Privacy Policy

Last updated: October 2026

This is a translation for your information. Only the German version is legally binding.

1. Controller and contact

The controller responsible for the processing of your personal data on pafory.com is:

YUNIQU GmbH
Fuchseckstraße 7
70188 Stuttgart
Germany
Represented by the Managing Director Alexandr Cernomoret
Email: [email protected]

2. Overview

We only process personal data if a legal basis permits it. The most important ones are:

• Contract (Art. 6(1)(b) GDPR): everything we need to handle your order or membership.
• Legal obligation (Art. 6(1)(c) GDPR): for example, retaining invoices under tax and commercial law.
• Legitimate interest (Art. 6(1)(f) GDPR): for example, the secure operation of the website or protection against fraud. Here we weigh our interest against yours. You can object at any time (Section 22).
• Consent (Art. 6(1)(a) GDPR): for example, for statistics and marketing cookies or the newsletter. You can withdraw consent at any time with effect for the future.

In addition, § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) applies to storing information on your device and reading information from your device. Without your consent, this is only permitted if it is strictly necessary for the service you requested.

3. Hosting, delivery and server log files

Hosting. Our website, our shop system and all our servers are operated by Hetzner Online GmbH, Gunzenhausen, Germany, on cloud servers in Germany. Hetzner processes the data on our behalf (Art. 28 GDPR).

Cloudflare. Traffic to pafory.com and our subdomains runs through the network of Cloudflare, Inc., San Francisco, USA. Cloudflare protects the website against attacks, speeds up delivery and determines your country from your IP address so that we can show you the appropriate language, prices and delivery countries. In doing so, Cloudflare processes your IP address, technical information about your browser and the addresses accessed. The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

Country detection. If Cloudflare does not provide the country information, we determine your country from your IP address using the GeoLite2 database of MaxMind, Inc., USA.

Server log files. With every visit, our servers automatically store: IP address, date and time, page accessed, referrer URL, browser type and version, and operating system. We need this data to deliver the website, find errors and fend off attacks (Art. 6(1)(f) GDPR). We delete these log files after 14 days.

4. Cookies, local storage and consent management

What cookies are. Cookies are small text files that your browser stores. Your browser's local storage (localStorage) and session storage (sessionStorage) work in a similar way. Here we refer to all of these together as "cookies".

Cookiebot. We use the consent tool Cookiebot of Usercentrics A/S, Copenhagen, Denmark. On your first visit, Cookiebot asks which categories you agree to:

• Necessary: always active, because the website would not work otherwise, for example shopping cart, login and security.
• Preferences: store settings such as your language.
• Statistics: help us understand how the website is used.
• Marketing: measure the success of our advertising and show you suitable advertising.

Cookiebot stores your choice in the cookie CookieConsent for 12 months and logs the consent with a shortened IP address, time and browser information. The legal basis is our legal obligation to be able to prove consents (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). You can change your choice at any time via the "Cookie settings" link in the footer.

Google Consent Mode. We use Google Consent Mode. Without your consent, all storage signals are set to "denied". Google services are then not loaded and do not set any cookies.

Google Tag Manager. We control the integration of statistics and marketing services via Google Tag Manager of Google Ireland Limited, Dublin, Ireland. The Tag Manager itself does not set any cookies. It only loads the other services in line with your consent. When the Tag Manager is loaded, your IP address is transmitted to Google. The legal basis is our legitimate interest in the orderly management of these services (Art. 6(1)(f) GDPR).

Server-side Tag Manager. We first send part of the measurement data (Google Analytics, Meta) to our own server at sgtm.pafory.com. It is operated on our behalf by Stape Europe OÜ, Tallinn, Estonia, on servers in France. There we remove or shorten data before it is passed on to Google or Meta. This only happens if you have agreed to the respective category. The server sets the cookies FPID, FPLC and FPGSID.

You will find an overview of our own cookies in the Annex, and all cookies with their storage period in the cookie settings.

5. Customer account and login

Registration. For a membership, you create a customer account. We store your email address, password (encrypted only), name and the addresses you provide, as well as, voluntarily, gender and date of birth. The legal basis is the contract (Art. 6(1)(b) GDPR).

