Privacy Policy

1. What this policy covers

GROM is a managed market test that combines verified demand for one exact product within a defined delivery country and lets retailers quote for the group. This policy covers data submitted through buyer, quote, retailer-network and waitlist forms, plus technical data needed to operate, secure and evaluate the pilot.

2. Data we collect

• From buyers: email address, delivery country, product link, name and identifiers (such as brand, model, variant, GTIN or MPN), prices, quantity, deadline, notification language, purchase type, and confirmation of genuine intent to decide.
• From sellers: company or store name, optional company or tax ID, business contact, price, availability, delivery, warranty and offer terms.
• Waitlist and retailer network: email, selected market and language and, for a business, company name, website and optional registration number.
• Technical and pilot-measurement data: basic security logs, referral source carried in the link, a random identifier lasting only until the page is reloaded, and events such as starting a form, confirming a product or sharing. Event records do not contain an email address or form contents.

We do not ask for payment details, identity documents or passwords to other services.

3. Why we use data and our legal basis

• we verify email addresses, create and update pools, aggregate verified demand only, and send material outcome updates in order to take the steps you request when joining the pilot;
• we receive and verify seller offers and contact the parties when a genuine transaction opportunity arises;
• we protect the service from spam and abuse and measure the non-identifying pilot funnel (for example landing → form → confirmation) to find problems and assess whether the model works, relying on our legitimate interest in operating and securing the project;
• we use an address on the Poland waitlist only for the requested notice that the Poland pilot has opened;
• we send optional messages not directly related to running a pool only after obtaining separate consent.

Selecting the form checkbox confirms participation under the pilot rules and service messages needed to operate the chosen pool, such as address verification, round launch, verified offer and outcome. It is not consent to unrelated marketing, and we will not use your contact details for that purpose.

4. What is public and what stays private

We publicly show the product, group code, review status, prices, and aggregated numbers of people and units. The status clearly separates a community request from a retailer-backed challenge. We do not publicly display buyer or seller contact details. We do not sell personal data.

Contact details may be shared with a verified seller only after the participant separately chooses to proceed with a transaction or expressly permits it.

5. Service providers

Hosting, infrastructure, security and email delivery providers may process data only as needed to operate GROM. We use Resend to deliver transactional messages. If a provider processes data outside the United Kingdom or European Economic Area, appropriate legal safeguards are required.

6. How long we keep data

We keep contact details and pilot records for no longer than 12 months from collection unless you request deletion sooner or a longer period is necessary to establish, exercise or defend legal claims. Anonymised statistics that cannot be linked to a person may be retained longer.

7. Your rights

You may request access to, correction or deletion of your data, restriction or portability, and you may object to processing. Where consent is the legal basis, you may withdraw it at any time. Write to the controller at the address above.

You may also complain to the relevant supervisory authority, including the Information Commissioner's Office in the United Kingdom or the authority responsible for your place of residence.

8. Device storage, cookies and changes

GROM does not currently use advertising cookies, cross-site analytics or advertising profiling. The chosen language applies only to the current visit or is carried in the page address — we do not store this preference on the device. The identifier used for funnel measurement exists only in the open page memory and disappears when the page is reloaded. Infrastructure may use technologies necessary for security and operation. Material changes to this policy will be marked with a new date on this page.