Privacy Policy

1. About this policy

CampOne GmbH, trading as Grondia (“Grondia”, “we”, “us”, “our”), operates the website grondia.com. This policy explains how we process personal data where we decide why and how it is processed (as “controller”), in particular when you:

• visit grondia.com in any of its market and language versions;
• request a demo, contact us, or book a meeting with us on a trade fair page;
• receive marketing communications from us;
• take part in the Grondia camper referral programme;
• are a contact person at a campground that we contact, that is our customer, or that is onboarding with us;
• communicate with us by email, phone, video call or through our social media pages.

This policy does not cover:

• Guest data and campground websites. When a campground uses Grondia for its booking engine, its website, its check-in kiosk, its point of sale or its payments, the campground decides how guest data is used and is the controller. We process that data on the campground’s behalf and under its instructions. The campground’s own privacy notice applies. If you send us a request about such data, we forward it to the campground within 2 business days. We do not use these data for our own purposes (section 4.16).
• Campground staff using the Grondia platform. Their user accounts are processed on behalf of the campground that employs them. The campground’s notice applies.
• Job applicants. Our Applicant Privacy Notice applies.

“Personal data” in this policy also means “personal information” as used in US law.

2. Who is responsible and how to contact us

Controller:

CampOne GmbH
c/o Christoph Tonini
Habüelstrasse 112
8704 Herrliberg
Switzerland
UID: CHE-134.912.193

Privacy contact: hello@grondia.com

Persons in the European Union and the United Kingdom can contact us directly at the same address.

We have not appointed a data protection officer. Swiss law makes the appointment optional (Art. 10 revDSG).

3. Your right to object

You can object at any time to processing of your personal data that we base on our legitimate interests, on grounds relating to your particular situation (Art. 21(1) GDPR). You can object at any time, without giving reasons, to the use of your data for direct marketing, including profiling related to it (Art. 21(2) and (3) GDPR). Under Swiss law you can likewise object to processing (Art. 30(2)(b) revDSG). Write to hello@grondia.com or use the unsubscribe link in any marketing email. For cookies and similar technologies, use “Cookie settings” in the footer of any page.

4. What we process, why, on which legal basis and for how long

For each processing activity we list the data, the purpose, the legal basis under the GDPR and the UK GDPR, the recipients and the retention period.

Swiss law does not require a legal basis for each processing by a private controller. We process in line with the principles of Art. 6 revDSG. Where a processing would infringe your personality, we rely on the same grounds that this section states for the GDPR: your consent, the performance of a contract with you, our overriding private interests as described, or a legal obligation (Art. 31 revDSG).

Where we rely on legitimate interests (Art. 6(1)(f) GDPR), we name the interest in each section. Where we did not collect the data from you, section 4.11 says where it comes from.

4.1 Visiting the website

• Data: IP address, date and time of the request, requested page, referring page, browser and operating system (user agent), language settings, and the approximate location (country, sometimes region) that our hosting provider derives from the IP address.
• Purpose: to deliver the website, to show you the right market and language version, to apply the cookie consent rules that apply where you are, to keep the website and our forms secure, to detect and block abuse (for example repeated form submissions), and to fix errors.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, working website delivered in your language.
• Recipients: Vercel Inc. (hosting and content delivery network; servers worldwide, including the USA).
• Retention: data used to limit repeated form submissions (your IP address) is kept only in the working memory of our hosting provider’s servers and is not written to storage.

4.2 Cookies and similar technologies

We store a few necessary items on your device, for example your market and language, your cookie choice and, for as long as your browser tab is open, your country, so that the right consent rules apply. Analytics (Umami, Ahrefs Web Analytics and Google Analytics 4) runs only with your consent if you visit from the EU/EEA, the United Kingdom, the USA or Canada, or if we cannot determine your location; in Switzerland and other countries it runs unless you object. Advertising (Google Ads) runs only with your consent, in every country. Our Cookie Policy lists every cookie, its purpose and its duration, and explains how to change your choice. “Cookie settings” in the footer of every page lets you change your choice at any time.

