Privacy
Who looks after your data
The controller is Nina Smole. For privacy questions and to exercise your rights, email [email protected].
What we collect and why
When you sign up, we collect your email address, language, and the time of sign-up and confirmation. The email provider also records your IP address as proof of consent. We use this information for a launch notification and occasional Gard9 news. The legal basis is your consent (GDPR Article 6(1)(a)).
Signing up is optional. Without your email address, we cannot send you these messages. We use double opt-in: after signing up, you receive an email with a confirmation link. You join the active list after confirming.
Who processes the data
MailerLite is our processor for collecting sign-ups and sending email.
The website runs on a DigitalOcean server in Frankfurt, Germany. Traffic passes through Cloudflare for network and security services. Both providers keep technical logs, including IP addresses, to operate and secure the site. Where either provider processes data outside the EU, it uses the safeguards GDPR requires, such as EU standard contractual clauses.
How long we keep it
We keep your data until you unsubscribe or withdraw consent. Unconfirmed sign-ups are deleted after 30 days. If the project stops, we delete the list.
Your rights
You can request access, rectification or erasure, restriction of processing and portability where applicable. Withdraw consent at any time using the one-click unsubscribe link in each message or by emailing [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal.
You may complain to the Slovenian data protection authority, Informacijski pooblaščenec: www.ip-rs.si. We do not use automated decision-making or profiling.
Analytics
We use Google Analytics 4, provided in the European Economic Area by Google Ireland Limited, only with your consent (GDPR Article 6(1)(a)) to understand how this website is used. Before consent, we send no analytics requests to Google and set no analytics cookies.
Google receives pages viewed, the referrer, device and browser information, approximate location derived from the IP address, and a successful sign-up event without the email address. Google signals and advertising personalisation are off.
The _ga and _ga_<ID> cookies are kept for up to 180 days. Event data in Google Analytics is retained for 2 months. Google may process data in the United States, relying on the EU-U.S. Data Privacy Framework and standard contractual clauses.
You can withdraw consent at any time through “Cookie settings” in the footer and choosing “Reject”. This stops analytics and deletes the Google Analytics cookies. Withdrawal does not affect the lawfulness of earlier processing.
With analytics consent, planting and harvest events send only the plant type’s fixed identifier. Plant names, plot layouts and basket contents are never included.
Your browser
We set no cookies without consent. Your browser’s local storage keeps your cookie choice (gard9.consent). The cookie choice is valid for 180 days; we then ask again.
Your garden (plants, names and basket) is kept only in this browser’s local storage (gard9.garden). It is never sent to us or anyone else. You can delete it with “Start over” in the garden or by clearing site data.