As of: October 2026
Controller
Frank Poessel, Malinenstraße 27, 22783 Hamburg, Germany
Email: kontakt@succulenttent.store
More details are in the legal notice.
In short
We process personal data only as far as it is needed to run the shop, to handle your order and to meet our legal duties. The shop uses only technically necessary cookies, no advertising or tracking cookies, and no advertising networks. For online payment we send you on to our payment service provider (see below). Fonts, pictures and films are on our own server.
Visiting the shop (server logs)
The shop runs on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Germany. Hetzner processes the data on our behalf.
Technically necessary connection data arises when you open a page. The shop's own access log contains only the time, the kind of request, the status code, the amount of data and the response time, no IP address and not the page that was requested. The server in front, which takes the encrypted connection, processes your IP address and the requested address for a short time to deliver the pages and to ward off attacks.
The purpose is to deliver the pages to you, to run the shop securely and to find errors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and working operation). The log files are limited in size and are overwritten continuously, so entries usually disappear after a few days to a few weeks.
Cookies
The shop sets only technically necessary cookies:
- Session cookie: recognises you during your visit and, if you are signed in, your sign-in and your cart. It expires by itself after a few days and is deleted when you sign out.
- Protection cookie against forged forms (CSRF): protects forms such as sign-in and ordering from misuse.
The legal basis is § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. No consent banner is needed for this. There are no cookies for advertising, audience measurement or profiling.
Visitor counter (Umami)
To see how many people visit the shop and which pages are used, the statistics software Umami runs on the same server. The data does not leave the server and is not passed on to anyone.
- What is recorded: the page, the page you came from, browser, operating system, device type, screen size, language, and the country or region (derived from the IP address).
- What is not stored: your IP address and anything that makes you personally identifiable. Umami sets no cookies and stores nothing on your device. To count visits an anonymous identifier is calculated that changes regularly.
- If your browser sends “Do Not Track”, nothing is counted. On the pages for checkout, order, account and withdrawal nothing is counted.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving the shop with anonymous figures).
Customer account
If you create an account we store your email address, your name, your password (only as an encrypted value, not in plain text), any saved addresses and the list of your orders. The legal basis is Art. 6(1)(b) GDPR (using the account as part of the contractual relationship).
The account stays until you delete it. You can delete it in the account itself or write to the email address above. We must keep data on completed orders for as long as the law requires (see below).
Order and shipping
For an order we process your name, your billing and delivery address, your email address, if given your phone number, the plants ordered, the destination country and the state of the payment. For payment by bank transfer we also see the payer's name, the account details and the reference on the bank statement.
The purpose is to carry out the purchase contract: to confirm your order, to check that the payment has arrived, to ship the plant and to help with questions or defects. The legal basis is Art. 6(1)(b) GDPR. Where we meet retention and documentation duties (tax and commercial law, species protection law), it is Art. 6(1)(c) GDPR.
Recipients: for shipping we pass your name, delivery address and, where needed for delivery, your email address or phone number to the parcel service we use (for example DHL, Deutsche Post, DPD, GLS or UPS). There are no other recipients, unless we are legally obliged to provide information.
Payment (Mollie and PayPal)
When you pay by PayPal we send you on to our payment service provider: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands. Mollie processes the payment and, for payment with PayPal, sends you on to PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg).
We do not pass your name to Mollie for this; what is passed on is the amount, the order number, the chosen payment method and the language. Which data Mollie and PayPal collect from you during the payment is decided by them under their own responsibility; details are in their privacy notices: Mollie, PayPal. From Mollie we learn whether the payment was made, and from your payment only what we need to match it to the order.
The legal basis is Art. 6(1)(b) GDPR (carrying out the purchase contract).
Emails
We send you emails that belong to your order, for example the order confirmation with payment details, the shipping notice, the confirmation of receipt of a withdrawal, and answers to your enquiries. We send no advertising emails. We send emails through our mailbox at IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany), which works on our behalf. The legal basis is Art. 6(1)(b) GDPR.
If you write to us we use your details to answer your enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR. We delete the message once the enquiry is dealt with and no retention duty applies.
Withdrawal with the “Withdraw from contract” button
If you declare the withdrawal with the “Withdraw from contract” button we store your name, the details of the contract, your email address and the time of the declaration. We need this to confirm receipt to you and to handle the withdrawal. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a BGB (German Civil Code) and Art. 6(1)(b) GDPR.
Storage period
- Server logs: as described above.
- Data on orders and invoices: up to ten years, as long as tax and commercial law require it. After that we delete them.
- Declarations of withdrawal: as long as the order concerned is kept.
- Customer account: until you delete it.
- Enquiries by email: until dealt with, after that only as far as a retention duty applies.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Where we process data only with your consent you can withdraw it at any time with effect for the future. Write to the email address above for this.
You can also lodge a complaint with a data protection supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information.
Providing your data is necessary for the order, because otherwise we cannot perform the contract. There is no automated decision-making including profiling.
The game BLATTGOLD
The website succulenttent.store with the game BLATTGOLD has its own privacy notice: succulenttent.store/datenschutz.