My Lawn, My Landmark - Privacy Policy

This Privacy Policy explains how we collect, use, and protect your personal data when you participate in this campaign (the “Campaign”). Please read it carefully before taking part.

 

1. Data Controller

This Campaign is organized and operated by Navimow B.V., Dynamostraat 7, 1014 BN Amsterdam, as the data controller within the meaning of the General Data Protection Regulation (GDPR), responsible for the collection and processing of personal data related to the Campaign.

Contact for privacy/data rights: support-navimow@rlm.segway.com

 

2. Data We Collect (Categories of Personal Data)

To operate the Campaign, display submissions, and deliver prizes, we collect only the minimum data necessary:

· Submission Content: Photos/images you upload of your garden or outdoor landscape (lawns, yards, etc.). No faces, body parts, or private information should be included.

· Generated Postcards: Postcards generated by the system based on your upload, used for display during the Campaign.

· Participation Information: City/country information provided in forms, community account/user ID (e.g., for Facebook group participation), timestamps, basic technical logs (e.g., filename, hash/fingerprint, moderation status).

· Contact and Prize Information: Email address for contact and prize delivery. If you win a physical prize (e.g., i105 + garage), we will collect your name, shipping address, and phone number (only for logistics purposes).

· Prize Preferences (EU gift cards only): Your selected Amazon site (e.g., Amazon.de / .fr / .it / .es / .nl / .se / .pl) for issuing the gift card.

· Anti-Fraud and Security Data: Basic technical information (e.g., device/browser fingerprint, approximate IP range, risk control verification results) necessary to ensure the fairness and security of the Campaign. This information is used only for security and integrity purposes, not for profiling or marketing.

Important: Only upload garden-related photos. Do not upload images containing identifiable faces, body parts, or other private information. You are solely responsible for any legal liability arising from uploading prohibited content.

 

3. Submission Restrictions and Automated Review

· We use automated content moderation services to technically scan uploaded photos (e.g., detect faces or non-compliant content). Automated checks do not produce legal or significant effects on users.

· If prohibited or non-compliant content is detected, the submission will be rejected, and the image and its temporary processing data will be automatically deleted without entering long-term storage.

· If you believe your content was incorrectly flagged, you may appeal and request manual review via support-navimow@rlm.segway.com.

 

4. Purposes of Processing

We process your personal data strictly for the following purposes:

· Campaign Operation: Verify eligibility, generate and display postcard submissions (on campaign website/social media), conduct voting/review, publish results, and distribute prizes.

· Compliance & Security: Automated compliance checks, anti-fraud and risk control measures, operational security.

· Communication: Send operational notifications related to the Campaign (e.g., participation instructions, winner notifications, prize delivery confirmations).

· Statistics & Optimization: Use aggregated or de-identified data to analyze and improve campaign processes.

 

5. Legal Bases for Processing

· Consent (GDPR Art. 6(1)(a)): Your consent is collected when you submit your content for display and review.

· Legitimate Interests (GDPR Art. 6(1)(f)): Content moderation and minimal technical processing for campaign security, anti-fraud, and operations. We balance these interests against your rights and freedoms.

· Legal Obligation (GDPR Art. 6(1)(c)): Where retention is required for tax, compliance, or audit purposes.

 

6. Data Storage Location and Service Providers

· Hosting & Region: Campaign data is hosted on Microsoft Azure in the West Europe region, using Azure’s PaaS database/storage services (non-private deployment).

· Compliance: Azure complies with GDPR and EU privacy/security requirements. Data is stored within the EEA by default.

· Control: We retain full control over database accounts, keys, and access policies. No third party has access except as required by law. Azure provides infrastructure services only and may not use data for its own purposes.

· Security Measures: TLS encryption in transit, encryption at rest, least-privilege access controls, audit logging, periodic access review, and key rotation.

 

7. AI Services and Compliance

· We may use AI-based recognition services to check the compliance of submitted photos (e.g., face or sensitive content detection).

· The processed data may include usernames, submitted photos, and city information, which may constitute personal data.

· This processing is based on legitimate interests under Article 6(1)(f) GDPR.

· AI service providers are required to comply with GDPR and the EU AI Act.

· AI is used solely for backend moderation and not for user interaction or model training.

· All AI processing servers are located within the EEA.

 

8. Data Sharing (Processors and Third Parties)

· We do not sell your personal data. Data will only be shared when necessary for the purposes described in this policy or as required by law.

· The processors we may use include:

o Microsoft Corporation (Microsoft Azure / West Europe): Hosting and database/storage services for secure campaign data management.

o Automated content moderation/AI service providers (EEA): For compliance review of submissions only, not for commercial use.

o Enterprise email service providers (EEA or offering EEA data residency): For sending campaign-related notifications and prize delivery emails.

o Logistics providers: If you win a physical prize, only the minimum information (e.g., name, shipping address, phone number) will be shared for delivery.

· Amazon Gift Cards: We do not share your personal data with Amazon. Gift card claim codes are sent to your email.

If cross-border data transfers are required (e.g., for disaster recovery), we will use Standard Contractual Clauses (SCCs) and conduct a Transfer Impact Assessment (TIA) in accordance with GDPR.

 

9. Data Retention and Deletion

· Temporary processing data (e.g., cache, thumbnails, technical fingerprints/hashes, intermediate moderation results): deleted immediately after processing.

· Contact and prize information: Retained for up to 30 working days after prize delivery and redemption to allow for necessary notifications in case of incidents, then permanently deleted.

· Legal obligations: Where applicable (e.g., tax/audit), data is retained for the legally required period.

· Statistics and optimization: Only aggregated or de-identified data is retained, for up to 12 months.

 

10. Automated Decision-Making and Manual Review

Automated moderation is used to identify non-compliant content (e.g., faces or sensitive elements). These results do not produce legal or significant effects. You may request a manual review at any time via support-navimow@rlm.segway.com.

 

11. Minors

This Campaign is intended only for individuals aged 18 years or older. We do not knowingly collect personal data from minors.

 

12. Your Rights

Under the GDPR, you have the right to:

· Access your personal data held by us;

· Request correction of inaccurate or incomplete data;

· Request deletion of your data under legal conditions (“right to be forgotten”);

· Restrict or object to certain processing activities;

· Exercise data portability (structured, commonly used, machine-readable format, where technically feasible);

· Withdraw your consent at any time (without affecting the lawfulness of processing based on consent before withdrawal).

You also have the right to lodge a complaint with your local data protection authority.
Rights and complaints contact: support-navimow@rlm.segway.com

 

13. Security Incidents and Notification

In the event of a personal data breach that may pose a risk to your rights and freedoms, we will assess the incident and, where required, notify the competent supervisory authority and affected individuals in accordance with applicable law.

 

14. Policy Updates

We may update this Privacy Policy from time to time. The latest version will be published on the campaign page or announced in community groups. Significant changes will be communicated in a clear and prominent manner.