4.3 Cookieless audience measurement (Umami and Ahrefs)

• Data: page address, referring page, browser type, operating system, device type, screen size, language and the country derived from your IP address. These tools do not set cookies. Umami does not store your IP address.
• Purpose: to count visits and understand, in aggregate, which pages are read and how visitors find us, including for search engine optimisation.
• When they run: both tools belong to the “Analytics” category of our cookie banner. If you visit from the EU/EEA, the United Kingdom, the USA or Canada, or if we cannot determine your location, they run only after you allow “Analytics”. Your location (the country that our hosting provider derives from your IP address) decides this, not the market version of the page; if the page you open belongs to a market where we ask for consent, we ask you wherever you are. In Switzerland and other countries they run unless you object in “Cookie settings”.
• Legal basis: where we ask for consent: your consent, Art. 6(1)(a) GDPR. Elsewhere: Art. 6(1)(f) GDPR; our legitimate interest is understanding, in aggregate and without profiles of individuals, how our website is used. You can object at any time in “Cookie settings”.
• Recipients: Umami is operated by Grondia itself (analytics.campone.ch). Ahrefs Pte. Ltd., Singapore, provides Ahrefs Web Analytics.
• Retention: Umami statistics are kept without time limit.

4.4 Google Analytics 4

• Data: an online identifier stored in a cookie, pages viewed, events (for example a submitted form, without its content), time spent, device and browser information, referring page and the approximate location that Google derives from your IP address.
• Purpose: statistics to improve the website.
• Legal basis: where we ask for consent (section 4.3 explains when): your consent, Art. 6(1)(a) GDPR, given in the cookie banner (storage on your device also needs consent under Art. 5(3) of Directive 2002/58/EC as implemented, for example § 25(1) TDDDG in Germany and regulation 6 PECR in the UK; we ask for consent in the UK even where Schedule A1 to PECR would allow statistics on an opt-out basis). In Switzerland and other countries: our overriding private interest, or our legitimate interest under Art. 6(1)(f) GDPR, in website statistics; you can object at any time in “Cookie settings”.
• Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor. Google LLC in the USA may access the data (see section 6).
• Retention: the cookies expire after 2 years.

4.5 Google Ads (advertising)

• Data: click identifiers that Google adds to the link of an advertisement (gclid, wbraid), campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the page the advertisement led to, conversion events and cookie identifiers.
• Purpose: to measure which advertisement led to a demo request, so that we stop paying for advertisements that do not work, and, because your consent covers it, to let Google show you relevant advertising (remarketing and personalisation).
• How it works: if you allow advertising, we store the click identifier and campaign parameters in a first-party cookie for 90 days and send them with a demo request or contact enquiry you submit. When we report conversions to Google Ads, we upload only the click identifier, the type of conversion and its time. We never upload your name, email address, phone number or message.
• Legal basis: your consent, Art. 6(1)(a) GDPR, in every market including Switzerland. If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising.
• Recipients: Google Ireland Limited and Google LLC. For ad personalisation Google also uses the data for its own purposes as a separate controller.
• Retention: cookies 90 days. Google keeps data under its own terms.

4.6 Demo requests

• Data: first name, last name, business email address, phone number, campground name, number of pitches, country, plan of interest, how you heard about us, a referral code if you have one, your language, and the website and market version you used. If you allowed advertising, also the campaign data in section 4.5.
• Purpose: to answer your request, find a time and hold the demo (by video call), send you the follow-ups that belong to your request, prepare an offer, and manage our sales pipeline.
• AI-assisted replies: a large language model writes a draft of our first reply from your name, campground, number of pitches, country, plan of interest and how you heard about us. The model is Claude, provided by Anthropic, or a model provided by OpenAI, both in the USA. Your email address, phone number, campaign data, referral code and the website version are not given to the model. A member of our team reviews and approves the first reply before it is sent. The confirmation you receive after you book a time is drafted by the model in the same way and sent without prior review. The model makes no decision about you.
• Legal basis: Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract. Art. 6(1)(f) GDPR for follow-ups and pipeline management; our legitimate interest is following up a business enquiry that you started. We send you marketing emails beyond your request only on the basis described in section 4.10.
• Recipients: Vercel (form transmission), Cloudflare, Inc. (network protection for our API), Infomaniak Network SA (storage in Switzerland), Anthropic or OpenAI (drafting), Google (calendar, video call and email), Resend (email delivery).
• Retention: if you become a customer, section 4.12 applies. Otherwise we keep the data only as long as we need it to handle your request and its follow-up (section 7). If you object, we keep only what is needed to respect your objection.

