Privacy Policy

The controller responsible for processing your personal data on this website is:

We only process personal data where there is a lawful basis under the EU General Data Protection Regulation (GDPR) and German data-protection law. In short, we process data when you:

• contact us through the contact form or by email,
• sign up for our waitlist or newsletter,
• visit the website (technical data needed to deliver and secure the site).

We do not sell your personal data.

When you open our website, your browser automatically sends technical data that our hosting provider stores in server log files:

• IP address (shortened/anonymised where possible),
• date and time of the request,
• the page or file requested,
• browser type and version, operating system,
• referring website.

Purpose: to deliver the website reliably, ensure security, and prevent abuse.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, functioning website).

Retention: log data is deleted or anonymised after 30 days, unless needed longer to investigate a security incident.

Our website is hosted by Microsoft Azure (Microsoft Corporation / Microsoft Ireland Operations Ltd.). The hosting provider processes the above data on our behalf under a data-processing agreement (Art. 28 GDPR). We use the West Europe region.

If you use the contact form or write to us, we process the data you provide (e.g. your email address and your message) in order to respond to your enquiry.

• Legal basis: Art. 6(1)(b) GDPR (pre-contractual / contractual steps) and/or Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).
• Retention: we keep your message until your enquiry is resolved and then delete it, unless statutory retention periods apply.

If you join our waitlist or subscribe to our newsletter, we process your email address to send you updates, launch information and offers.

• We use a double opt-in process: you receive a confirmation email and your subscription is only active once you confirm.
• Legal basis: Art. 6(1)(a) GDPR (your consent).
• You can withdraw your consent at any time with effect for the future — click "unsubscribe" in any email or write to atelier@gardensofeternity.com. Withdrawing consent does not affect processing that took place before.

We use the email service provider Klaviyo, Inc. to send these emails and to measure whether emails are opened or links clicked, so we can improve our communications. Klaviyo processes data on our behalf under a data-processing agreement.

We only use cookies that are strictly necessary to operate the website (for example, to remember your chosen language). These do not require consent, and we do not use tracking, analytics or advertising cookies.

• Legal basis: § 25(2) TDDDG (storage strictly necessary to provide the service you requested).

Some providers (e.g. Klaviyo) are based in or process data in the United States. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards: the EU Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework where the provider is certified.

We keep your personal data only as long as necessary for the purposes set out above. Waitlist and contact data is deleted once it is no longer needed or when you withdraw your consent.

Longer retention applies only where the law requires it — in particular, once we issue invoices, German tax and commercial law requires us to keep invoices for 8 years and certain accounting records for up to 10 years. We delete or anonymise data as soon as the applicable period ends.

Under the GDPR you have the right to:

• Access (Art. 15) — obtain confirmation and a copy of your data,
• Rectification (Art. 16) — correct inaccurate data,
• Erasure (Art. 17) — have your data deleted,
• Restriction (Art. 18) — limit how we process it,
• Data portability (Art. 20) — receive your data in a machine-readable format,
• Object (Art. 21) — object to processing based on legitimate interests, including direct marketing,
• Withdraw consent (Art. 7(3)) — at any time, with future effect.

To exercise any of these rights, contact us at atelier@gardensofeternity.com.

You also have the right to lodge a complaint with a data-protection supervisory authority.

We use appropriate technical and organisational measures (including TLS/HTTPS encryption) to protect your data against unauthorised access, loss or misuse.

This website is not directed at children. We do not knowingly collect personal data from children under 16.

We may update this privacy policy to reflect changes to our website or legal requirements. The current version is always available on this page, with the date of the last update shown at the top.