Article 1 – Data Controller
The data controller is:
2JP s.r.o.
Hurbanova 1924/14, 052 01 Spišská Nová Ves, Slovak Republic
Company ID (IČO): 52707199
Phone: +421 903 416 803
Email: info@gridgarden.eu
We process personal data when operating the gridgarden.eu website, the GridGarden e-shop and the GridGarden Studio app.
Article 2 – Scope of Processed Data
When using our services, we process the following categories of personal data:
2.1 Identification Data
- Name and surname
- Company name and registration number (for business customers)
2.2 Contact Data
- Email address
- Phone number
- Delivery address
- Billing address
2.3 Transaction Data
- Order history
- Payment data – card payments are processed by Stripe; we do not see or store your card details
2.4 Technical Data
- IP address
- Browser and device information
- Technical records of website and app errors
- Cookies and similar browser storage (see Article 13)
2.5 Account and designs in Studio
- Email address for signing in (we send you a sign-in link by email)
- Saved garden designs and app settings
2.6 Data used by artificial intelligence features
- Garden photos you upload to AI photo and sketches you upload to Studio
- Texts you write to the AI architect or in the AI chat
- Your ratings of AI proposals (your choice of proposal, thumbs up or down, labels, free text)
You must provide the data needed for the order and invoice (name, contact details, address), otherwise we cannot conclude the contract; billing details are required by law. All other data is provided voluntarily. We do not carry out automated decision-making or profiling that has legal effects on you (Art. 22 GDPR).
We obtain most data directly from you. If your purchase was arranged by one of our business partners (a reseller), we received the data needed to process and deliver the order (name, contact details, address) from that partner.
If you bought from GridGarden or subscribed to our newsletter before October 13, 2026, we took over your data from the previous operator of the GridGarden shop (a sole trader based in Slovakia). We took over customers' identification and contact details, delivery and billing addresses and order history, and for newsletter subscribers their e-mail address and consent record. We process them for the same purposes as before: handling warranties and claims for earlier purchases, accounting obligations, and sending the newsletter to those who consented to it. You can withdraw your consent at any time and you have all the rights described in Article 6.
Article 3 – Processing Purposes
We process your personal data for the following purposes:
| Purpose | Legal Basis | Retention Period |
|---|---|---|
| Order processing and fulfillment | Contract performance (Art. 6(1)(b) GDPR) | 4 years from delivery of the goods; for a claim, 4 years from when it was made |
| Accounting and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) | 10 years from end of accounting period |
| Order communication | Contract performance (Art. 6(1)(b) GDPR) | 4 years from delivery of the goods; for a claim, 4 years from when it was made |
| Handling claims and complaints | Contract performance, legal obligation | 4 years from claim submission |
| Answering your questions and support (e-mail, phone) | Performance of a contract or legitimate interest in replying to you (Art. 6(1)(b) and (f) GDPR) | As long as needed to deal with your question, at most 4 years after the last message |
| Account and saving designs in Studio | Contract performance (Art. 6(1)(b) GDPR) | Designs with an account 36 months after the last account activity, designs without an account 12 months after the last edit; we do not delete a design that is part of an order or the gallery. The account itself remains until you delete it or ask us to erase it |
| AI photo, AI architect and AI chat | Contract performance (Art. 6(1)(b) GDPR) | AI photos and their designs linked to an e-mail address 3 years after your last activity, without an e-mail 90 days; AI chat transcripts 12 months after the last message |
| Unpaid cart (including a copy of the design and snapshots of the beds) | Contract performance (Art. 6(1)(b) GDPR) | 12 months after the cart expires, together with the data in it; we do not delete a cart that became an order (the order period applies) |
| Improving and further training our AI – mainly the AI architect in Studio (Studio Architect), using your briefs and ratings of its designs, and also original AI photo uploads (after our review, internal use only) | Legitimate interest in improving our own service (Art. 6(1)(f) GDPR); you can object at any time by e-mail to info@gridgarden.eu – we will remove your photos and ratings from training; credits for further ratings of designs are then no longer refunded (Article 12.3) | As long as we keep the design or photo concerned (see the rows above); anonymised ratings may be kept longer |
| Marketing and newsletter | Consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn |
| Measuring visits and advertising (Google Analytics, Google Ads) | Consent (Art. 6(1)(a) GDPR) | See Article 13 |
| Anonymous visit measurement without cookies (Google Analytics) | Legitimate interest in knowing how many people visit the website and where they come from (Art. 6(1)(f) GDPR); no cookies and no identifier | Nothing is stored in your browser; only totals in our reports |
| Security and error logging for the website and app | Legitimate interest in protecting our services and fixing errors (Art. 6(1)(f) GDPR) | At most 90 days |
| Improving the website and Studio using technical and aggregated data | Legitimate interest in improving our services (Art. 6(1)(f) GDPR) | 3 years |
Article 4 – Data Recipients
Your personal data may be disclosed to the following categories of recipients:
- Shipping companies – GLS, Geis – to deliver the goods
- Payment service providers – Stripe – processing card payments, issuing invoices and calculating and recording tax (Stripe Tax; this uses the billing address and the country from the IP address); to prevent fraud, Stripe also processes some data as an independent controller under its own privacy policy
- Hosting – Hetzner Online GmbH – servers in a data centre in Germany (Falkenstein) running the website, e-shop, Studio, databases and error tracking (GlitchTip, which we run ourselves)
- Email – Google (Google Workspace) – sending and receiving email from info@gridgarden.eu
- Artificial intelligence – Google (Gemini API) and Replicate – processing photos, sketches and texts in AI features (Article 12)
- Analytics and advertising – Google (Google Analytics, Google Ads) – cookies only with your consent; without consent only anonymous visit measurement without cookies (Article 13)
- Accounting and legal services – fulfillment of legal obligations
- Public authorities – in cases required by law
If you use the plot or map feature in Studio (address search, aerial image of your plot), your browser queries OpenStreetMap (address search via Nominatim) and national map portals (aerial imagery, for example ČÚZK, IGN or PDOK) directly. These services see your IP address and the address you search for.
