Privacy Policy

Last updated: 10 July 2026 · Effective from: 10 July 2026

This policy describes how the Gardlio platform processes personal data of users of the website and mobile apps (the "service"). Gardlio is an online marketplace (an intermediary) connecting customers with gardeners; the contract for the gardening work itself is concluded directly between the customer and the gardener.

1. Data controller

The controller of your personal data is DigiatPPSolutions s.r.o., seat Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, company ID (IČO) 23623632, registered in the Commercial Register kept by the Regional Court in Brno, file C 146691, represented by managing director Petr Procházka ("Gardlio").

• General contact: info@gardlio.eu
• Data-protection contact: info@gardlio.eu
• Web: https://www.gardlio.cz (the service is also available at gardlio.sk and gardlio.eu)
• Phone: we do not list a phone number; please contact us by email.

As a microenterprise, Gardlio is not required to appoint a data protection officer and has not appointed one; the data-protection contact is info@gardlio.eu.

2. Who this policy covers

We process personal data of three groups, described separately below:

• Gardeners (self-employed service providers who list on Gardlio)
• Customers (people who look for and book gardening work)
• Visitors (anyone browsing the site or app without an account)

3. What we process, why, and on what legal basis

Gardeners

Customers

Visitors

4. Where your data comes from

From you, from your use of the service, from our billing provider (Stripe) for the outcome of a subscription or boost payment, and from the other party to a booking (e.g. a review about a gardener). We do not receive payment or KYC data about the gardening job itself, because the customer pays the gardener directly and Gardlio does not handle that money.

5. Recipients and processors

We share data only as needed with: Supabase (hosting, database, auth, storage — region EU, Frankfurt / eu-central-1), Stripe (billing for Gardlio's own paid services — customer subscriptions and gardener visibility boosts; not the gardening job, which the customer pays the gardener directly), Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS) for push notifications, no analytics or marketing providers at launch, and authorities where legally required or where disclosure is necessary to establish, exercise, or defend legal claims. Processors act under data-processing agreements.

6. International transfers

We host in the EU/EEA where possible. Where a processor transfers data outside the EEA (e.g. Stripe), it is protected by Standard Contractual Clauses or an adequacy decision. Stripe may process data outside the EEA under Standard Contractual Clauses; see stripe.com/privacy.

7. Retention

We keep data for as long as your account is active and thereafter only as required. Specifically: account data for the life of the account; accounting and tax documents for the statutory period (up to 10 years under Czech law); and dispute records until the dispute is resolved. Consent-based cookies expire within 13 months.

8. Your rights

You have the right to access, rectify, erase, restrict, port, and object, and to withdraw consent at any time (without affecting prior processing). To exercise them, contact info@gardlio.eu. You may also complain to your supervisory authority (see annex).

9. Automated decisions

Gardlio makes no decisions producing legal or similarly significant effects solely by automated means. Search ranking and fraud checks are automated, but they are not by themselves determinative and are subject to human review.

10. Security

We use appropriate technical and organisational measures (encryption in transit, access controls, RLS on the database, least-privilege). No system is perfectly secure. If a personal-data breach occurs, we will notify the supervisory authority as required by Art. 33 GDPR and, where required, the affected data subjects under Art. 34 GDPR.

Country-specific annex — national data-protection overlay & supervisory authority