Privacy Policy
1) Introduction
This Privacy Policy explains how we collect, use, share and protect your personal data when you visit our website, create an account, place an order, contact us or otherwise interact with our services.
“Personal data” means information that relates to an identified or identifiable individual.
2) Data Controller and Contact Details
Data Controller (UK GDPR):
Tomasz Wojs (Sole Trader)
Garden-Aches, Haus A, 1. Stock Edisonstraße 63, 12459 Berlin, Deutschland
Tel.: +44 2045770301
Email: info@garden-arches.com
VAT: PL7343064345
UK Representative (if required)
If you are located in the UK, we may be required to appoint a UK GDPR representative where UK GDPR applies to us but we have no UK establishment (Article 27 UK GDPR). If/when appointed, we will publish the representative’s name and UK contact address here.
3) What Data We Collect
- Website / device data: IP address, device type, browser, operating system, referring pages, date/time of access, and similar technical logs.
- Account data: name, email, password (stored in encrypted/hashed form), addresses, order history.
- Order data: billing/delivery address, items purchased, delivery instructions, communications about your order.
- Payment data: payment tokens/transaction references and limited payment metadata (payment card details are processed by PayPal/Stripe, not stored by us).
- Contact data: information you provide when emailing us or using website forms.
- Marketing/analytics data (if enabled): cookie identifiers and event data (only where you consent or where permitted by law).
4) How We Use Your Data and Our Lawful Bases
Under UK GDPR, we must have a lawful basis for processing your personal data. The lawful basis depends on the purpose, for example contract performance, legal obligation, legitimate interests, or consent.
| Purpose | Examples of data | Lawful basis (UK GDPR) |
|---|---|---|
| Provide the website and keep it secure | Server logs, IP address, device/browser details | Legitimate interests (security, fraud prevention, stability) |
| Process orders and deliver goods (UK-only shipping) | Name, address, order contents, contact details | Contract (to perform/enter into a contract) |
| Payments and fraud prevention | Transaction refs, order details, limited payment metadata | Contract; legitimate interests (fraud prevention); legal obligation (where applicable) |
| Customer support and communications | Email, messages, order number, support history | Contract / legitimate interests (responding efficiently) |
| Marketing (newsletter, remarketing, ads) – if enabled | Email (newsletter), cookie IDs, ad events | Consent (where required) and/or legitimate interests for limited direct marketing where permitted |
| Legal/accounting compliance | Invoices, payment records, VAT-related records | Legal obligation |
5) Cookies and Similar Technologies
We use cookies and similar technologies to operate the website, remember preferences, measure performance and (where enabled) support marketing. You can manage your cookie preferences via our cookie banner/settings tool and in your browser settings. If you disable cookies, some features may not work properly.
6) Contacting Us
If you contact us by email or via a contact form, we will use the information you provide to respond to your request. We may keep a record of communications for customer service and dispute resolution.
7) Accounts
If you create an account, we process the data required to set up and manage your account and to provide order history and checkout convenience. You can request account deletion by contacting us (subject to legal retention requirements).
8) Orders, Delivery and Service Providers
To fulfil your order, we share necessary data with service providers such as payment processors and delivery companies. We only share what is necessary for the service.
Payment processors
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)
- Stripe Payments Europe Ltd. (Ireland)
When you pay, your payment is processed by the selected provider under their own terms and privacy notices. We receive confirmation of payment and transaction references.
Delivery / logistics
We share your name and delivery address with carriers to deliver your goods. Where needed for delivery updates, we may share contact details (e.g., email/phone) according to your choices at checkout and/or the carrier’s requirements.
9) Analytics, Advertising and Tag Management (only if enabled)
If enabled on our site, we may use tools such as Google Analytics, Google Ads conversion tracking/remarketing and Google Tag Manager. These tools may set cookies or access device information. We run these tools only where you consent via our cookie settings, unless a legal exception applies.
- Google privacy: https://policies.google.com/privacy
- Partner sites/cookies info: https://policies.google.com/technologies/partner-sites
10) Fonts, reCAPTCHA and Similar Site Features (if used)
If we use external font libraries (e.g., Google Fonts / FontAwesome) or security services (e.g., Google reCAPTCHA), these providers may receive your IP address and browser/device information to deliver the feature and protect against spam/abuse. We enable these only as needed for site operation and security, and we apply consent where required.
11) International Data Transfers
Because we are established in Germany and use service providers in different countries, your personal data may be transferred outside the UK. Where UK GDPR requires safeguards for restricted transfers, we use appropriate mechanisms such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU SCCs, or other recognised safeguards, and we carry out transfer risk assessments where required.
12) Data Retention
We keep personal data only for as long as necessary for the purposes described above, including:
- Order and invoice records: retained as required for legal/tax/accounting obligations.
- Support communications: retained as needed to resolve queries and handle disputes.
- Marketing preferences: retained until you unsubscribe/withdraw consent (plus minimal suppression records to respect your choice).
- Cookie/analytics data: retained according to the settings of the relevant tools and your consent preferences.
13) Your Rights (UK GDPR)
You have rights over your personal data, including the right to:
- request access to your personal data;
- request correction of inaccurate data;
- request deletion (where applicable);
- restrict or object to certain processing (including objections to processing based on legitimate interests);
- data portability (in certain cases);
- withdraw consent at any time (where processing is based on consent);
- lodge a complaint with the UK supervisory authority.
14) Complaints (UK)
If you are unhappy with how we use your data, please contact us first so we can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/
15) Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version on this page with a revised “last updated” date.
Last updated: 18 February 2026