Privacy policy
1. Who We Are
GARDENALIA ('we', 'us', 'our') is a global D2C garden lifestyle brand selling one-of-a-kind outdoor décor hand-forged from reclaimed iron. Our Shopify store is operated by [LEGAL COMPANY NAME], a company incorporated in [COUNTRY OF INCORPORATION], with its registered address at [REGISTERED ADDRESS].
Our website is located at [www.gardenalia.com] (the 'Site'). For all privacy matters, contact us at:
- Email: [privacy@gardenalia.com]
- Postal address: [REGISTERED ADDRESS]
- We aim to respond to all privacy requests within 30 calendar days.
2. What Personal Data We Collect
2.1 Data You Give Us Directly
| Data Type | How & Why We Collect It |
|---|---|
| Full name | Order placement, account registration, gift messages |
| Delivery address & billing address | Order fulfilment and invoicing |
| Email address | Order confirmation, shipping updates, optional marketing |
| Phone number | Courier delivery notifications (where provided) |
| Payment information | Processed securely by payment gateway — we do not store full card details |
| Order history & purchase preferences | Customer service, product recommendations, repeat purchase convenience |
| Communications you send us | Customer service tickets, review submissions, quiz responses |
| Gift message content | Handwritten-style gift note fulfilment |
| Newsletter sign-up preferences | Email marketing (opt-in only) |
| Garden quiz responses | Personalised product recommendations; optional email capture |
2.2 Data Collected Automatically
When you visit our Site, we and our technology partners automatically collect:
- IP address and approximate location (country/region level)
- Browser type, device type, operating system
- Pages visited, time on site, referring URL, clicks, scrolls
- Session recordings and heatmap data (where consent is given — see Section 9)
- Cookie identifiers and advertising pixel data (subject to your consent choices)
2.3 Data from Third Parties
- Payment processors (e.g. Shopify Payments, PayPal, Stripe, Klarna, Razorpay) share transaction status with us
- Courier/shipping partners share delivery status and proof-of-delivery data
- Review platforms may share your review content with us
- Social media platforms may share limited data if you connect social accounts or use social login
3. How We Use Your Personal Data
| Purpose | Legal Basis (EU/UK GDPR) |
|---|---|
| Processing and fulfilling your order | Contractual necessity |
| Sending order confirmation, dispatch notification, and delivery updates | Contractual necessity |
| Resolving customer service queries, returns, and refunds | Contractual necessity |
| Fraud prevention and security screening | Legitimate interests / legal obligation |
| Sending marketing emails (newsletters, seasonal drops) — where you opted in | Consent |
| Sending abandoned cart reminders — where you opted in or applicable law permits | Consent / Legitimate interests |
| Personalising product recommendations and search results | Legitimate interests / Consent |
| Running the garden style quiz and saving your preferences | Consent / Legitimate interests |
| Analytics to improve our website, products, and marketing | Legitimate interests / Consent |
| Complying with tax, customs, accounting, and legal obligations | Legal obligation |
| Providing loyalty, referral, or affiliate programme benefits | Contractual necessity / Consent |
4. Who We Share Your Data With
We share your data only as necessary and never sell your personal information to third parties for their own marketing purposes.
| Recipient Category | Purpose |
|---|---|
| Shopify Inc. (platform provider) | Store infrastructure, payments, checkout, data hosting |
| Payment gateway providers | Secure payment processing (Shopify Payments, PayPal, Stripe, Klarna, Razorpay, others) |
| Courier & logistics partners | Order shipment and delivery (e.g. DHL, FedEx, India Post, local last-mile partners) |
| Fulfilment / warehouse partners | Order picking, packing, and dispatch |
| Email marketing platforms | Newsletter delivery and abandoned cart flows (e.g. Klaviyo, Mailchimp) |
| SMS / WhatsApp marketing providers | Optional transactional and marketing messages (where consented) |
| Analytics providers | Google Analytics 4, Shopify Analytics — website performance |
| Advertising platforms | Meta Pixel, Google Ads, TikTok Pixel, Pinterest Tag (subject to cookie consent) |
| Review platforms | Customer review collection and display |
| Accounting / tax / ERP tools | Financial record-keeping and tax compliance |
| Customs and border authorities | Required for international shipments (name, address, order value) |
| Legal/regulatory authorities | Where required by law or valid legal process |
All third-party service providers are contractually required to process your data only for the stated purpose and to maintain appropriate security standards.
5. International Data Transfers
GARDENALIA operates globally and your data may be transferred to and processed in countries outside your home country, including India, the United States, and the European Union. These countries may not have data protection laws equivalent to yours.
Where transfers occur, we rely on appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Shopify's data transfer mechanisms under UK GDPR and EU GDPR
- Adequacy decisions where applicable
For questions about international transfers, contact [privacy@gardenalia.com].
