Privacy policy

Last updated: 30 September 2026

This Privacy Policy describes how Gårdisto AB, company registration no. 559532-4806, VAT registration no. SE559532480601, Stockholmsvägen 164E, 187 32 Täby, Sweden (“Gårdisto”, “we”, “us”, “our”), collects, uses and shares your personal data when you visit or shop at https://gardisto.eu (the “Website”) or otherwise interact with us.

Gårdisto AB is the data controller for the processing of your personal data under this policy, unless otherwise stated.

The Website is provided through Shopify, which processes personal data to enable and improve the services.

1. What is personal data?

Personal data is information that can identify you directly or indirectly as an individual.

It does not include anonymised information that cannot be linked to you.

2. Personal data we collect

Depending on how you use our services, we may collect the following categories of personal data:

Contact details

• Name
• Shipping address
• Billing address
• Telephone number
• Email address

Payment information

• Payment method
• Transaction details
  (Payment details are processed through our payment providers. We do not store complete card details.)

Account information

• Email address, customer ID and account status
• Preferences and information needed for verification using a one-time code

Shopify handles account authentication. Gårdisto does not store a customer-account password.

Transaction information

• Purchase history
• Returns
• Order details

Communications data

• Messages sent to customer support
• Email correspondence

Device and usage information

• IP address
• Browser type
• Device information
• Cookies and similar technologies
• How you navigate the Website

3. How we collect personal data

We collect personal data:

• Directly from you (when you make a purchase, contact us or create an account)
• Automatically through cookies and similar technologies
• From payment providers
• From Shopify
• From marketing and analytics tools

4. Why we process your personal data (legal basis)

We process your personal data on the following legal bases under the GDPR:

Contract (Article 6(1)(b) GDPR)

To:

• Process and deliver your order
• Handle payment
• Administer returns
• Provide customer support

Legal obligation (Article 6(1)(c) GDPR)

To:

• Comply with bookkeeping requirements
• Handle consumer complaints
• Comply with tax rules (including the OSS scheme)

Legitimate interests (Article 6(1)(f) GDPR)

To:

• Prevent fraud
• Improve our Website
• Analyse purchasing behaviour
• Protect our rights

Consent (Article 6(1)(a) GDPR)

For:

• Newsletters
• Email marketing
• Cookies that are not strictly necessary

You may withdraw your consent at any time.

5. Marketing

We may send you marketing communications if you have consented to receive them.

You may unsubscribe at any time using the link in our communications.

We may still send service-related communications, such as order confirmations.

6. Cookies

We use cookies to:

• Enable the Website to function
• Analyse traffic
• Personalise content
• Display relevant advertisements

You can accept or refuse non-essential cookies in our cookie banner. Necessary cookies support the cart, checkout, security and account functions. Optional analytics and advertising cookies require your consent where required by law. To withdraw consent later, use Shopify’s privacy portal for Shopify’s processing or contact support@gardisto.eu. You can also delete cookies in your browser; some preferences may then need to be set again.

7. How we share personal data

We share personal data only when necessary:

Shopify and Shopify Network Intelligence

Shopify hosts our store and processes personal data when you visit or make a purchase. With Shopify Network Intelligence enabled, Shopify also uses information from your interactions with this store, other merchants and Shopify to provide enhanced services, including security, improvements and personalised advertising. Your information is shared with Shopify and other service providers, which may be located in other countries.

Shopify is an independent controller for this enhanced processing. Its Consumer Privacy Policy explains how it uses your information. You can use Shopify’s privacy portal to exercise applicable rights, including withdrawing consent or objecting to this processing.

Advertising based on activity across this store, other merchants and Shopify requires your consent in the EEA, UK and Switzerland. You can refuse optional cookies in the cookie banner. To withdraw consent later, use Shopify’s privacy portal for Shopify’s processing or contact support@gardisto.eu. Withdrawing consent does not affect the lawfulness of processing before withdrawal. Accepting our purchase terms is not consent to this advertising.

Payment providers

To process payments.

Logistics partner (3PL)

To store, fulfil, deliver and handle returns for orders.

IT and cloud service providers

For hosting, analytics and operations.

Authorities

Where required by law.

Reviews, analytics and marketing

We use service providers including Judge.me to collect, verify and display reviews, and Google and Meta for analytics or marketing only to the extent permitted by applicable law and your consent choices.

8. International transfers

Your personal data may be processed outside the EU/EEA.

For such transfers, we use:

• The European Commission’s Standard Contractual Clauses
• Or transfers to a country that provides an adequate level of protection

9. Retention periods

We retain personal data:

• For as long as necessary to perform the contract
• As required under bookkeeping legislation (usually 7 years in Sweden)
• For as long as necessary in connection with legal claims

Marketing data is retained until you withdraw your consent.

10. Your rights

If you reside in the EU/EEA or the United Kingdom, you have the right to:

• Request access to your personal data
• Request correction
• Request erasure
• Request restriction of processing
• Object to processing
• Request data portability
• Withdraw consent

To exercise your rights, contact:
support@gardisto.eu

We may need to verify your identity before processing your request.

11. Complaints

If you believe that we are processing your personal data incorrectly, you may contact us.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) in Sweden or the corresponding supervisory authority in your country.

12. Children

The Website is not intended for children. We do not knowingly collect personal data from children.

13. Security

We use technical and organisational security measures to protect your personal data.

However, no transmission over the internet can be guaranteed to be completely secure.

14. Changes

We may update this policy when necessary. The latest version is always published on the Website.

15. Contact

Gårdisto AB
Company registration no.: 559532-4806
VAT registration no.: SE559532480601
Stockholmsvägen 164E
187 32 Täby
Sweden

Email: support@gardisto.eu

Telephone: +46 70 713 53 38