4.7 Contact form and emails to us

• Data: name, email address, subject, message and anything else you choose to tell us, plus the technical data of the email. If you allowed advertising, also the campaign data in section 4.5.
• Purpose: to answer your enquiry.
• Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering enquiries addressed to us.
• Recipients: Vercel (form transmission), Resend (delivery to our mailbox), Google (email hosting, Google Workspace).
• Retention: as long as we need it to answer your enquiry (section 7); longer where it leads to a sales contact (section 4.6) or belongs to a contract (section 4.12).

4.8 Meetings booked on trade fair pages

On the pages for trade fairs and at our stand, you can book a meeting at the stand or an online demo.

• Data: first name, last name, email address, phone number, campground, number of pitches, the software you currently use, your notes, the fair, the time slot and the team member.
• Purpose: to book the meeting, send you a confirmation with a calendar invitation and hold the meeting. The request is also recorded in our demo request process (section 4.6).
• Legal basis: Art. 6(1)(b) GDPR for booking and holding the meeting. Your consent given in the form, Art. 6(1)(a) GDPR, for contacting you by email or phone about the demo and any offer for the fair; you can withdraw it at any time.
• Recipients: Google (team calendars), Resend (confirmation email), Vercel, Infomaniak.
• Retention: as for demo requests (section 4.6).

4.9 Camper referral programme

This section applies if you sign up for the Grondia camper referral programme, in which campers hand Grondia cards to campgrounds.

• Data: email address, chosen handle, first name, country and language, the code of the participant who invited you (if any), login data (a password stored as a cryptographic hash, or a one-time login link), your profile (full name, phone number, postal address, bank details such as IBAN and account holder), verification status, the cards sent to you, the campgrounds you report (claims) and when, trips, rewards and payouts, our messages to you, and your IP address for abuse protection. A login cookie (grondia_camper, 90 days) keeps you signed in.
• Purpose: to run the programme: your account, sending card packs by post, verifying your email address (link) and phone number (SMS code), recording claims, deciding and paying rewards, preventing fraud and double payments, and keeping accounting records.
• Legal basis: Art. 6(1)(b) GDPR (your participation in the programme), Art. 6(1)(c) GDPR for accounting and tax obligations, Art. 6(1)(f) GDPR for fraud prevention; our legitimate interest is paying rewards only for genuine referrals.
• Recipients: Infomaniak (hosting in Switzerland), Vercel (transmission), Resend (emails), Twilio Inc., USA (SMS verification codes), printing and postal service providers (card packs), our bank (payouts).
• Retention: account and profile data until you close your account. Payout records and their supporting documents: 10 years (Art. 958f Swiss Code of Obligations). Claims: as long as a reward can still become due under the programme.

4.10 Marketing communications

• Customers: we may email customers information about our own similar products and services, with an easy way to opt out in every message, where the law allows this without separate consent.
• Prospects: we contact campground businesses by post and by phone on the basis of our legitimate interest in offering our software to businesses for which it is relevant (Art. 6(1)(f) GDPR, recital 47). We send marketing emails to prospects only with their prior consent where the law requires it, which is the case at least in Germany and Austria.
• You can object to any marketing at any time (section 3).

4.11 Prospect research and our customer relationship management (data we did not collect from you)

• Categories of data: business data of campgrounds and their contact persons: name of the campground and of its operator, names and roles of owners and managers, business email addresses, phone numbers, postal address, website, the booking software the campground uses, its size, the result of an automated check of its public booking pages (for example their accessibility), and our interactions with the campground (calls, letters, meetings, notes).
• Sources: publicly accessible sources (the campground’s own website, OpenStreetMap and camping directories) and campgrounds reported by participants in our camper referral programme.
• Purpose: to find campgrounds for which Grondia could be useful, to contact them, and to manage our sales relationships.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is direct marketing to businesses and building business relationships. We limit ourselves to business contact data in a professional role and offer an easy way to object.
• Recipients: HubSpot (customer relationship management), Infomaniak (our CRM database in Switzerland), printing and postal service providers (letters), Google (email and calendar).
• When we inform you: at the latest with our first contact, and in any case within one month of obtaining the data (Art. 14(3) GDPR), unless an exception in Art. 14(5) GDPR applies.
• Retention: as long as we need it for these purposes (section 7). If you object, we keep a minimal entry (name of the campground and the objection) so that we do not contact you again.

