Back to home

the curious plant

privacy policy

We keep data collection to the minimum needed to run this website and to answer messages you send us. Anything optional — such as analytics — stays switched off until you actively agree to it. This page explains what that means in practice, in line with the EU General Data Protection Regulation (GDPR).

Last updated: 30 July 2026

1. Who is responsible for your data

The controller responsible for data processing on this website is:

The Curious Plant UG (haftungsbeschränkt)
Siegburger Str. 116
40591 Düsseldorf
Germany
Email: [email protected]

Registered at Amtsgericht Düsseldorf under HRB 112907. Managing Director: Shelly Christine Sundag. Full company details are set out in our legal notice.

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, email addresses, etc.).

2. What this website is

This is a purely informational “coming soon” website. There is no user account, no newsletter sign-up, no shop and no comment function. You can browse the site without giving us any personal information at all.

3. Server log files

Our hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:

  • browser type and browser version
  • operating system used
  • referrer URL (the page you came from)
  • host name of the accessing device
  • date and time of the server request
  • IP address (shortened or anonymised where technically possible)

This data is not merged with other data sources and is not used to identify you personally. The legal basis is Art. 6(1)(f) GDPR: we have a legitimate interest in the technically error-free presentation and security of our website. Log data is deleted or anonymised after a short retention period.

4. Cookies and consent

The core functions of this website work without cookies. Technically necessary cookies may be set by the hosting infrastructure to deliver the site securely; these are used on the basis of Art. 6(1)(f) GDPR and § 25(2) TDDDG, and they do not profile you.

Beyond that, we use one optional analytics service — Google Analytics, described in section 5. It is switched off by default. When you first visit, a banner asks whether you agree to it. Nothing is loaded, no analytics cookies are set and no data is sent to Google unless and until you choose “Accept analytics”. Declining costs you nothing: the site behaves in exactly the same way.

Your choice is stored locally in your own browser (a browser storage entry named “tcp-analytics-consent”) so that we do not have to ask again. You can change or withdraw it at any time using the Cookie Settings link in the footer of every page. Withdrawing is as easy as giving consent, and when you withdraw it we delete the analytics cookies from your browser.

Fonts and images on this site are served from our own servers. No web fonts are loaded from third-party font services, so no data is transmitted to such providers when you visit.

5. Google Analytics — only with your consent

If, and only if, you have agreed via the consent banner, this website uses Google Analytics 4, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Our measurement ID is G-6355PN7X6L.

Legal basis. Art. 6(1)(a) GDPR (your consent), together with § 25(1) TDDDG for the storage of the cookies involved. You are under no obligation to consent and there is no disadvantage to you if you do not.

Why we use it. For one purpose only: to see in aggregate how many people find this page, which pages they open and roughly where they came from, so that we can judge whether it is worth building on. We do not run advertising, we do not use this data for advertising, and we have not connected it to any Google advertising product. Google Signals and data sharing for advertising purposes are not enabled.

What is processed. Pages viewed and the time of the visit, the referring page, an approximate location derived from your IP address (country, region or city level), your device, browser and operating system type, screen size and language, and a randomly generated identifier stored in cookies (typically “_ga” and a second cookie beginning “_ga_”) which allows Google to recognise a returning browser. We never receive your name or email address through this service, and we do not attempt to combine analytics data with any other data in order to identify you.

IP addresses. According to Google, Analytics 4 uses IP addresses only to derive an approximate location and does not log or store them. We additionally send the IP anonymisation signal in our configuration.

Transfer to third countries. Google Ireland Limited acts as our processor on the basis of a data processing agreement under Art. 28 GDPR, and data may be transferred onward to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision under Art. 45 GDPR; Google’s Standard Contractual Clauses apply in addition. Even so, we cannot entirely rule out that US authorities may gain access to such data.

Retention. Event data in our Google Analytics property is deleted automatically after the retention period configured in that property; 14 months is the longest period Google makes available. The analytics cookies in your browser expire after two years at the latest.

How to withdraw your consent. Open Cookie Settings in the footer of any page and choose “Decline”. Measurement stops immediately for the future and we remove the analytics cookies from your browser. You may also delete cookies in your browser settings, or install Google’s browser opt-out add-on.

Google’s own information on how it handles this data is available in the Google Privacy Policy and on Google’s business data responsibility pages.

6. Contacting us by email

If you write to us at [email protected], the details you provide — your email address, your name if you give it, and the content of your message — are stored by us so we can handle your enquiry and any follow-up questions.

The legal basis is Art. 6(1)(b) GDPR where your message relates to a (pre-)contractual relationship, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries addressed to us) or Art. 6(1)(a) GDPR where you have given consent. We keep this correspondence until the purpose has been fulfilled, until you ask us to delete it, or until a statutory retention period ends.

7. Payments and voluntary donations

If we offer a voluntary donation or tip option, payments are processed by Stripe (Stripe Payments Europe, Ltd.). When you make a payment, the data required for the transaction — for example your name, email address, payment method and payment amount — is transmitted to and processed by Stripe as an independent controller and payment service provider. We never see or store your full card details.

The legal basis for transmitting this data is Art. 6(1)(b) GDPR (performance of the payment you initiate) and Art. 6(1)(f) GDPR (efficient and secure payment processing). Stripe’s own privacy notice applies to their processing and is available at stripe.com/privacy. Transaction records are retained by us for as long as required by German commercial and tax law.

8. Hosting

This website is hosted by an external service provider that processes personal data only on our behalf and on our instructions, on the basis of a data processing agreement in accordance with Art. 28 GDPR. Data processed on our behalf is limited to what is needed to deliver the website (see “Server log files” above).

9. Your rights

Under the GDPR you have the right, at any time and free of charge, to:

  • request information about the personal data we hold about you (Art. 15 GDPR)
  • have inaccurate data corrected (Art. 16 GDPR)
  • have your data deleted (Art. 17 GDPR)
  • request restriction of processing (Art. 18 GDPR)
  • receive your data in a portable format (Art. 20 GDPR)
  • object to processing based on legitimate interests, including for direct marketing purposes (Art. 21 GDPR)
  • withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

To exercise any of these rights, simply email us at [email protected].

10. Right to complain to a supervisory authority

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority — in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). This is without prejudice to any other administrative or judicial remedy.

11. Data security

This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by the “https://” prefix and the lock symbol in your browser’s address bar. We also apply appropriate technical and organisational measures to protect data against loss, manipulation and unauthorised access.

12. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

13. Changes to this policy

We may update this privacy policy so that it always reflects current legal requirements or changes to our services — for example when the shop launches. The version published on this page always applies.

Questions about privacy? Write to [email protected].