Transactional Email Services: Encrypted Simple Mail Transfer Protocol (SMTP) relays delivering customer inquiry notifications directly to our office inbox.
Cross-Border Data Transfers
Johnson Gardens Center is located in Cookeville, Tennessee, United States. While our primary servers and operations reside within the United States, our advertising and technological partners operate distributed worldwide infrastructure. If you access our website from outside the United States, your communications and technical metadata are transferred to and processed within the United States. Where personal data is transferred out of the European Economic Area or United Kingdom, our technological partners rely upon Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent adequacy frameworks to guarantee equivalent protection standards.
Defined Retention Periods
We do not keep personal information indefinitely. We maintain concrete, purpose-based retention windows for all categories of visitor data:
- Customer Inquiry Records & Email Correspondence: Retained for 24 months from submission to resolve follow-up planting questions, seasonal tree orders, and repeat nursery quote requests, after which records are purged.
- Support Chat Transcripts: Retained on our server for 12 months following conversation conclusion.
- Technical Web Server & Access Logs: Kept for exactly 60 days for network security analysis and intrusion detection before automatic rotation and deletion.
- Visitor Consent Records: The local browser record of your consent choice (
site_consent_v2) persists for 12 months unless cleared manually. - Data Subject Access Requests (DSAR): All inquiries, verification records, and fulfillment correspondence are answered within 5 days and retained for 36 months to document regulatory compliance.
Information Security Safeguards
We protect visitor records through industry-standard physical, administrative, and technical safeguards. All data transmitted between your browser and our nursery server is encrypted using Transport Layer Security (TLS 1.2 and TLS 1.3) with valid digital certificates. Our inquiry handler utilizes hidden honeypot verification fields to intercept automated scraping bots without imposing frustrating puzzles on human visitors. Server access is restricted to authorized personnel via key-based authentication, and operating software receives routine security patches. Because we execute no online financial processing, payment card data is never accepted, transmitted, or stored on our infrastructure.
European Visitor Rights Under GDPR
If you visit our website from the European Union, European Economic Area, or United Kingdom, you hold specific statutory rights under the General Data Protection Regulation (gdpr):
- Right of Access: You may request confirmation of whether we process your personal data and obtain a copy of all retained records under gdpr provisions.
- Right to Rectification: You may demand correction of inaccurate or incomplete contact details or planting project specifications.
- Right to Erasure (“Right to be Forgotten”): You may request permanent deletion of your inquiry records where retention is no longer necessary.
- Right to Restriction of Processing: You may restrict processing while a contest regarding data accuracy or lawful basis is investigated.
- Right to Data Portability: You may receive your personal inquiry records in a structured, commonly used, and machine-readable format.
- Right to Object: You may object at any time to processing grounded in our legitimate interests.
- Right to Withdraw Consent: Where processing depends on consent, you may withdraw that consent at any time without affecting prior lawful processing.
United States State Privacy Rights (CCPA/CPRA)
Residents of United States jurisdictions with enacted state privacy legislation—including California under the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa/CPRA), the Tennessee Information Protection Act, and comparable consumer statutes in Colorado, Virginia, Utah, and Connecticut—enjoy specific privacy prerogatives:
- Right to Know: You may request the categories and specific pieces of personal information collected, the business purposes for collection, and the categories of third-party recipients.
- Right to Delete: You have the right to request deletion of personal information gathered from you, subject to statutory business exemptions under ccpa rules.
- Right to Correct: You may request correction of inaccurate personal records.
- Right to Opt Out of Sale or Sharing: We do not sell your personal information for monetary compensation. To the extent that third-party ad tracking identifiers (such as Google Ads or Meta Ads cookies) are deemed “sharing” under ccpa regulations, you may opt out via our consent banner or Global Privacy Control signal.
- Non-Discrimination: We will never deny nursery services, alter plant price bands ($7.99 to $97.90 for seedlings, $15 to $100 for trees), or degrade service quality because you exercised statutory privacy rights.
Global Privacy Control Recognition
Our website programmatically detects and honors global privacy control (GPC) signals transmitted by compatible browser software (via the Sec-GPC request header). When our server detects an active global privacy control signal, all optional advertising and analytics signals are automatically set to denied, preventing non-essential tracking without requiring manual interaction with our consent banner.
Children’s Privacy Notice
Our website is directed toward homeowners, landscape contractors, and adult gardening enthusiasts. We do not knowingly market plant nursery goods to children, nor do we knowingly collect personal data from individuals under the age of 16. If we discover that a minor under 16 has submitted contact details through our inquiry form, we will delete those records immediately. Parents or guardians who believe their child has provided contact information may write to us at [email protected] for prompt removal.
Supervisory Authorities & Complaints
If you have concerns regarding our data handling practices, we encourage you to contact us directly so we can resolve the issue. However, you retain the legal right to lodge a complaint with an appropriate supervisory regulatory body:
- Tennessee Residents: Office of the Tennessee Attorney General and Reporter, Consumer Protection Division.
- California Residents: California Privacy Protection Agency (CPPA) or the California Office of the Attorney General.
- European Residents: The competent Data Protection Authority in your EU Member State or the Information Commissioner’s Office (ICO) in the United Kingdom.
Data Subject Access Requests (DSAR)
To exercise your statutory privacy rights—including requests to inspect, correct, export, or delete your inquiry records—submit a formal Data Subject Access Request using either method below:
- Email Request: Send an email with the subject line “Privacy Data Request” to [email protected].
- Postal Request: Mail your written request to Johnson Gardens Center, Attn: Privacy Coordinator, 1717 E Spring St, Cookeville, Tennessee 38506, United States.
Please specify your full name, the email address or telephone number submitted on your original plant inquiry, and the specific action requested. We verify requests by sending a confirmation note to the email address on file. Our team answers all verified requests within 5 days of receipt at no financial cost to you.
Amendments to This Policy
We review and update this Privacy Policy periodically to reflect technological adjustments, changes to our plant nursery operations, or emerging regulatory guidelines. Any amendments will be published directly on this page with an updated “Effective Date” at the top. We encourage visitors to review this policy whenever submitting an inquiry for Cookeville nursery stock.
Direct Privacy Contact
If you have questions regarding this Privacy Policy, our data protection protocols, or the handling of your plant inquiry records, reach out directly to our management team:
Johnson Gardens Center
Attn: Ivan Petrov, Nursery Management
1717 E Spring St, Cookeville, Tennessee 38506, United States
Telephone: 931-528-8000
Inquiry Email: [email protected]