Privacy Policy

(Datenschutzerklärung)

Last Updated: 9.10.2026

1. An Overview of Data Protection

General Information

The following notes provide a simple overview of what happens to your personal data when you visit our website [Insert Website URL] (the "Site"). Personal data is any data with which you could be personally identified. Detailed information on the subject of data protection can be found in our Privacy Policy below.

Controller / Data Capture on Our Site

Who is responsible for the data collection on this website? Data processing on this website is carried out by the website operator:

  • Company Name: Endless Forest

  • Address: Outstanding

  • Email: support@endless-forest.com

How do we collect your data?

  • Data you provide to us: This includes information you enter when placing an order, creating a customer account, signing up for our newsletter, or contacting us via email/contact forms.

  • Data collected automatically: Other data is collected automatically or after your consent when visiting the website by our IT systems. These are mainly technical data (e.g., internet browser, operating system, or time the page was accessed).

What do we use your data for? Part of the data is collected to ensure the proper functioning of the website. Other data can be used to analyze user behavior, process purchases, ship goods, and send marketing communications (where consented to).

2. Legal Basis for Processing Data (GDPR)

We process your personal data in accordance with the GDPR (DSGVO) based on the following legal grounds:

  • Art. 6 (1) (a) GDPR (Consent): When you have given us explicit consent (e.g., for newsletter subscriptions or non-essential tracking cookies).

  • Art. 6 (1) (b) GDPR (Contract Performance): Processing necessary to fulfill a contract with you (e.g., processing orders, payment details, shipping natural fragrances and diffusers to your address).

  • Art. 6 (1) (c) GDPR (Legal Obligation): Processing required to comply with statutory legal and tax obligations (e.g., retaining invoices under German commercial/tax law).

  • Art. 6 (1) (f) GDPR (Legitimate Interest): Processing for our legitimate interests (e.g., ensuring IT security, preventing fraud).

3. Data Storage & Retention

Unless a more specific storage period has been specified in this policy, your personal data will remain with us until the purpose for which it was collected no longer applies.

If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods under German HGB / AO, which require storing billing data for up to 10 years).

4. Your Rights Under GDPR

As a data subject in the EU/Germany, you have the following rights at any time:

  • Right of Access (Art. 15 GDPR): Right to obtain information about your personal data processed by us.

  • Right to Rectification (Art. 16 GDPR): Right to request the correction of inaccurate or incomplete personal data.

  • Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Right to request deletion of your personal data.

  • Right to Restriction of Processing (Art. 18 GDPR): Right to request restricted processing of your data under certain conditions.

  • Right to Data Portability (Art. 20 GDPR): Right to receive your data in a structured, commonly used, and machine-readable format.

  • Right to Object (Art. 21 GDPR): Right to object at any time to processing based on legitimate interests or direct marketing.

  • Right to Revoke Consent (Art. 7 (3) GDPR): Right to withdraw previously granted consent at any time with effect for the future.

  • Right to Lodge a Complaint: Right to complain to a competent data protection supervisory authority (e.g., the State Data Protection Officer / Landesdatenschutzbeauftragter in your German federal state).

5. Data Collection & Services on Our Website

A. Hosting & Content Delivery Networks (CDN)

Our website is hosted by an external service provider (Host):

  • Host Provider: Squarespace

  • Data Transferred: IP addresses, contact requests, server log files, transaction data.

  • Legal Basis: Art. 6 (1) (b) & (f) GDPR. We have entered into a Data Processing Agreement (DPA / Auftragsverarbeitungsvertrag) with our host in accordance with Art. 28 GDPR.

B. E-Commerce & Order Processing

To process and ship your order for our reed diffusers and fragrances, we share necessary personal data with third-party partners:

  • Shipping & Logistics Partners: (e.g., DHL, Hermes, UPS) – Name, delivery address, and tracking notification details (Art. 6 (1) (b) GDPR).

  • Payment Service Providers:

    • [e.g., Stripe, PayPal, Klarna, Apple Pay, Mollie]

    • Transaction data, payment details, and total amounts are processed directly by these providers according to their privacy policies under Art. 6 (1) (b) GDPR.

C. Cookies & Tracking Technologies

Our site uses cookies and local storage.

  • Essential Cookies: Necessary for the operation of the online store (e.g., shopping cart functions). Processing is based on Art. 6 (1) (f) GDPR / § 25 (2) TDDDG.

  • Analytical & Marketing Cookies: Used to measure site performance or serve targeted advertising (e.g., Google Analytics, Meta Pixel). Processing takes place only with your explicit consent via our Consent Management Platform / Cookie Banner (Art. 6 (1) (a) GDPR / § 25 (1) TDDDG). You may change or revoke your cookie settings at any time via the cookie settings footer on our site.

D. Newsletter & Email Marketing

If you subscribe to our newsletter:

  • We collect your email address based on your explicit consent (Art. 6 (1) (a) GDPR).

  • We use a Double Opt-In procedure (a confirmation link sent to your email) to ensure you are the actual account owner.

  • Newsletter Platform: [Insert Provider, e.g., Klaviyo / Mailchimp / Sendinblue].

  • You can unsubscribe at any time via the link provided at the bottom of every newsletter.

6. SSL / TLS Encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us as the site operator. You can recognize an encrypted connection by the browser address bar changing from http:// to https:// and by the lock icon in your browser line.