Grenae
Privacy Policy
At Grenae, we believe that everything around you should be considered — including how your personal information is handled. This Privacy Policy explains clearly and honestly what data we collect when you visit grenae.com, why we collect it, how we use it, and what rights you have over it.
We are committed to protecting your privacy and complying fully with the General Data Protection Regulation (GDPR) and all applicable Austrian and European data protection law.
Please read this policy carefully. If you have any questions, we are always glad to hear from you at the contact details below.
1. Who We Are
Grenae is a luxury Austrian Alpine spring water brand. For the purposes of data protection law, the data controller is:
Name: Nina Green, trading as Grenae
Address: Austria
Email: [email protected]
Website: www.grenae.com
As data controller, we are responsible for deciding how and why your personal data is processed. If you have any questions about this policy or about how we handle your data, please contact us at the email address above.
2. What Personal Data We Collect
We collect personal data in the following circumstances:
2.1 The Founding Circle Sign-Up
When you join the Grenae founding circle, we collect:
— Your first name
— Your email address
This data is provided voluntarily by you. You are under no obligation to provide it.
2.2 Contact Form Submissions
When you use our contact form, we collect:
— Your name
— Your email address
— The content of your message
2.3 Website Usage Data
When you visit grenae.com, certain technical data is collected automatically by our website platform (Squarespace) and our content delivery network (Cloudflare). This may include:
— Your IP address
— Browser type and version
— Device type
— Pages visited and time spent on each page
— Referring website
This data is collected in aggregate and is used to understand how the website is used. It is not used to identify you personally.
2.4 Cookies
Our website uses cookies. Please see Section 7 of this policy for full details.
3. How We Use Your Personal Data
We use your personal data only for the purposes for which it was collected:
Founding circle email address: To send you one notification when Grenae products become available for purchase. We will not send you marketing emails, newsletters, or any other communications without your explicit consent. You may withdraw from the founding circle at any time by emailing us at [email protected].
Contact form data: To respond to your enquiry. Your message and contact details are used solely for this purpose and are not added to any marketing list.
Website usage data: To understand how our website is used, to improve its performance and content, and to ensure its security.
4. Legal Basis for Processing
Under GDPR, we must have a lawful basis for processing your personal data. Our legal bases are:
Consent — Article 6(1)(a): We rely on your consent for processing your email address for the founding circle. You provide this consent by actively submitting your details and agreeing to receive a notification from Grenae. You may withdraw this consent at any time.
Legitimate interests — Article 6(1)(f): We rely on legitimate interests for processing website usage data for the purpose of maintaining and improving the security and performance of our website. We have assessed that these interests are not overridden by your rights and freedoms.
Contract performance — Article 6(1)(b): In future, when Grenae products are available for purchase, we will process the personal data necessary to fulfil orders and manage customer relationships. This will be covered by an updated version of this policy at that time.
5. How Long We Keep Your Data
We do not keep your personal data for longer than is necessary for the purposes for which it was collected.
Founding circle data: We retain your name and email address until Grenae products launch and you have been notified, or until you request removal from the founding circle, whichever comes first. Following the launch notification, your data will be deleted within 30 days unless you have made a purchase or explicitly consented to further communications.
Contact form data: We retain the content of contact form submissions for as long as necessary to respond to and resolve your enquiry, and for a period of up to 12 months thereafter in case of any follow-up.
Website usage data: Retained in accordance with the data retention policies of Squarespace and Cloudflare. Please refer to their respective privacy policies for details.
6. Who We Share Your Data With
We do not sell, rent, or trade your personal data. We share it only with the following trusted third-party service providers who help us operate our website and communications:
Squarespace Inc.: Our website is hosted and built on the Squarespace platform. Squarespace processes data on our behalf as a data processor. Squarespace is certified under the EU-US Data Privacy Framework. For more information, see squarespace.com/privacy.
Cloudflare Inc.: We use Cloudflare to provide security and performance services for our website. Cloudflare may process certain technical data. Cloudflare is certified under the EU-US Data Privacy Framework. For more information, see cloudflare.com/privacypolicy.
Mailchimp (Intuit Inc.): If you have joined the founding circle, your email address may be stored in Mailchimp, our email service provider. Mailchimp is certified under the EU-US Data Privacy Framework. For more information, see mailchimp.com/legal/privacy.
All third parties are required to process your data only in accordance with our instructions and applicable data protection law.
We do not transfer your personal data to countries outside the European Economic Area (EEA) except where appropriate safeguards are in place, such as the EU-US Data Privacy Framework certifications noted above.
7. Cookies
Cookies are small text files placed on your device when you visit a website. They help websites function correctly and provide information about how the site is used.
7.1 Cookies We Use
Strictly necessary cookies: These are essential for the website to function. They cannot be disabled. They include cookies set by Squarespace to maintain your session and ensure the site operates correctly.
Analytics cookies: Squarespace may set cookies to collect anonymised information about how visitors use the website. This helps us understand which pages are most useful and how we can improve the experience.
Cloudflare cookies: Cloudflare sets cookies for security purposes, to distinguish between human visitors and automated bots.
7.2 Managing Cookies
When you first visit grenae.com, you will be presented with a cookie consent banner. You may accept or decline non-essential cookies at that point.
You can also control cookies through your browser settings. Most browsers allow you to refuse cookies or delete cookies that have already been set. Please note that disabling cookies may affect the functionality of the website.
For more information about cookies and how to manage them, visit allaboutcookies.org.
8. Your Rights Under GDPR
Under GDPR, you have the following rights in relation to your personal data:
Right of access: You have the right to request a copy of the personal data we hold about you.
Right to rectification: You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.
Right to erasure: You have the right to ask us to delete your personal data in certain circumstances — for example, if the data is no longer necessary for the purpose it was collected, or if you withdraw your consent.
Right to restriction: You have the right to ask us to restrict the processing of your personal data in certain circumstances.
Right to data portability: Where processing is based on your consent or a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to object: You have the right to object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.
There is no charge for exercising your rights unless your request is manifestly unfounded or excessive.
9. Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Austrian supervisory authority:
Österreichische Datenschutzbehörde:
Barichgasse 40-42
1030 Wien, Austria
+43 1 52 152-0
We would, however, appreciate the opportunity to address your concerns directly before you contact the supervisory authority. Please reach out to us first at [email protected].
10. Changes to This Policy
We may update this Privacy Policy from time to time — for example, when we add new products or services, when the law changes, or when our data practices change. When we make significant changes, we will update the date at the top of this policy.
We encourage you to review this policy periodically. Continued use of grenae.com after any changes constitutes acceptance of the updated policy.
GRENAE — grenae.com — [email protected]
Celebrate with clarity.