Login. With every login, we store the time, IP address, browser information and a device identifier (Section 8) in order to protect your account from misuse (Art. 6(1)(f) GDPR). The login is stored in the cookie __Secure-next-auth.session-token for up to 30 days.

Login with Google or Facebook. You can also log in with your Google or Facebook account. We then receive your name, your email address and an identifier from the respective provider. The provider learns that you are logging in with us. The providers are Google Ireland Limited, Dublin, Ireland, and Meta Platforms Ireland Limited, Dublin, Ireland. The legal basis is your consent, which you give by clicking the button (Art. 6(1)(a) GDPR). The processing at Google and Meta is governed by their privacy notices.

Account emails. When you register and log in, we transmit your email address, language and, where applicable, your referral code to Klaviyo (Section 11) so that we can send you emails about your account and your membership (Art. 6(1)(b) GDPR).

6. Orders, membership and contract handling

When you place an order or conclude a membership, we process:

• name, billing and delivery address, email address and telephone number
• products ordered, scents in your queue, prices and voucher codes
• payment method and payment status (no full card data, see Section 7)
• status of your membership, charge dates, pauses and cancellations
• for cancellations, your reason for cancelling and voluntary comments
• for gift memberships and vouchers, name, email address and message for the recipient

The legal basis is the contract (Art. 6(1)(b) GDPR). We evaluate cancellation reasons in order to improve our offering (Art. 6(1)(f) GDPR).

Origin of the order. With your consent in the Marketing category, we store with your order which advertising or link brought you to us: campaign parameters such as utm_source, click identifiers of advertising platforms such as gclid or fbclid, the landing page and a referral or creator code (Section 15). Without consent, we do not store this information. We always store a creator or voucher code that you enter yourself, because your discount and the creator's compensation depend on it (Art. 6(1)(b) and (f) GDPR).

Systems. We manage orders and customer accounts in our shop system and in our own database, both on servers in Germany (Section 3). For inventory management, shipping handling, shipping confirmations and accounting, we use weclapp of weclapp SE, Frankfurt am Main, with a data center in Frankfurt. For this purpose, weclapp receives your name, your addresses, your email address, your telephone number and the products ordered. For evaluations of our orders, we use Metorik of UJU Pty Ltd, Australia. Metorik stores the data on servers in the USA. We have concluded standard contractual clauses for the transfer.

Saved form. So that your entries in the order form are not lost when you reload the page, we store them in your browser's local storage (pcfdk_v1) for a maximum of 24 hours. After the order is completed, we delete them there immediately.

7. Payment service providers

Depending on the payment method you choose, we pass on the data required for the payment (name, address, email address, amount, order number) to the respective payment service provider. The legal basis is the contract (Art. 6(1)(b) GDPR) and our legitimate interest in fraud prevention (Art. 6(1)(f) GDPR). The payment service providers are themselves responsible for their processing.

• Credit card (Braintree). You enter card data in input fields that are loaded directly by Braintree. They do not reach our servers. Braintree stores the card for recurring payments and gives us only the card type, the last four digits and the expiry date. For the 3-D Secure security check and for fraud detection, Braintree collects device data. Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
• PayPal. Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
• Amazon Pay. Amazon transmits your name, email address, telephone number and billing address to us. Provider: Amazon Payments Europe S.C.A., Luxembourg.
• Klarna. Klarna additionally receives your IP address, browser information, a device identifier and your customer number in order to prevent fraud. Depending on the payment method, Klarna checks your identity and creditworthiness and may query credit reference agencies for this purpose. Klarna decides which Klarna payment methods are offered to you. Provider: Klarna Bank AB (publ), Stockholm, Sweden.

Checking payment methods. When you store a new payment method, the payment service provider checks it without collecting any amount.

8. Fraud prevention and security

Device identifier. To protect accounts and payments from misuse, for example from the repeated creation of accounts for introductory offers or from card fraud, we calculate an identifier from technical characteristics of your browser (device type, screen, time zone, language settings and similar) at login, registration and order. We send it together with your IP address to our server and, for payment with Klarna, to Klarna. The legal basis is our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).

