European Privacy Rights (GDPR)

Who this applies to

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) gives you rights over your personal data, described below.

How we process your data

We process personal data only on the following lawful bases:

• Performance of a contract: to provide your account and the app's features you requested.
• Legitimate interests: to keep the service safe, prevent abuse, and improve it.
• Consent: for optional features where you are asked first. You can withdraw consent at any time.
• Legal obligations: where we are required to keep or disclose data by law.

Your rights

• Access: get a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your data (the "right to be forgotten"), subject to legal retention duties.
• Restriction: ask us to pause processing of your data while a dispute is resolved.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interests.
• Complain: lodge a complaint with your national data protection authority.

How to exercise your rights

You can manage much of your data directly in the app — edit stand details, remove photos, and delete your favorites at any time. For other requests, contact the GardenCart admin team through the app.

We may need to verify your identity. We will respond within one month, as required by law.

Data retention and transfers

We keep personal data only as long as necessary to provide the service and meet legal obligations. The service may be hosted and processed outside the EEA; where that happens, we apply appropriate safeguards as required by law.

Changes and contact

We may update this notice from time to time. If you have questions, contact the GardenCart admin team — send us a message through the contact form.