Article 5 – International Data Transfers
Some providers are based in the USA or may process data there. Google LLC and Stripe, Inc. are certified under the EU–US Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023. Transfers to Replicate, Inc. are governed by the EU standard contractual clauses. We will send you a copy of these safeguards on request – write to info@gridgarden.eu. Our servers are in Germany.
Article 6 – Data Subject Rights
In connection with the processing of your personal data, you have the following rights:
6.1 Right of Access (Art. 15 GDPR)
You have the right to obtain confirmation whether your personal data is being processed, and if so, to access that data.
6.2 Right to Rectification (Art. 16 GDPR)
You have the right to have inaccurate personal data corrected and incomplete data completed.
6.3 Right to Erasure (Art. 17 GDPR)
You have the right to have your personal data erased when the purpose of processing has been fulfilled or when you withdraw consent. This right does not apply when processing is necessary for compliance with a legal obligation.
6.4 Right to Restriction of Processing (Art. 18 GDPR)
You have the right to request restriction of processing in cases specified by GDPR.
6.5 Right to Data Portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used and machine-readable format.
6.6 Right to Object (Art. 21 GDPR)
You have the right to object to processing based on legitimate interest, including profiling and direct marketing.
6.7 Right to Withdraw Consent
If processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing before its withdrawal.
6.8 Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority: the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk, or the supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement.
Article 7 – Exercising Your Rights
You can exercise your rights:
- Email: info@gridgarden.eu
- Phone: +421 903 416 803
- By mail: 2JP s.r.o., Hurbanova 1924/14, 052 01 Spišská Nová Ves
We will respond to your request within 30 days.
Article 8 – Data Security
We have implemented appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction or misuse:
- SSL encryption of all communications
- Card payments through the Stripe payment gateway – we do not see or store card details
- Regular security system updates
- Restricted access to personal data
Article 9 – Automated Emails
Apart from emails about your order, the sign-in link and emails you request yourself (for example a discount code), we may send you these automated emails:
9.1 Reminders of a design in progress in Studio
If you have a Studio account and a saved design but have not bought yet, we send you at most 2 reminders (about 24 hours and 7 days later). If you start a design on your phone, we may send you a link once so that you can continue on a computer. The reminders stop when you buy or unsubscribe.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR; Section 116 of Slovak Act No. 452/2021 Coll. on electronic communications). Retention: Until you unsubscribe or delete your account. We send the reminders on the basis of legitimate interest; you can refuse them when you register, in your account settings and via the link in every e-mail.
9.2 Newsletter
If you subscribe to our newsletter, we send you growing tips, product news and offers.
Legal basis: Consent (Art. 6(1)(a) GDPR). Retention: Until consent is withdrawn.
Every one of these emails contains an unsubscribe link. You can also unsubscribe by email at info@gridgarden.eu. Unsubscribing from one list stops all our marketing emails.
Article 10 – Data Deletion
You can request deletion of your personal data at any time:
- By email: info@gridgarden.eu
- On request we also delete your Studio account and saved designs
Please note that we may retain certain data where required by law (e.g., accounting records for 10 years, claims records for 4 years). In such cases, the data will be restricted to the legally required purpose only.
We will process your deletion request within 30 days and confirm the action by email.