4.12 Customers, onboarding and business partners

• Data: names, roles and business contact details of contact persons; contract data (order form, terms, signatures); billing and payment data; communications and meeting notes; support requests; information needed to set up the services.
• Payment onboarding: if a campground uses Grondia Pay, we collect identification data of its owners, directors and authorised signatories (for example name, date of birth, nationality, address, identity document data and ownership share) and pass it to our payment partner, which verifies identities and screens against sanctions lists under its own legal obligations as a separate controller. The partner is named in the customer contract.
• References: where the customer contract allows it, we name the customer as a reference. We publish quotes, photos or videos of individuals only after the customer has approved them.
• Purpose: to prepare, perform and administer the contract, invoice, collect payments, keep accounting records, provide support and comply with legal obligations.
• Legal basis: Art. 6(1)(b) GDPR (contract); Art. 6(1)(c) GDPR (accounting, tax and, for payment onboarding, anti-money laundering obligations); Art. 6(1)(f) GDPR (communication with contact persons of business customers who are not themselves the contracting party; establishing and defending legal claims).
• Recipients: Infomaniak, Google, HubSpot, Linear, Resend, our payment partner, banks, accountants, auditors and legal advisers.
• Retention: accounting records, invoices and business correspondence relevant for accounting: 10 years (Art. 958f Swiss Code of Obligations). Other data: as long as we need it for these purposes (section 7).

4.13 Communication tools, video calls and social media

• We use Google Workspace for email, calendars and video calls (Google Meet).
• We have a company page on LinkedIn. When you visit it, LinkedIn Ireland Unlimited Company processes your data under its own privacy policy. For the page statistics that LinkedIn gives us, LinkedIn and we are joint controllers (Art. 26 GDPR); you can contact LinkedIn or us about this processing. Our website only links to LinkedIn and does not load LinkedIn plug-ins.

4.14 Support requests and status notifications

• Data: name, email address, campground, the content of your support request and any attachments, our replies, and ticket metadata (time, category, priority). Support requests can contain guest data from the campground’s systems; we process such guest data on the campground’s behalf (section 1).
• AI-assisted handling: a large language model (Claude, provided by Anthropic, USA) sorts incoming support requests and drafts our replies to them.
• Purpose: to answer support requests, fix problems and improve our help content.
• Legal basis: Art. 6(1)(b) GDPR for customers’ contact persons where the request concerns the customer contract; otherwise Art. 6(1)(f) GDPR, our legitimate interest in providing efficient support.
• Recipients: Infomaniak (storage), Anthropic (sorting and drafting), Resend and Google (email).
• Status page: if you subscribe to notifications on our status page (https://status.campone.ch), Better Stack processes your email address or phone number to send them. Legal basis: your request, Art. 6(1)(b) GDPR. You can unsubscribe in every notification.
• Retention: support requests as long as we need them for these purposes (section 7); status page subscriptions until you unsubscribe.

4.15 Security, legal obligations, claims and company transactions

• We process the data described above where necessary to protect our systems, to comply with legal obligations (Art. 6(1)(c) GDPR), to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR), and, if Grondia or parts of its business are sold or merged, to prepare and complete that transaction (Art. 6(1)(f) GDPR; our legitimate interest is the transfer of the business), subject to confidentiality.
• We disclose data to authorities and courts where the law requires it.

4.16 Anonymous statistics from the Grondia platform

If a campground opts in, we compute anonymous statistics from its booking and usage data on its behalf, as its processor, for product analytics and for benchmarks that combine at least 5 campgrounds; we keep only results from which no person can be identified.

