1. Overview
We take the protection of your personal data seriously and aim to process it in line with applicable data protection law, including the EU General Data Protection Regulation (GDPR). This policy explains what data we process when you use this website, place an order or contact us, why, and what rights you have.
We only process personal data that is necessary for the purposes described below, or where you have given consent.
2. Responsible entity (controller)
The controller responsible for data processing on this website is: GROG Spółka z ograniczoną odpowiedzialnością, Zabraniecka 8L, 03-872 Warszawa, Poland.
Contact: info@grogairless.com · +49 157 7089 1438. Full legal company details are listed in the Imprint.
3. Contact forms and inquiries
When you send us an inquiry through a contact or request form, or by phone, email or messaging, we process the information you provide. Depending on the form, this may include your name, email address, phone number, company name, country, a VAT ID (for business inquiries) and the content of your message.
We use this data to receive and respond to your inquiry and to provide the information or quote you request. Inquiry submissions are stored in our systems and a notification may be sent to our team through an email service provider so that we can reply.
To limit spam and abuse, your IP address is processed temporarily when a form is submitted; it is used for rate-limiting and is not stored with the inquiry.
The legal basis is the handling of your request and our legitimate interest in responding, and where applicable steps prior to entering into a contract.
4. Orders and checkout
When you place an order through our online checkout, we process the data needed to conclude and perform the purchase contract — typically your name, billing and delivery address, email address, phone number and the details of your order. For business customers, a VAT ID may also be processed.
This data is used to process your order, arrange payment and delivery, issue invoices and provide customer service. The legal basis is the performance of a contract with you (Art. 6(1)(b) GDPR) and, for invoicing and retention, our legal obligations (Art. 6(1)(c) GDPR).
You can also request a non-binding quote instead of ordering directly; such requests are handled as inquiries (see section 3).
5. Cookies and consent
When you first visit the site, a consent banner lets you choose which categories of cookies and similar technologies may be used. We distinguish between necessary/functional, analytics and marketing categories.
Strictly necessary cookies are required for the site to work. Non-essential cookies (analytics and marketing) are only set after you give consent. You can change or withdraw your consent at any time; your choice is stored on your device so the banner remembers it.
6. Analytics and tag management
We use Google Tag Manager, a tool by Google that manages website tags. Google Tag Manager only loads after you have consented to analytics cookies; until then it is blocked through a consent mechanism.
Depending on configuration, analytics or marketing tools can be loaded through the tag manager. These only run after you have given the corresponding consent. If no such tools are configured or you do not consent, they are not loaded.
7. Payment processing
When you pay for an order, the payment is handled by external payment service providers. Depending on the method you select at checkout, the data required to process the payment (such as your name, billing address, email address and payment details) is transmitted to and processed by the relevant provider. We do not store full card numbers; card data is entered directly within the payment provider’s secure environment.
Depending on the payment methods offered, the following providers may process your payment data:
- ›Stripe — card payments as well as Apple Pay and Google Pay (Stripe Payments Europe, Ltd., Ireland)
- ›PayPal — including PayPal and, where offered, Pay Later (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg)
- ›Klarna — invoice/instalment payments, where offered (Klarna Bank AB, Sweden)
- ›SEPA bank transfer — processed via our bank using the payment data you provide
Each provider processes payment data under its own responsibility and privacy policy and may carry out fraud-prevention and identity checks. The legal basis for processing payment data is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure payment processing and fraud prevention (Art. 6(1)(f) GDPR).
8. Shipping and logistics
To deliver your order, the delivery details necessary for shipping (such as recipient name, delivery address and, where needed, phone number or email for delivery notifications) are passed to the transport or logistics provider carrying out the delivery. The specific carrier is selected per order. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
9. VAT ID validation
If you provide a business VAT identification number (for example for an invoice request), it may be checked for validity against the European Commission’s VIES service (VAT Information Exchange System). For this check, the VAT ID is transmitted to the VIES service operated by the EU. The result may be cached to avoid repeated checks.
10. Embedded content (video)
Some product pages may embed videos using a privacy-enhanced player (YouTube “no-cookie” mode). When you actively play an embedded video, data may be transmitted to the video provider. Embedded content is only loaded when you interact with it as described.
11. Content management and hosting
This website is managed with a content management system. Order and inquiry data is stored in our database and is accessible only to authorised staff through protected administrative access.
The website and its database are hosted on the infrastructure of Railway Corporation (United States), our hosting provider, which processes data on our behalf as a processor under a data processing agreement; servers are operated in EU/EEA regions where available. The website is served over an encrypted connection (SSL/TLS).
12. Your rights
Subject to the conditions of applicable data protection law, you have the right to:
- ›access the personal data we hold about you
- ›request correction of inaccurate data
- ›request erasure of your data
- ›request restriction of processing
- ›object to certain processing
- ›data portability
- ›withdraw consent at any time, with effect for the future
- ›lodge a complaint with a data protection supervisory authority
13. Data retention
We keep personal data only for as long as necessary for the purposes described above, or as required to meet legal, accounting or contractual obligations. When data is no longer needed, it is deleted or anonymised.
14. Contact for privacy questions
For questions about this privacy policy or your data, contact us at info@grogairless.com or +49 157 7089 1438. Company details are listed in the Imprint.