Privacy Policy

Who is responsible for your data? G&CO. Ltd, the company behind GRECH & CO., registered in Malta (C96486). Write to us at info@grechandco.com about anything on this page.

What do we collect? What you give us when you order, create an account, sign up or write to us: your name, email, delivery and billing address, phone number if you add one, what you buy, and your messages. Payments are taken by our payment providers, and we never see or store your full card number. When you allow it, cookies and similar tools also tell us how the site is used.

Why do we use it? To take and deliver your order, handle returns and questions, keep the records tax and accounting law asks of us, and protect the shop against fraud. We send you our newsletter and offers only if you've said yes, and you can unsubscribe from any email with one click. Order, shipping and return emails still reach you, because they're part of your order.

Who helps us? A small number of services do this work with us, each only for its part: Shopify and Shop run our shop and checkout; our payment providers take payment; our warehouses in Slovakia and the United States and their systems pack and ship; carriers deliver; Klaviyo and Privy send our emails and run our sign-up forms; Loox collects reviews; Swym keeps your wishlist; UpCart runs the cart; SparkLayer runs our wholesale portal; ShopMy tracks links from the creators we work with; Instafeed shows our Instagram feed; TaxJar works out US sales tax; Fillout runs our returns form; Enzuzo runs our cookie banner; Metorik helps us report on orders; and analytics and advertising tools from Google, Microsoft (Clarity and Advertising), Hotjar, Meta and Pinterest show us how the site and our ads perform.

Does it leave Europe? Some of these services are based in the United States or other countries outside the EU, so your data may be handled there. When it is, it's covered by the safeguards the law requires: a European Commission adequacy decision, such as the EU-US Data Privacy Framework for companies certified under it, or the Commission's Standard Contractual Clauses.

What legal grounds do we use? To take, deliver and return your order and answer your questions: because we need it to carry out our contract with you. To keep tax and accounting records: because the law requires it. To protect the shop against fraud and misuse: our legitimate interest in a safe shop. To send our newsletter and offers, and to run analytics and advertising cookies where consent is required: your consent, which you can withdraw at any time.

How long do we keep it? Orders, invoices and returns: for as long as tax and accounting law requires us to keep them. Messages to us: as long as we need them to answer you and to deal with any claim that could follow. Your account: until you close it. Newsletter: until you unsubscribe; after that we keep only your email address on a do-not-email list, so we never write to you again. Cookies: for the time each one sets, shown in "Manage Cookies".

What about children? We make things for children, and our shop is for the grown-ups who choose for them. We don't knowingly collect personal data from children.

What are your rights? You can ask to see the data we hold about you, correct it, delete it, take a copy with you, or object to how we use it, and you can withdraw your consent to marketing at any time. Email info@grechandco.com and we answer within one month. If you're not happy with our answer, you can complain to the Information and Data Protection Commissioner in Malta, or to the data protection authority where you live.

How do cookies work here? Essential cookies keep the shop and your cart working. Where the law asks for your consent first, as in the EU and the UK, analytics and advertising cookies run only after you allow them in our cookie banner. Wherever you are, you can change your choice at any time from "Manage Cookies".