5. Recipients

We share personal data only as described in section 4. Our service providers process data for the purposes described in this policy. Where this policy says that a recipient acts as a separate controller, that recipient decides itself how it uses the data.

We name further recipients on request. Where we act as processor for campgrounds on the Grondia platform, our sub-processors are listed on our sub-processor page.

6. International transfers

We are based in Switzerland. Our database and files are stored in Switzerland. Some recipients in section 5 process data in other countries, in particular the EU/EEA, the USA and Singapore.

• Switzerland, the EU/EEA and the UK recognise each other as providing an adequate level of data protection: the European Commission’s decision on Switzerland (Decision 2000/518/EC, reconfirmed in the Commission’s report of 15 January 2024), its decision on the UK (Implementing Decision (EU) 2021/1772, extended to 27 December 2031), and the Swiss Federal Council’s list of states in Annex 1 to the Data Protection Ordinance (DSV).
• USA: where the recipient is certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), the UK Extension to it or, for transfers from Switzerland, the Swiss-US Data Privacy Framework (listed in Annex 1 DSV since 15 September 2024), we rely on that certification. Otherwise, and as a fallback in case the framework is invalidated, we use the European Commission’s standard contractual clauses, with the amendments needed for Switzerland and the UK (UK International Data Transfer Addendum). This paragraph does not cover Anthropic (sections 4.6 and 4.14).
• In individual cases we may rely on an exception, for example where a transfer is necessary to perform a contract with you or at your request (Art. 49(1)(b) GDPR, Art. 17(1)(b) revDSG).

Content delivery and network protection providers (Vercel, Cloudflare) may answer a request from an edge server in the country closest to you, in which case data passes through that country; these providers are bound by standard contractual clauses for every country without an adequacy decision.

Under Art. 19(4) revDSG we name the countries: Switzerland, member states of the EU/EEA, the United Kingdom, the USA and Singapore, and, for edge delivery only, the countries where those providers operate edge servers. You can ask us for a copy of the safeguards at hello@grondia.com.

7. How long we keep data

We keep personal data only as long as needed for the purposes in section 4, or as long as the law requires.

When we no longer need the data, we delete it or anonymise it so that it no longer relates to you. Backups age out and are overwritten or deleted in their normal cycle within 90 days.

8. Your rights

Depending on the law that applies to you, you have the right to:

• access your personal data and receive information about its processing (Art. 15 GDPR, Art. 25 revDSG);
• rectification of inaccurate data (Art. 16 GDPR, Art. 32(1) revDSG);
• erasure (Art. 17 GDPR, Art. 32(2)(c) revDSG);
• restriction of processing (Art. 18 GDPR);
• data portability, that is, to receive data you gave us in a structured, commonly used and machine-readable format or to have it transmitted to another controller (Art. 20 GDPR, Art. 28 revDSG);
• object to processing (Art. 21 GDPR, Art. 30(2)(b) revDSG; see section 3);
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); withdrawal does not affect the lawfulness of processing before it;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (Art. 22 GDPR, Art. 21 revDSG; see section 10).

To exercise your rights, write to hello@grondia.com or to our address. We may ask you to confirm your identity. We answer within one month (Art. 12(3) GDPR) or, under Swiss law, normally within 30 days (Art. 25(7) revDSG), and tell you if we need longer where the law allows it.

You can always complain to us first at hello@grondia.com. You also have the right to lodge a complaint with a supervisory authority:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch;
• EU/EEA: the supervisory authority of the Member State where you live, work or where the alleged infringement took place (Art. 77 GDPR).

US residents: see section 14.

9. Do you have to provide your data?

You can visit our website without telling us who you are. To answer a demo request, an enquiry or a meeting request, we need the fields marked as required in the form; without them we cannot respond. To take part in the camper referral programme and receive rewards, you must provide the data the programme requires. Cookie consents are voluntary.

10. Automated decisions, profiling and AI

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Where we use AI to draft replies, sections 4.6 and 4.14 and our AI Transparency Notice explain how. If you allow advertising, Google may build a profile for ad personalisation (section 4.5). You can withdraw that consent at any time.

