Privacy policy

Garden of Chow is a food gift box store run from Amsterdam, the Netherlands. We curate gift boxes of snacks, hot sauces, and candy, and we link out to single products sold on Amazon. This policy explains what personal data we collect, why, and what rights you have over it.

If you have questions about any of this, email us at hello@gardenofchow.com.

Account data. When you create an account we store your name, your email address, and a hash of your password. We never store the password itself, only a one-way hash. You can optionally save a phone number and a default shipping address.

Business data. If you buy on behalf of a company, you can save a company name and VAT number so we can put them on your invoices.

Order data. When you place an order we store the items, your shipping details, any gift note you write, and the order total.

Job applications. If you apply for a role, we store everything in your application, including your CV.

Technical data. Like most websites, we log technical details such as your IP address, browser, device type, and the pages you visit.

We use your account details to log you in and to prefill checkout. We use your order details to fulfil your order and keep records. We use your email address to send transactional messages such as login codes and order notifications, and, if you have opted in, our newsletter.

We use technical logs to keep the site secure, detect abuse, and understand which products people actually care about. We use your business details only to produce invoices.

We process your data on the following legal bases under the GDPR:

Contract. We need your account and order details to perform our contract with you, such as fulfilling an order or letting you log in.

Legitimate interest. We use technical logs to secure the site and prevent fraud, which is a legitimate interest that does not override your rights.

Consent. Where we rely on consent, such as the newsletter, you can withdraw it at any time.

Legal obligation. We keep order records where the law requires it, for example for tax purposes.

We use a small number of cookies. Essential cookies keep you logged in, remember your cart, and remember your currency preference. These are necessary for the site to work and do not require consent.

We may use simple analytics cookies to understand how people use the site. We keep these to a minimum and you can clear them from your browser at any time.

Amazon. Single products are sold through Amazon. When you click through and buy on Amazon, that purchase is governed by Amazon's own privacy policy, not ours.

Stripe. When checkout is live, payments are processed by Stripe. Stripe receives the payment details necessary to process your transaction.

Cloudflare. Our site runs on Cloudflare. Cloudflare provides hosting, security, and our email sending, and processes some technical data on our behalf.

We do not sell or rent your personal data to anyone.

We keep your account until you delete it. Login codes expire after ten minutes. Order records are kept as long as legally required for accounting and tax purposes. Job applications are kept for up to one year, then deleted unless you ask us sooner.

You can delete your account at any time from your account page, which removes your profile, sessions, and order history.

Under the GDPR you have the right to access the data we hold about you, correct it, delete it, restrict how we process it, and receive a copy of it in a portable format. You also have the right to object to processing and to withdraw consent at any time.

To exercise any of these rights, email us at hello@gardenofchow.com. We aim to respond within 30 days. If you are not satisfied, you have the right to lodge a complaint with your local data protection authority.

We store passwords as salted one-way hashes, so a breach of our database does not reveal your password. The site is served over HTTPS, and access to our systems is restricted to people who need it to run the store.

No method of transmission or storage is completely secure. If you believe your account has been compromised, change your password and contact us.

Our hosting runs through Cloudflare, which may process data in servers outside the European Economic Area. Where data is transferred outside the EEA, we rely on the safeguards Cloudflare provides, such as standard contractual clauses.

Our store is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy from time to time. If we make material changes, we will note the updated date here. Your continued use of the site after changes take effect means you accept the updated policy.