1. Overview & principles

We respect your privacy. This Policy explains how we collect, use, store, and share personal data and your rights under the EU General Data Protection Regulation (GDPR) and Irish law.

2. Personal data we collect 

• Identity & contact: name, postal address, email, telephone.
• Order & payment: billing address, order history, payment transaction identifiers (payment card details are processed by our secure payment processor and are not stored by us).
• Communications: messages you send to us, including customer service enquiries.
• Cookies & analytics: see Cookies & analytics below.

3. Purposes & lawful bases

• To fulfil contracts: process orders, dispatch certificates, and provide the Service (lawful basis: performance of a contract).
• Legal obligations: record-keeping for tax and accounting (legal obligation).
• Marketing & updates: where you opt in, we may send newsletters and offers (consent). You can withdraw consent at any time.
• Legitimate interests: preventing fraud, improving our website, and communicating important administrative messages (we ensure these do not override your rights).

4. Sharing data

• Third-party service providers (payment processors, delivery companies, IT and hosting providers) – only as needed and under contractual obligations to protect your data.
• Where required by law (e.g., court orders, legitimate authority requests) we will share data.
• We will not sell your personal data.

5. International transfers

Some third-party processors may be located outside the EEA. We ensure appropriate safeguards (standard contractual clauses or adequacy decisions) before any data transfer.

6. Retention

We retain order and transactional data for as long as required by law (usually 6–7 years for tax) and for legitimate business purposes. Marketing consents are retained until withdrawn.

7. Your rights

You have rights under GDPR including the right to: access, rectify, erase (in certain circumstances), restrict processing, object to processing, data portability, and to withdraw consent. To exercise your rights contact hello@grownforest.ie You also have the right to lodge a complaint with the Irish Data Protection Commission: https://www.dataprotection.ie/.

8. Security

We use appropriate technical and organisational measures to safeguard personal data. However, no internet transmission is 100% secure; we cannot guarantee absolute security.

9. Cookies & analytics

Cookies are small files stored on your device. When you first visit, our cookie banner lets you accept, reject or choose which types we can use. Only strictly necessary cookies are set without your consent. You can change your choice at any time using the cookie settings button here, or by clearing cookies in your browser.

• Strictly necessary: keep your basket and checkout working (WooCommerce: woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*, up to 2 days), remember your cookie choice (Complianz: cmplz_*, 1 year), and help our payment provider Stripe prevent card fraud (__stripe_mid, 1 year; __stripe_sid, 30 minutes).
• Statistics (only with your consent): Google Analytics 4 helps us understand how visitors use the site, such as pages viewed, add to basket and completed orders (_ga and _ga_1FH8GSKY66, up to 2 years). If you do not consent, Google receives only basic, cookieless signals that do not identify you or your device.
• Order attribution: WooCommerce records how you arrived at the site (for example a search engine or social link) so we can see which channels lead to orders (sbjs_*, for the length of your visit).
• Marketing: we do not currently use advertising or marketing cookies. If that changes, they will only be set with your consent and will be listed here.

Google Analytics is provided by Google Ireland Limited. See Google’s privacy policy for how Google handles data.

10. Contact & updates

Questions about this Policy: contact hello@grownforest.ie 

We may update this Policy; the effective date will be posted above.