11. Security

We protect personal data with technical and organisational measures, including encrypted connections (TLS), role-based permissions in the product and storage of our main database in Switzerland. More on our Trust and Security page. No transmission over the internet is fully secure. If a breach of security is likely to result in a risk to you, we will inform the authorities and you where the law requires it.

12. Children

Our website and services are aimed at businesses. They are not directed at children. We do not knowingly collect personal data of children under 16.

13. Other notices on this website

• Cookie Policy: cookies and similar technologies, and how to change your choice.
• Legal notice: company details.
• Digital Services Act information: our points of contact under the EU Digital Services Act and how to report illegal content on websites we host for campgrounds.
• AI Transparency Notice: where we use AI.

14. Additional information for residents of the United States

14.1 California Online Privacy Protection Act (CalOPPA)

• Categories of personally identifiable information we collect through the website: identifiers and contact data (name, email address, phone number, postal address for camper programme participants), business information (campground, role), online identifiers and usage data (IP address, cookie identifiers, pages viewed), and bank details for camper programme payouts. Section 4 describes each.
• Categories of third parties with whom we share it: hosting, network and email providers, analytics and advertising providers (Google, Ahrefs), AI providers (Anthropic, OpenAI), customer relationship management and task tools (HubSpot, Linear), SMS and postal providers, our payment and banking partners, professional advisers, and authorities where the law requires it (section 5).
• Reviewing and correcting your information: write to hello@grondia.com. Camper programme participants can review and change their profile in the camper app.
• Changes to this policy: we post the new version on this page with a new date, and for material changes we also notify you by email or a notice on the website (section 15).
• Do Not Track: there is no common industry standard for “Do Not Track” browser signals, so we do not respond to them. We do respond to Global Privacy Control signals as described in section 14.2.
• Tracking by other parties over time and across websites: if you allow advertising, Google can collect information about your online activities over time and across different websites. Without your consent, no other party does so through our website.

14.2 California Consumer Privacy Act (CCPA, as amended by the CPRA)

This section applies once Grondia meets a threshold in Cal. Civ. Code § 1798.140(d), that is: annual gross revenue above USD 25,000,000 as adjusted under § 1798.199.95 (USD 26,625,000 since 1 January 2025 under the California Privacy Protection Agency’s adjustment); or buying, selling or sharing the personal information of 100,000 or more California consumers or households a year; or deriving 50% or more of annual revenue from selling or sharing personal information. We already honour Global Privacy Control signals and the rights below voluntarily.

Notice at collection and categories of personal information (last 12 months):

We keep each category for the periods in section 7.

Sale and sharing. We do not sell personal information for money. Allowing advertising in our cookie banner lets Google use your data for cross-context behavioural advertising, which the CCPA may treat as “sharing”. You can opt out at any time through “Cookie settings” in the footer, and we treat a Global Privacy Control signal from your browser as a valid request to opt out of sale and sharing. We do not knowingly sell or share personal information of consumers under 16.

Your rights. You have the right to know what personal information we collect, use, disclose, sell and share, and to access it (§ 1798.100, § 1798.110, § 1798.115); to delete it (§ 1798.105); to correct it (§ 1798.106); to opt out of its sale or sharing (§ 1798.120); to limit the use of sensitive personal information where applicable (§ 1798.121); and not to be discriminated against for exercising these rights (§ 1798.125).

How to exercise them. Email hello@grondia.com or write to the address in section 2. We confirm receipt within 10 business days and respond within 45 calendar days, which we may extend once by another 45 days with notice. We verify your identity by matching information you give us with information we hold. An authorised agent may act for you with your signed permission; we may ask you to confirm your identity directly.

14.3 Other US states

Residents of states with comprehensive privacy laws (for example Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia) may have similar rights to access, correct, delete and port their data and to opt out of targeted advertising, sale and certain profiling, once those laws apply to us. We honour these requests on the same terms as in section 14.2. If we decline a request, you can appeal by replying to our decision or by writing to hello@grondia.com with the subject “Appeal”. We answer an appeal within the period required by your state’s law. If you are not satisfied, you can contact your state’s Attorney General.

15. Changes to this policy

We update this policy when our processing or the law changes. The current version is always on this page with the date of its last update. If a change materially affects you, we tell you in advance by email (where we have your address) or by a notice on the website.