6. How Long We Keep Your Data
| Data Category | Retention Period |
|---|---|
| Order records (name, address, items, payment confirmation) | 7 years from order date (tax and accounting obligation) |
| Customer account data | Duration of account + 2 years after last activity |
| Email marketing contact data | Until you unsubscribe or request deletion |
| Customer service communications | 3 years from resolution |
| Analytics and session data | As configured in each platform (typically 14 months for GA4) |
| Cookie and advertising identifiers | Per our Cookie Policy — typically 30 days to 13 months depending on cookie type |
| Fraud prevention data | Up to 5 years where legally required |
7. Your Privacy Rights
Depending on where you are located, you may have the following rights:
| Right | What It Means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Correction / Rectification | Ask us to correct inaccurate or incomplete data |
| Deletion / Erasure | Ask us to delete your personal data (subject to legal retention obligations) |
| Restriction | Ask us to limit how we process your data in certain circumstances |
| Portability | Receive your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests or for direct marketing |
| Withdraw consent | Withdraw any consent you have given at any time (without affecting prior processing) |
| Opt out of sale/sharing (US) | Opt out of the 'sale' or 'sharing' of personal information under CCPA/CPRA |
| Non-discrimination (US) | We will not discriminate against you for exercising your privacy rights |
To exercise any right, contact us at [privacy@gardenalia.com] with your name, email address, and the right you wish to exercise. We will respond within 30 days (or as required by applicable law). We may ask you to verify your identity before fulfilling your request.
You also have the right to lodge a complaint with your local data protection authority. In the EU, this is your national DPA; in the UK, the ICO (ico.org.uk); in India, the Data Protection Board of India (once operational).
8. Data Security
We take the security of your personal data seriously. We implement appropriate technical and organisational measures, including:
- SSL/TLS encryption for all data in transit
- Shopify's PCI-DSS compliant payment infrastructure — we do not store full payment card numbers
- Access controls limiting who within our organisation can view personal data
- Regular review of data handling practices
No system is entirely secure. If you suspect any unauthorised use of your account or data, contact us immediately at [privacy@gardenalia.com].
9. Cookies & Tracking Technologies
We use cookies and similar technologies to operate our Site, personalise your experience, and measure marketing performance. A detailed breakdown is available in our Cookie Policy (Section 5 of this document).
In summary, we use:
- Essential cookies — required for the Site to function (no consent needed)
- Functional cookies — remember your preferences and cart contents
- Analytics cookies — Google Analytics 4, Shopify Analytics (consent required in EU/UK)
- Advertising/marketing cookies — Meta Pixel, Google Ads, TikTok Pixel, Pinterest Tag (consent required)
- Personalisation cookies — product recommendations, quiz results
You can manage your cookie choices at any time via the Cookie Preferences link in our website footer. Residents of the EU and UK can reject non-essential cookies and the Site will continue to function.
10. Children's Privacy
Our Site is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a child, please contact us at [privacy@gardenalia.com] and we will delete it promptly.
11. Marketing Communications
We will only send you marketing emails, SMS, or WhatsApp messages where you have opted in. You can unsubscribe or opt out at any time by:
- Clicking 'Unsubscribe' in any marketing email
- Replying STOP to any SMS marketing message
- Contacting us at [privacy@gardenalia.com]
Opting out of marketing does not affect transactional messages (order confirmation, shipping updates).
12. Jurisdiction-Specific Addendums
12a. EU & UK GDPR
Our legal bases for processing are set out in Section 3. Where we rely on legitimate interests, we balance these against your rights and freedoms. Our EU/UK representative for GDPR purposes is [EU/UK REPRESENTATIVE NAME AND ADDRESS — to be appointed if required].
12b. California (CCPA / CPRA)
California residents have additional rights under CCPA/CPRA, including the right to know what personal information we collect, to delete it, to opt out of its 'sale' or 'sharing', and to non-discrimination. We do not 'sell' personal information in the traditional sense. We do share identifiers and browsing activity with advertising platforms (Meta, Google, TikTok) which may constitute 'sharing' under CCPA/CPRA. California residents may opt out via our Cookie Preferences. To submit a CCPA request, contact [privacy@gardenalia.com] with 'CCPA Request' in the subject line.
12c. Australia (Privacy Act 1988)
Australian customers have rights under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). We handle your data consistently with these obligations. To access or correct your information, or to make a complaint, contact [privacy@gardenalia.com]. If we cannot resolve your complaint, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).
12d. Canada (PIPEDA / Law 25)
Canadian residents have rights under PIPEDA (federal) and provincial privacy legislation. We collect only the information necessary for the purposes identified, with your knowledge and consent. To access your personal information or withdraw consent, contact [privacy@gardenalia.com].
12e. India (DPDP Act 2023)
Indian customers have rights under the Digital Personal Data Protection Act, 2023. As a Data Fiduciary, we process your personal data for lawful purposes with your consent or on other permitted grounds. You have the right to access, correct, and erase your data. Contact [privacy@gardenalia.com] for any requests.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the 'Last Updated' date at the top of this page. For material changes, we will notify you by email or by a prominent notice on our Site. Continued use of the Site after changes take effect constitutes your acknowledgement of the updated policy.
Last updated: June 2026