GDPR Data Protection Policy (EU/EEA)

 

Document Reference: GV-GDPR-2026-V.2

Last Updated: --/--/2026

Status: Legally Binding for EU/EEA Residents

​

1. Introduction and Identity of the Data Controller

This Privacy Statement describes how GARDENVIEW Entertainment ("the Company," "we," "us") processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR). As the operator of the GARDENVIEW portal and the DANDY'S WORLD™ community experience, we act as the Data Controller for the personal data of our users located within the European Economic Area (EEA).

​

​

2. Legal Basis for Processing (Article 6 GDPR)

Under the GDPR, we only process your personal data when we have a valid legal basis to do so. This includes:

​

• Consent (Art. 6(1)(a)): You have given clear consent for us to process your personal data for a specific purpose (e.g., subscribing to our newsletter).

​

• Contractual Necessity (Art. 6(1)(b)): Processing is necessary for the performance of a contract to which you are a party (e.g., maintaining your community account).

 

• Legal Obligation (Art. 6(1)(c)): Processing is necessary for compliance with a legal obligation to which the controller is subject.

​

• Legitimate Interests (Art. 6(1)(f)): Processing is necessary for our legitimate interests, such as ensuring website security, preventing fraud, and improving the GARDENVIEW Educational Center and Museum user experience.

​

​

3. Categories of Personal Data Processed

We collect and process the following categories of data:

​

• Technical Data: IP addresses (anonymized where possible), browser type/version, time zone settings, operating systems, and platform-specific identifiers.

​

• Profile Data: Usernames, avatar preferences, and community engagement history.

​

• Communication Data: Email addresses and the content of any inquiries sent to our support or privacy teams.

​

• Usage Data: Information about how you navigate our 13-page website architecture and interact with the DANDY'S WORLD™ lore sections.

​

​

4. Rights of the Data Subject (Articles 15–22 GDPR)

As a resident of the European Union, you possess the following Data Subject Rights which you may exercise at any time:

​

• Right of Access (Art. 15): You may request a copy of the personal data we hold about you.

​

• Right to Rectification (Art. 16): You have the right to request the correction of inaccurate or incomplete personal data.

​

• Right to Erasure / "Right to be Forgotten" (Art. 17): You may request the permanent deletion of your personal data under certain conditions.

​

• Right to Restriction of Processing (Art. 18): You may request that we limit the way we use your data.

​

• Right to Data Portability (Art. 20): You may request that we transfer your data to another organization or directly to you in a structured, machine-readable format.

​

• Right to Object (Art. 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes.

​

​

5. International Data Transfers (Articles 44–49 GDPR)

While GARDENVIEW Entertainment operates globally, your data may be stored on servers located in the United States.

​

• Standard Contractual Clauses (SCCs): To ensure your data receives a level of protection essentially equivalent to that within the EU, we utilize the European Commission’s Standard Contractual Clauses for all cross-border data transfers.

​

• Security Adequacy: We only utilize service providers (such as Wix or Google Cloud) that maintain strict security certifications and adhere to international privacy frameworks.

​

​

6. Data Retention and Storage

We do not keep your personal data longer than is necessary for the purposes for which it was collected.

​

• Community Accounts: Data is retained as long as the account is active. Accounts inactive for more than 24 months are subject to automated deletion.

​

• Technical Logs: Server logs are kept for a maximum of 90 days for security auditing purposes, after which they are purged or anonymized.

​

• Statutory Requirements: We may retain certain data longer if required by EU or Member State law (e.g., for tax or litigation purposes).

​

​

7. Mandatory Disclosure Regarding ROBLOX

Please note that DANDY'S WORLD™ is a game experience hosted on the ROBLOX platform.

​

• GARDENVIEW Entertainment is not the controller for data processed by ROBLOX Corporation (e.g., payment info, account passwords, platform-wide chat).

​

• We strongly advise all EU users to review the Roblox Privacy Policy to understand their rights regarding platform-level data processing.

​

​

8. Data Protection Officer (DPO) and Contact Information

In compliance with Article 37 of the GDPR, we have designated a Data Protection Officer to oversee our privacy strategy.

​

Privacy Compliance Lead

120 Marconi Boulevard, Columbus, OH 43215, USA

privacy-eu@gardenview.org

 

You have the right to lodge a complaint with a Data Protection Authority (DPA) in your country of residence if you believe our processing of your data infringes upon the GDPR.

 

Consent Affirmation: By clicking "Accept" on our Cookie Banner or by continuing to use the GARDENVIEW portal, you acknowledge that you have been informed of your rights under the GDPR and understand how your data is processed by GARDENVIEW Entertainment.