Privacy policy

Last updated: 6 October 2026

This policy explains how we use personal data when you visit gardisto.eu, shop with us or contact us. Personal data can identify you directly or indirectly; information that is fully anonymous is not personal data.

Who is responsible?

Gårdisto AB is the data controller for the processing described here, unless stated otherwise. Shopify provides our store platform.

Gårdisto AB
Company registration number: 559532-4806
VAT number: SE559532480601

Postal address:
Karlavägen 18, BV
114 31 Stockholm
Sweden

Email: support@gardisto.eu
Telephone: +46 8 558 020 80

What data do we collect?

The data depends on how you use our services:

Contact details: name, email, telephone number, shipping and billing addresses.
Purchases and payments: orders, purchase history, returns, payment method and transaction details.
Customer account: email, customer ID, account status, preferences and information needed for verification by one-time code.
Communications: support messages and email correspondence.
Reviews and content: ratings, review text, display name and information needed to verify a purchase, if you choose to leave a review.
Marketing preferences: subscription status, consent and how you interact with our marketing messages.
Device and usage: IP address, browser, device information, cookies and how you navigate the website.

Payment providers process payment details. We do not store complete card details. Shopify handles account authentication; we do not store a customer-account password.

Where does the data come from?

We receive data directly from you when you buy, contact us or create an account. We also receive data through cookies and similar technologies, payment providers, Shopify, and marketing and analytics tools.

Why do we use the data?

To fulfil a contract: process payment, deliver orders, administer returns and provide customer support. Legal basis: GDPR Article 6(1)(b).
To meet legal obligations: bookkeeping, consumer complaints and tax rules, including OSS. Legal basis: Article 6(1)(c).
For legitimate interests: prevent fraud, improve the website, analyse purchasing behaviour, administer and verify reviews, and protect our rights. Legal basis: Article 6(1)(f). This does not replace consent where consent is required.
With your consent: newsletters, email marketing and non-essential cookies. Legal basis: Article 6(1)(a). You can withdraw consent at any time.

Marketing and cookies

We send marketing if you have consented. You can unsubscribe using the link in our messages. We may still send service messages, such as order confirmations.

Necessary cookies support the cart, checkout, security and account functions. Optional cookies are used for traffic analysis, personalised content and relevant advertising, with your consent where required by law.

Accept or refuse optional cookies in the cookie banner.
Change or withdraw cookie consent using Your Privacy Choices in the website footer.
You can also delete cookies in your browser; you may then need to set your preferences again.

Who receives the data?

We share data when needed for the purposes described in this policy:

Shopify: to host and operate the store; see the next section.
Payment providers: to process payments.
Our logistics partner: to store, fulfil and deliver orders and handle returns.
IT and cloud providers: for hosting, analytics and operations.
Judge.me: to collect, verify and display reviews.
Google and Meta: for analytics or marketing as permitted by law and your consent choices.
Authorities: when required by law.

Shopify Network Intelligence

Shopify processes data when you visit or buy from our store. Shopify Network Intelligence is enabled. It combines information from your interactions with this store, other merchants and Shopify to provide enhanced services, including security, improvements and personalised advertising.

Data is shared with Shopify and other service providers, which may be in other countries. Shopify is an independent controller for this enhanced processing. Read Shopify's Consumer Privacy Policy.

Advertising based on your activity across merchants requires consent in the EEA, UK and Switzerland. Accepting our purchase terms is not consent to this advertising. You can refuse optional cookies or change your choices using the controls described above.

For rights relating to Shopify's processing, including withdrawing consent or objecting, use Shopify's privacy portal. For other privacy requests, email us. Withdrawing consent does not affect the lawfulness of earlier processing.

Transfers outside the EU/EEA

Data may be processed outside the EU/EEA. For such transfers, we use the European Commission's Standard Contractual Clauses or transfer data to a country recognised as providing an adequate level of protection.

How long do we keep data?

For as long as needed to fulfil the contract.
For the period required by bookkeeping law, usually seven years in Sweden.
For as long as needed in connection with legal claims.
For marketing, while your consent remains valid and the data is needed for that purpose. You can withdraw consent at any time.

Your rights and complaints

Subject to the applicable legal conditions, you can:

Request access to your data and correction of errors.
Request erasure or restriction of processing.
Object to processing and request data portability.
Withdraw consent.

Email support@gardisto.eu to make a request. We may need to verify your identity.

You can contact us if you believe data is being handled incorrectly. You may also complain to the Swedish Authority for Privacy Protection, IMY, or the corresponding authority in your country.

Security and children

We use technical and organisational measures to protect personal data. No internet transmission can be guaranteed completely secure.

The website is not intended for children. We do not knowingly collect children's personal data.

Changes to this policy

We may update this policy when needed. The latest version is published on our website.