Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data within the meaning of the EU General Data Protection Regulation (GDPR) is:

2. Data We Collect

We process the following categories of personal data:

• Order data: name, shipping & billing address, email, phone number (optional), ordered items
• Payment data: processed by our payment provider (we never store your full card number)
• Account data: email and a hashed password if you choose to create an account
• Usage data: anonymised analytics, IP address, browser type, pages viewed

3. Legal Basis (Art. 6 GDPR)

We process your data on the following legal bases: performance of a contract (Art. 6(1)(b) GDPR) for orders and account management; compliance with a legal obligation (Art. 6(1)(c) GDPR) for tax and accounting records; your consent (Art. 6(1)(a) GDPR) for non-essential cookies and marketing; and our legitimate interests (Art. 6(1)(f) GDPR) for fraud prevention and service improvement.

4. Purposes of Processing

Your data is used to process and ship your orders, handle returns and warranty claims, provide customer support, send transactional emails, meet our legal accounting obligations, and — only with your explicit consent — send occasional product updates.

5. Cookies

We use strictly necessary cookies to make the Shop work (e.g. your shopping cart and session). Analytics or marketing cookies are only set with your prior consent through our cookie banner. You can withdraw your consent at any time via the cookie settings link in the footer.

6. Payment Processing

Payments are handled by PCI-DSS certified payment service providers (e.g. Stripe, Mollie). When you pay, the payment data is transmitted directly to the provider via an encrypted connection. We only receive a confirmation that the payment was successful, along with a token for reference.

7. Data Retention

We retain order and invoice data for the periods required by EU tax and commercial law (typically 7–10 years). Account data is kept for as long as your account exists. Analytics data is anonymised after 14 months.

8. Sharing With Third Parties

We share data only with carefully selected processors who help us run the Shop: shipping carriers, payment providers, email and hosting providers, and analytics tools. All processors are bound by data processing agreements under Art. 28 GDPR. We never sell your personal data.

9. Your Rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectify inaccurate data (Art. 16)
• Have your data erased ("right to be forgotten", Art. 17)
• Restrict or object to processing (Art. 18, 21)
• Receive your data in a portable format (Art. 20)
• Withdraw consent at any time, with effect for the future

To exercise any of these rights, email support@verdegrowz.com.

10. Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority of the EU member state where you live, work or where the alleged infringement took place.