Google reCAPTCHA. For card payments and in the cancellation form, we use Google reCAPTCHA of Google Ireland Limited to detect automated attacks. reCAPTCHA evaluates your behavior on the page and browser information and transmits data for this purpose, including your IP address, to Google. The legal basis is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

Country block. To protect against fraud, our shop is not accessible from some countries. For this, we check your IP address when you access the site.

9. Shipping

We ship from our warehouse. For delivery, we pass on your name and delivery address to the shipping company that delivers your shipment (Art. 6(1)(b) GDPR). We work with DHL Paket GmbH, Bonn, Germany, and with Asendia. We send the shipping confirmation via weclapp (Section 6). We retrieve the shipping status via our own service at api.pafory.com.

10. Customer service and contact

Email and Help Center. When you write to us, we process your information to answer your inquiry (Art. 6(1)(b) GDPR if it concerns a contract, otherwise point (f)). For email inquiries and our Help Center at support.pafory.com, we use Help Scout of Help Scout PBC, Boston, USA. The Help Center is translated via Weglot (Weglot SAS, Paris, France). We load the Help Scout help window on our website only with your consent in the Preferences category. Help Scout then receives your IP address and browser information. Help Scout is certified under the EU-US Data Privacy Framework.

Cancellation form. We process name, email address and cancellation reasons from the cancellation form to carry out the cancellation (Art. 6(1)(b) and (c) GDPR). The form is sent via our own mail server.

11. Newsletter and email

Newsletter. If you subscribe to our newsletter, we send you information about scents, offers and news. We only need your email address for this. After signing up, you receive an email in which you confirm your subscription (double opt-in). We store the time of signup and confirmation as well as the IP address as proof. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time via the link in every email.

Emails to customers. If you have bought from us, we may send you emails about our own similar products as long as you do not object (§ 7 Abs. 3 UWG, the German Act against Unfair Competition, and Art. 6(1)(f) GDPR). You can object at any time, for example via the link in every email. You only incur the transmission costs at the basic rate for this.

Advent calendar waiting list. If you sign up for the waiting list, we inform you by email about the start of sales. The legal basis is your consent.

Klaviyo. For sending and evaluating our emails, we use Klaviyo of Klaviyo, Inc., Boston, USA. This applies to the newsletter and to emails about your contract, for example order and shipping confirmations, payment reminders and notices about your membership. For contract-related emails, the legal basis is the contract (Art. 6(1)(b) GDPR). Klaviyo stores your profile (email address, name, language, country, where applicable telephone number and address), your orders, events such as adding to the shopping cart, results from the Perfume Finder, your member status and whether you open and click our emails. From this, we build audiences in order to send you suitable emails.

In addition, a script from Klaviyo is embedded on our website, which displays signup forms and detects which pages you visit (cookie __kla_id, 2 years). We load the script only with your consent in the Marketing category.

Klaviyo sends emails via the service SendGrid of Twilio Inc., USA, and records clicks via our subdomain trk.pafory.com. Klaviyo is certified under the EU-US Data Privacy Framework. In addition, we have concluded standard contractual clauses.

12. Perfume Finder

In the Perfume Finder, you answer questions about scent preferences, occasions, personality, gender and age. Your answers are stored in your browser (pf-stepsV2, pf-results-steps) and sent to our own service at api.pafory.com to calculate your scent recommendation, without name or email address. The legal basis is the performance of the service you requested (Art. 6(1)(b) GDPR).

If you are logged in, we store your result in your profile and at Klaviyo in order to show you suitable scent recommendations in your account. We only send you scent recommendations by newsletter if you have agreed to the newsletter.

13. Reviews

When you review a product, we store the review in our own database, check it manually and publish it on the product page with your first name, the first letter of your last name and your country. We additionally store your IP address and browser information in order to detect misuse. When we approve your review, we inform Klaviyo about it (Section 11) in order to send you a confirmation. The legal basis is your consent by submitting the review (Art. 6(1)(a) GDPR) and our legitimate interest in genuine reviews (Art. 6(1)(f) GDPR).

On the homepage and some promotion pages, we also show reviews that were collected via reviews.io (Section 17).

14. Statistics and analytics (with consent)

We only use the following services if you have consented in the Statistics category (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG).

