1. Controller
The controller of personal data is Housing OÜ, registry code 11712597, address Aavoja tee 7, Vikipalu, 74313 Harjumaa, Estonia. For privacy questions and data-subject requests, contact info@grovegz.com, telephone +372 53 568 834.
2. Data processed
Depending on the service used, we process names, contact details, delivery and billing addresses, order and return information, payment status, customer communications, account information, consent records and technical data such as IP addresses, device and browser information, security logs and cookie identifiers. Housing OÜ does not have access to full bank-account authentication or card details; these are processed by the payment service provider in its secure environment.
3. Purposes and legal bases
- Conclusion and performance of a contract: shopping basket, order, payment status, delivery, customer account, returns and customer support (Article 6(1)(b) GDPR).
- Legal obligations: accounting, taxation, consumer rights and the resolution of claims (Article 6(1)(c)).
- Legitimate interests: preventing fraud, attacks and misuse, ensuring service reliability and defending legal claims (Article 6(1)(f)). The impact and interests involved are balanced before such processing.
- Consent: optional analytics and marketing cookies and consent-based direct marketing (Article 6(1)(a)). Consent may be withdrawn at any time as easily as it was given.
4. Service providers and recipients of data
Where necessary, data may be processed by Zone Media as the web-hosting and email provider; WooCommerce/Automattic as the provider of the Online Store and Jetpack services; ESTO AS and PayPal as payment service providers; DPD, Omniva, SmartPosti/Itella and Venipak as carriers; Smaily as the newsletter and customer-communication service; Google (Analytics, Ads and Merchant/Listing services) and Meta (Meta Pixel) only with the relevant consent; and accounting, IT and legal advisers subject to contractual confidentiality obligations.
Only the data necessary to fulfil the purpose is disclosed to a service provider. Terms complying with Article 28 GDPR are used with processors.
5. International transfers
When Google, Meta, Automattic or PayPal is used, data may be processed outside the European Economic Area. In such cases, we rely on an applicable adequacy decision, EU Standard Contractual Clauses or another safeguard permitted under Chapter V GDPR. Information about the safeguards is available from info@grovegz.com.
6. Retention periods
- order, contract and complaint data: generally for up to 3 years after the end of the contract, or until the claim becomes time-barred in the event of a dispute;
- source accounting documents: 7 years due to a statutory obligation;
- customer account: while the account is in use and for up to 2 years after the last activity, unless longer retention is required in connection with a claim;
- customer communications and applications for withdrawal: generally for up to 3 years;
- security and error logs: normally for up to 90 days, except where an incident requires investigation;
- marketing consent: until withdrawal, with proof of consent retained at least until the claim becomes time-barred;
- analytics and advertising identifiers: according to the cookie settings, but no longer than 24 months in our configuration.
7. Cookies and similar technologies
Necessary cookies enable the shopping basket, login, security and storage of consent choices and are used to provide the service. Analytics (for example, Google Analytics and Jetpack Stats) and marketing (Google Ads and Meta Pixel) are disabled by default and activated only after the relevant consent has been given. Consent can be changed at any time using the “Cookie settings” button in the footer.
Browser or cookie blocking may affect the operation of the shopping basket and login. When consent is withdrawn, we stop further optional processing; data already collected by service providers is deleted in accordance with their rules and applicable law.
8. Data-subject rights
You have the right to obtain information about and a copy of your data, request rectification or erasure, restrict processing, object to processing based on legitimate interests, receive the data you provided in a machine-readable format and withdraw consent. We generally respond to a request within one month. To protect your identity, we may request necessary additional information.
If you believe that data is being processed unlawfully, you may lodge a complaint with the Estonian Data Protection Inspectorate.
9. Security and changes
We apply access restrictions, encrypted connections, backups, logging and other technical and organisational measures. This Privacy Policy is updated when processing activities or legislation change; any material change will be clearly announced on the website.
Last updated: 1 September 2026.