Article 11 – Retention Periods Summary
The following maximum retention periods apply to your personal data:
| Purpose | Retention Period |
|---|---|
| Orders and customer data | 4 years from delivery of the goods; for a claim, 4 years from when it was made |
| Accounting and tax obligations | 10 years from end of accounting period |
| Answering your questions and support (e-mail, phone) | As long as needed to deal with your question, at most 4 years after the last message |
| Account and saving designs in Studio | Designs with an account 36 months after the last account activity, designs without an account 12 months after the last edit; we do not delete a design that is part of an order or the gallery. The account itself remains until you delete it or ask us to erase it |
| AI photo, AI architect and AI chat | AI photos and their designs linked to an e-mail address 3 years after your last activity, without an e-mail 90 days; AI chat transcripts 12 months after the last message |
| Unpaid cart (including a copy of the design and snapshots of the beds) | 12 months after the cart expires, together with the data in it; we do not delete a cart that became an order (the order period applies) |
| Improving and further training our AI – mainly the AI architect in Studio (Studio Architect), using your briefs and ratings of its designs, and also original AI photo uploads (after our review, internal use only) | As long as we keep the design or photo concerned (see the rows above); anonymised ratings may be kept longer |
| Newsletter and Studio reminders | Until you unsubscribe or withdraw consent |
| Measuring visits and advertising (Google Analytics, Google Ads) | See Article 13 (Google Analytics cookies at most 2 years, ad visit source 90 days) |
| Anonymous visit measurement without cookies (Google Analytics) | Nothing is stored in your browser; only totals in our reports |
| Security and error logging for the website and app | At most 90 days |
| Improving the website and Studio using technical and aggregated data | 3 years |
Article 12 – Artificial intelligence (AI)
12.1 With AI photo you upload a photo of your garden. The photo and your brief are processed by the Google Gemini service, which creates the proposal; to recognise objects in the photo (for example doors or a fence) it is also processed by the Replicate service. Images from AI photo are generated by artificial intelligence and are for illustration only.
12.2 With the AI architect and the AI chat in Studio we send the text you write and a description of your design to the Google Gemini service; when you upload a sketch, also the sketch image.
12.3 To improve and further train our AI – mainly the AI architect in Studio (Studio Architect) – we use your briefs and ratings of its designs, as well as original AI photo uploads, always only after our review and only internally – we never publish them. The legal basis is our legitimate interest in improving the service (Article 3); you can object at any time by e-mail to info@gridgarden.eu and we will remove your data from training. Credits for rating designs are refunded as a reward only if we may use the rating to improve the AI; after an objection they are no longer refunded for further ratings (Terms and Conditions, Article IX).
12.4 How we use your ratings of AI proposals is described in the terms and conditions, section How we use feedback.
Article 13 – Cookies and browser storage
The gridgarden.eu website and the GridGarden Studio app store cookies and similar data (localStorage, sessionStorage) in your browser. Necessary ones keep the website, cart and sign-in working. Analytics and advertising ones are used only with your consent in the cookie banner. Without consent we only measure visits anonymously: your browser sends Google Analytics a signal without cookies and without any identifier that could recognise you (the page viewed, where you came from, language and device type). Nothing is stored in your browser, and in our reports we only see total visit numbers that Google estimates from these signals.
Cookies and local browser storage (localStorage, sessionStorage)
| Name | Purpose | Storage period | Category |
|---|---|---|---|
gg_consent | Stores your choice in the cookie banner (website and Studio) | 180 days | Necessary |
gg_lang, gg_langsug | Remembers the website language you chose, or that you closed the language suggestion | 1 year (closed language suggestion 30 days) | Necessary |
gg_region, gg_region_src, gg_region_out | Delivery country, so that we show the right prices and shipping | 1 year | Necessary |
gg_cart_v1, gg_cart_discount_v1 (localStorage) | Your cart and the discount code you entered | No fixed period, until you delete it in your browser | Necessary |
gg_shop_ship_v1, gg_shop_sid_v1, gg_ka_compare (sessionStorage) | Chosen shipping, checkout progress and product comparison | Until the browser tab is closed | Necessary |
gg_studio_sid | Signing in to your account | 30 days | Necessary |
gg_studio_anon | Links a design in progress without an account to your browser | 1 year | Necessary |
NEXT_LOCALE | Remembers the Studio language you chose | At most 1 year | Necessary |
gg_viewport_class | Device type (phone, tablet, computer), so that Studio displays correctly | 30 days | Necessary |
gg_ui_scale, gg-rs3, gg-plant-lite … (localStorage, Studio) | Display and 3D quality settings in Studio | No fixed period, until you delete it in your browser | Necessary |
gg_internal | Our team only: turns off visit measurement | 1 year | Necessary |
_ga, _ga_<ID> | Google Analytics: distinguishing visitors and visits | 2 years | Analytics |
gg_attribution_v1, gg_attribution_last_v1 (localStorage) | Visit source from an ad or campaign (gclid, UTM), so that an order can be attributed to the campaign | 90 days | Advertising |
Google Ads (Studio) | In Studio, after you consent to advertising, Google Ads may set its own cookies to measure ad results (for example _gcl_au, 90 days) and, for remarketing, cookies on the doubleclick.net domain (for example IDE, about 13 months); the exact names and durations are set by Google | Set by Google | Advertising |
You can change your choice at any time using the “Cookie settings” link in the website footer.
Article 14 – Final Provisions
This privacy policy is effective from October 13, 2026. We may update it; we will inform you about significant changes.