Google Analytics 4. We measure how visitors use our website: pages viewed, time spent, clicks, device, approximate location, origin of the visit and purchases. If you are logged in, we link the data for purchases with your customer number and your member status in order to understand how customers shop across several devices. The provider is Google Ireland Limited, Dublin, Ireland. The data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework. The data is deleted after 14 months. Cookies: _ga, _ga_*, FPID.

Microsoft Clarity. We record how visitors move around our pages (mouse movements, clicks, scrolling) in order to find usability problems. Entries in form fields are masked in the process. The provider is Microsoft Ireland Operations Limited, Dublin, Ireland. Data may be transferred to the USA. Microsoft is certified under the EU-US Data Privacy Framework. Cookies: _clck, _clsk.

Own usage analysis (visitor paths). We analyze ourselves which pages visitors use to arrive at a purchase or a membership. For this, we record page type, language, device class, whether you are a member, the test variant (see below), campaign parameters, the domain of the referring page and whether a click identifier of an advertising platform was present (only yes or no). On the order confirmation, we additionally record the order number. We do not store IP addresses or form entries. A random visitor identifier is stored in the cookie paf_vid (30 days from the last visit). The data is transmitted via Cloudflare to our database at Supabase, Inc., USA, which is located on servers in Paris, France. We delete individual page views after 30 days. We delete aggregated visitor paths and their link to orders after 14 months. If you withdraw your consent, we delete the identifier.

A/B tests. We test different versions of individual pages to find out which one works better. For this, we randomly assign visitors to a version and remember the assignment in the cookies ab_<Test-ID> and ab_name_<Test-ID> (30 days), so that you see the same version on every visit. With your consent, we record which version you saw, the address accessed, the referring page and whether you bought, together with a random session identifier. The data is stored at Supabase (see above). We delete it 90 days after the end of the respective test.

Surveys. On some pages, we ask for your opinion in a short window. We store your answers, a random session identifier, the page path, the domain of the referring page and the device class. Your IP address is used only in shortened and encrypted form to prevent multiple responses, and is deleted after 24 hours. The data is stored at Supabase (see above).

15. Marketing and advertising performance measurement (with consent)

We only use the following services if you have consented in the Marketing category (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG). They help us measure which advertising leads to visits, purchases and memberships, and to show you suitable advertising on other websites. For this, we transmit events such as page views, shopping cart, start of checkout, purchase and conclusion of a membership with value and products.

Matching of encrypted customer data. For some platforms, we additionally send customer data where we have it. The data is encrypted (hashed) before transmission. The platform matches it with its user accounts in order to attribute purchases and memberships to an ad:

• Google Ads: email address, telephone number, name and address at purchase and conclusion of a membership.
• Meta: email address on page views. At purchase and conclusion of a membership additionally telephone number, first and last name, city, postal code, country and customer number, also via the Conversions API.
• TikTok: email address and customer number.
• Pinterest: email address on product views, purchase and conclusion of a membership.
• OpenAI: country, city and postal code at purchase and conclusion of a membership, not encrypted.
• Snap, Taboola, Microsoft: no customer data, only events and page address.

We send the Meta Conversions API data via our server-side Tag Manager (Section 4). For the collection and transmission of the data to Meta, we are jointly responsible with Meta (Art. 26 GDPR). You can find the agreement on this at facebook.com/legal/controller_addendum. For the further processing, Meta alone is responsible. OpenAI processes the data as an independent controller.

Own campaign cookies. With your consent, on your first and your last visit via an advertising link, we store the campaign parameters, click identifiers, the referring page, the landing page and, where applicable, a creator code in the cookies paf_utm (first visit) and paf_utm_last (last visit), each for 90 days. With an order, we transfer this information into the order (Section 6).

16. Affiliate partners

We work with partners who advertise for us on their websites and receive a commission for this. To attribute the commission, we record which partner you came to us through and whether an order resulted from it. This only happens with your consent in the Marketing category (Art. 6(1)(a) GDPR).

• AdCell of Firstlead GmbH, Rosenfelder Str. 15-16, 10315 Berlin
• Linkster of Linkster GmbH, Colonnaden 5, 20354 Hamburg, cookies TRS and TRSCJ (30 days)

For AdCell, Google and Meta, we also provide product lists without personal data.

