Privacy policy

The controller for the processing of data in the Gardeno24.de shop is:

GARDENARA Sp. z o.o., Raciborska 277, 44-280 Rydułtowy, Poland.

If you have questions about the processing of your personal data, please write to: shop@gardeno24.de

Your data is processed in order to fulfil orders and for marketing purposes.

We process the following data: first and last name, address, e-mail, telephone number, payment details, IP address and the actions carried out on the site.

Your data may be passed on to shipping companies, in particular DHL and GLS, in order to fulfil your order.

Our shop uses cookies for advertising purposes.

You can change or withdraw your consent at any time via “Privacy settings” at the bottom of every page.

We use analytics tools such as Google Analytics and the Facebook pixel to collect information about user behaviour on the site.

Your data is stored for a period of 180 days.

You have the right to access your data and to have it rectified or erased, or to have its processing restricted. To exercise these rights, please contact us at shop@gardeno24.de.

The connection to the shop is encrypted end to end with an SSL certificate.

The shop runs on its own server in Poland. We work with the following service providers to operate the shop. They receive only the data they need for their task:

Korbank (k.pl), Poland

Hosting: the shop's server and database in a data centre in Poland – all of the shop's data is stored here (customer accounts, orders, addresses, messages).

Cloudflare

Storage of encrypted backups of the shop in a data centre in the EU.

Stripe

Payment processing for card, Apple Pay, Google Pay, PayPal, Klarna, iDEAL | Wero, Bancontact, EPS and TWINT: name, e-mail address and amount, depending on the payment method also the billing address and telephone number; for payments by card, Apple Pay, Google Pay or PayPal, after dispatch also the recipient's name and delivery address, the carrier and the tracking number. Only Stripe receives the full card details; we only see the card brand, the last four digits and the expiry date. For PayPal, Klarna, iDEAL | Wero, Bancontact, EPS and TWINT the shop redirects you to the respective provider or to your bank to complete the payment.

PayPal

For payments with PayPal: after dispatch we report the carrier, the tracking number and the shipping date to PayPal.

Resend

Sending the shop's e-mails (e.g. order and shipping confirmations, customer account, withdrawal, contact form): e-mail address, name and content of the message.

dhosting.pl (Poland)

The shop's mailbox shop@gardeno24.de: receiving your e-mails to us and messages from the contact form – e-mail address, name and message content.

Mailchimp (Intuit Inc., USA)

Newsletter and promotional e-mails: e-mail address, language, country, source of the address and IP address when it was added, for buyers also orders (order number, name, items, amounts). We add the e-mail address of every buyer (section 6.1 of the terms and conditions) and the e-mail address from an uncompleted shopping cart to the mailing list; you can unsubscribe at any time via the link in every e-mail.

OpenAI (USA)

Chat assistant in the shop: the content of your messages; we first remove e-mail addresses, telephone numbers, VAT numbers and IBANs from the text. Also the translation of individual replies from our team to you.

Apilo

Processing and shipping of paid orders and invoices: name, company, billing and delivery address, telephone number, e-mail address, VAT number, items, amounts and payment method.

Shipping companies

Delivery of your parcel (details on the shipping label), see section 5.

European Commission (VIES)

Verification of the VAT number for business purchases: country code and VAT number.

Google Ireland Limited (Google Analytics 4, Google Ads, Google Merchant Center)

Only with your consent (section 6): Google Analytics 4 (“Statistics” category) – use of the shop and purchases (order number, value, items) with a cookie identifier, for customer accounts also with your customer ID; Google Ads and Google Customer Reviews (“Marketing” category) – remarketing (pages and items viewed), purchase conversion with e-mail address and telephone number as a hash value, and the invitation to the survey after the purchase (e-mail address, order number, delivery country, estimated delivery date, item numbers). With consent to “Marketing”, the server adds the e-mail address, telephone number, name and street as a hash value as well as the town, region, postcode and country to the purchase report sent to Google Analytics. Google Merchant Center: the shop's product data (names, prices, availability) for Google Shopping and ads – no personal data; the Google Customer Reviews programme runs via Merchant Center.

Meta Platforms Ireland Ltd (Facebook, Instagram)

Only with your consent to “Marketing”: Meta pixel and Conversions API – pages and items viewed, shopping cart, checkout, registration, newsletter sign-up, contact form (without its content) and purchases; for purchases also e-mail address, telephone number, name, town, postcode, country and customer identifier as a hash value, as well as IP address, browser identifier (user agent) and Meta cookie identifiers. On this basis we show and measure ads on Facebook and Instagram.

Microsoft Corporation (Microsoft Clarity)

Only with your consent to “Statistics”: Microsoft Clarity – session recordings and heatmaps; form entries as well as the checkout, customer account, payment and order confirmation pages are masked in your browser.

ipapi.co (Kloudend, Inc., USA)

Determining the country from the IP address – only when you view or buy professional plant protection products, so that customers from Poland are shown the required declaration of authorisation: your IP address. We keep the result (country) in the server's memory for up to 24 hours; we do not store the IP address in the database.

The following applies to the individual purposes, in derogation from section 8:

Order, payment, delivery, withdrawal, complaints

Contract (Art. 6(1)(b) GDPR). We keep order and invoice data for as long as tax and accounting law requires (Art. 6(1)(c) GDPR).

Customer account

Contract (Art. 6(1)(b) GDPR); until you request its deletion.

Shopping carts and guests without an order

Steps prior to entering into a contract (Art. 6(1)(b) GDPR); we delete uncompleted guest shopping carts and the data of guests without an order (except business customers) 180 days (6 months) after their last activity.

VAT number verification

Tax obligations (Art. 6(1)(c) GDPR); for verification requests without an order we delete the e-mail address, name, address and telephone number after 180 days; the VAT number, company and verification result remain stored as evidence.

E-mails and contact form

Contract or your enquiry (Art. 6(1)(b) and (f) GDPR); the shop stores the recipient and content of sent e-mails for 180 days.

Newsletter and promotional e-mails

Sign-up via the newsletter form: your consent (Art. 6(1)(a) GDPR). E-mail address of buyers: section 6.1 of the terms and conditions (Art. 6(1)(b) GDPR). E-mail address from an uncompleted shopping cart: our legitimate interest in direct marketing (Art. 6(1)(f) GDPR). Stored at Mailchimp until you unsubscribe; after that the address remains recorded there as unsubscribed until you request its deletion. The shop stores shopping cart reminders for 180 days and the list of addresses that no longer wish to receive reminders without a time limit.

Chat assistant

Answering your questions (Art. 6(1)(b) and (f) GDPR); we delete conversations after 12 months.

Statistics and marketing

Your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via “Privacy settings” at the bottom of every page. We anonymise our own statistics after 180 days; we store your choice in the banner in a cookie for 12 months.

Declaration of authorisation (customers from Poland)

Legal obligation and our legitimate interest (Art. 6(1)(c) and (f) GDPR): we keep the country determined from the IP address for up to 24 hours; the details from the declaration are kept together with the order.

Operation and security of the shop

Our legitimate interest in secure operation (Art. 6(1)(f) GDPR): server logs 30 days, backups 14 days on the server and 30 days encrypted outside the server.

Stripe, PayPal, Resend, Mailchimp, OpenAI, ipapi.co and Cloudflare as well as – only with your consent – Google, Meta and Microsoft are based in the USA or belong to groups of companies based in the USA; data may therefore be transferred to the USA. Such transfers take place on the basis of the European Commission's standard contractual clauses or an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework).

Consent to the processing of data is collected through a banner on the site.