Personal Data Protection and Privacy Policy

Last updated: July 8, 2025

This document refers to the Privacy Policy implemented, through its websites, by Open Grow, Lda, with its registered office at Rua Mário Pais da Costa, n.º 12 - 3515-174 Abraveses, Viseu, Portugal, registered with the Commercial Registry Office of Viseu under the sole registration and legal entity number 513 181 547, with a share capital of €50,000.

For simplification and editorial clarity, the aforementioned company, Open Grow, Lda, will be referred to as "OPEN GROW".

By accessing the website https://www.opengrow.pt, its subdomains and sub-websites (e.g.: *.opengrow.pt), or the Open Grow Shop online store (https://www.opengrow.pt/shop/) (hereinafter, collectively, the “SITES”), the user declares that they have read, understood, and accept, without reservations, the Terms and Conditions. This acceptance applies equally to any order placed through the aforementioned SITES.

The use of the SITES and the placement of any order implies the reading, understanding, and full and unreserved acceptance of the Terms and Conditions. This acceptance also extends to the complementary policies available on the SITES, namely our Privacy, Cookies, and Returns Policies, all of which are binding on the user. Failure to accept these conditions makes it impossible to use the services and make online purchases.

1. Introduction

OPEN GROW is the entity responsible for processing personal data collected through its SITES, acting in accordance with Regulation (EU) 2016/679 (GDPR), applicable Portuguese legislation, and best practices for security and confidentiality.

2. Purposes of data processing

Users' personal data may be processed for the following purposes, among others:

• Customer account management and order processing;
• Issuance of invoices and fulfillment of legal and tax obligations;
• Communication with customers, including customer support;
• Management of returns, warranties, and complaints;
• Sending promotional or commercial communications, with the user's due consent;
• Statistical analysis and optimization of the Browse experience on the SITES, including the use of cookies, when authorized.

Data will be processed only for the purposes indicated above and for the time strictly necessary for their pursuit or for the fulfillment of applicable legal obligations.

3. Subcontractors

OPEN GROW may use third-party entities to provide services, namely:

• Carriers for delivery purposes (e.g., CTT, DHL);
• Payment processors (e.g., PayPal, MBWay);
• Logistics services (e.g., Eurosender);
• Analysis and marketing tools (e.g., Google Analytics).

These third parties may have access to personal data solely for the contracted purposes, being obliged to ensure confidentiality and apply adequate security measures, in accordance with Article 28 of the GDPR.

In specific cases, personal data may be transferred outside the European Economic Area (EEA). Whenever this occurs, OPEN GROW will ensure compliance with the provisions of the GDPR, adopting legally required measures to guarantee an adequate level of protection, namely through the signing of Standard Contractual Clauses approved by the European Commission or, when applicable, based on Binding Corporate Rules or adequacy decisions.

4. Legal basis and data subject rights

The processing of personal data may be based on the following legal grounds:

• Contract execution;
• Fulfillment of legal obligations;
• Free, specific, informed, and unambiguous consent of the data subject;
• Legitimate interest of OPEN GROW, when applicable.

Under the terms of the GDPR, data subjects have the following rights:

• Right of access: To their personal data.
• Right to rectification: Of inaccurate or incomplete data.
• Right to erasure (right to be forgotten): Of their data.
• Right to restriction of processing: In certain circumstances.
• Right to object: To the processing of their data.
• Right to data portability: To another controller.
• Right to lodge a complaint: With the National Commission for Data Protection (CNPD) through the contacts available at https://www.cnpd.pt/.
• Right to withdraw consent: To withdraw their consent at any time (when processing is based on this legal basis), without compromising the legality of the processing carried out until that date. This withdrawal can be done through the consent management tool available on the SITES or the contacts indicated in Section 20 (Contacts and Support) of these Terms and Conditions.

5. Retention Period

OPEN GROW will retain personal data only for the period strictly necessary for the purposes for which it was collected, or for the period legally required. For example:

• Data related to commercial transactions (invoices, proof of payment) will be retained for a minimum period of 10 years, in accordance with applicable tax and accounting laws.
• Data used for direct marketing (e-mail marketing) will be kept as long as your consent is not withdrawn or until you exercise your right to object.
• Account user data will be maintained as long as the account is active. After prolonged inactivity or a request for account closure, data will be deleted or anonymized, unless there are legal retention obligations.
• Other data will be retained for the period necessary for the management of the contractual relationship and fulfillment of obligations arising therefrom.

6. Exercise of rights

The user may exercise their rights free of charge, unless otherwise provided by law, or request additional clarifications, using the general contacts available in Section 20 (Contacts and Support) of these Terms and Conditions.

7. Protection of Minors' Personal Data

OPEN GROW does not intentionally collect personal data from individuals under 18 years of age.

To ensure this protective measure and in compliance with applicable guidelines, it is mandatory to provide the date of birth during the customer account creation process in the OPEN GROW online store. It will not be possible to create an account if the entered date of birth corresponds to an individual under 18 years of age.

Despite these efforts and preventive measures, the responsibility for safeguarding the privacy and online safety of minors lies with their parents or legal guardians. We strongly recommend that parents/legal guardians supervise minors' access to online content and ensure that any collection or use of minors' personal data on other websites or online services is duly authorized by them.

8. Other commitments of OPEN GROW

OPEN GROW does not carry out automated decisions or profiling with legal or significantly similar effects for users. The PRODUTOS (PRODUCTS) recommendations presented are merely indicative, based on previous interactions with the SITES (e.g., Browse history or cart content), without producing significant legal or commercial effects for the user.

OPEN GROW commits to ensuring transparency, security, and confidentiality in the processing of personal data, in accordance with applicable legal principles.