17. External content

Fonts. We embed the fonts we use from our own server. No data is transferred to third parties in the process.

Partner shops and maps. We do not sell some brands ourselves but through partner stores. When you open "Select partner shop" on the product page, we load maps from Google Maps of Google Ireland Limited. Your IP address is transmitted to Google in the process, and data may be transferred to the USA (Data Privacy Framework). If you share your location in your browser, this is also transmitted to Google. If you enter a postal code, we determine the matching stores via Azure Maps of Microsoft Ireland Operations Limited. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by opening the function.

Review widget. On the homepage and some promotion pages, we show reviews via a widget from reviews.io (Reviews.co.uk Ltd, United Kingdom). We load the widget only with your consent in the Marketing category. reviews.io then receives your IP address and browser information. For the United Kingdom, there is an adequacy decision of the EU Commission.

18. Error reports

If a technical error occurs on our website, we send an error report to our development team via Slack of Slack Technologies Limited, Dublin, Ireland. Data may be transferred to the USA; Slack is certified under the EU-US Data Privacy Framework. The report contains the page accessed, the error message and browser information, but no contact details. The legal basis is our legitimate interest in a functioning website (Art. 6(1)(f) GDPR).

19. Recipients and processors

We only pass on your data if this is described in this policy. Service providers that process data on our behalf (processors under Art. 28 GDPR) are contractually bound to our instructions. These include in particular Hetzner (hosting), Cloudflare (delivery, protection), Supabase (database for statistics and tests), Stape (server-side Tag Manager), Klaviyo and SendGrid (email), Help Scout (customer service), Weglot (translation of the Help Center), Usercentrics (consents), weclapp (inventory management, shipping, accounting), Metorik (evaluations), Slack (error reports) and Microsoft (Clarity, Azure Maps).

Independent controllers are payment service providers, shipping companies, advertising platforms (where there is no joint responsibility) and providers of login services.

In addition, we pass on data to authorities, tax advisors and courts if we are legally obliged to do so or if it is necessary to enforce our rights.

20. Transfers to third countries

Some service providers are based in the USA or transfer data there. For the USA, there has been an adequacy decision of the EU Commission since 10 July 2023 (EU-US Data Privacy Framework). It applies to companies that have certified themselves under it. Where this is not the case, we conclude standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). You can obtain a copy on request.

21. Retention periods

We delete your data as soon as we no longer need it for the purpose and there is no statutory retention obligation.

• Customer account: until you request deletion. After that, we delete the account data, unless a retention obligation exists.
• Order and invoice data: 8 years for accounting records, 6 years for commercial letters and other documents, in each case from the end of the calendar year (§ 147 Abs. 3 AO, the German Fiscal Code, and § 257 Abs. 4 HGB, the German Commercial Code).
• Shopping carts without a customer account (with IP address and browser information): 3 months.
• Newsletter: until you unsubscribe. We keep the proof of your consent for up to 3 years afterwards.
• Server log files: 14 days (Section 3).
• Cookies: see Annex.

22. Your rights

You have the right to

• access to your stored data (Art. 15 GDPR),
• rectification of incorrect data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of a consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR). If we process data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving reasons.

Write to us at [email protected] for this.

Right to lodge a complaint. You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart (postal address: P.O. Box 10 29 32, 70025 Stuttgart), www.baden-wuerttemberg.datenschutz.de.

23. Automated decisions

As a rule, we do not make decisions based solely on automated processing that have legal effects concerning you (Art. 22 GDPR). Klarna may decide automatically on acceptance for certain payment methods. You will find information on this in Klarna's privacy policy.

Referral program. To prevent misuse of the "Refer a friend" program, we automatically compare IP address and device identifier (Section 8) with existing accounts when someone registers with a referral code and when invitations are sent. If they match, the referral is automatically marked as suspicious, and the credit or further invitations may be blocked. If you think this happened wrongly, write to us at [email protected]. We will then review the case personally. The legal basis is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

24. Changes to this Privacy Policy

We adapt this policy when our website or the legal situation changes. The version published here at the time applies.

Annex: Own cookies and local storage

You will find the complete list, including all third-party cookies, in the cookie settings.

Your browser's local storage