This privacy policy explains which personal data we process on Parfumo, for which purposes, on which legal basis, and for how long. It is structured by the individual features of the platform so you can quickly find the sections relevant to you.
The controller responsible for data processing on this website is:
Parfumo Community
Christoph Polatzky
Albert-Schweitzer-Straße 9
09648 Mittweida, Germany
Telephone: +49 (0) 3727 97 999 35
Email: [email protected]
You have the following rights regarding your personal data:
Right to object (Art. 21 GDPR)
Where we process data based on Art. 6 (1) (f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to [email protected] is sufficient to object.
To exercise your rights, simply contact us using the details above. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Sächsische Datenschutz- und Transparenzbeauftragte
Maternistraße 17, 01067 Dresden, Germany
Postfach 11 01 32, 01330 Dresden
Email: [email protected]
Our servers are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. All platform data is processed on servers in Germany and the EU. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure and reliable operation of the website.
We use the content delivery network and security services of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. For technical reasons, all requests to our website are routed through Cloudflare's servers. In this process, Cloudflare processes your IP address and technical connection data in order to deliver the website, fend off attacks and detect automated access. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure, fast and stable delivery of the website. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses pursuant to Art. 46 (2) (c) GDPR are in place. Further information: https://www.cloudflare.com/privacypolicy/
For the delivery of images and other static content we use the CDN and storage service of BunnyWay, informacijske storitve d.o.o., Slovenia (bunny.net). This involves the processing of network connection data, IP addresses, user agent information and URL referrers. We have concluded a data processing agreement with bunny.net pursuant to Art. 28 GDPR. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the fast delivery of media files.
When you access the website, information is automatically stored in server log files: browser type and version, operating system, referrer URL, IP address and time of the request. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the technically error-free provision of the website and the detection and prevention of attacks and abuse. The logs are deleted as soon as they are no longer required for these purposes.
The legal basis for storing and accessing information on your device (e.g. cookies) is your consent pursuant to § 25 (1) of the German TDDDG. This consent is requested via our consent platform when you first visit the website. Pursuant to § 25 (2) no. 2 TDDDG, no consent is required for storage and access operations that are strictly necessary to provide the features you use. For us these include, in particular, the cookies for logging in, storing your consent decision, your display preferences (e.g. dark mode and list views), and the "recently viewed perfumes" and search history features.
As our consent management platform we use Sourcepoint (Sourcepoint Technologies, Inc.) based on the IAB Transparency and Consent Framework (TCF). You can view, change or withdraw your decision at any time via the cookie settings (also linked in the footer).
The legal basis for the subsequent processing of personal data follows from the GDPR and is stated for each service in this policy.
You can create a user account to use the community features. We process the data you provide (username, email address, password in encrypted form and voluntary profile details). The legal basis is Art. 6 (1) (b) GDPR, as the processing is necessary to provide the user account and its associated features. We also use the email address provided during registration to inform you about important changes to the service.
To protect accounts, we log sign-in events including IP address, user agent, country of origin and the result of the sign-in attempt. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting accounts from unauthorized access and detecting abuse. The logs are deleted as soon as they are no longer required for these purposes.
If a sign-in occurs from a country you have not signed in from before, we send a security notification by email to your registered address so that you can change your password in case of unauthorized access. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting your account from unauthorized access.
To detect multiple accounts created to circumvent bans or to manipulate content (e.g. ratings), we store a cookie linked to the account and evaluate technical characteristics of shared devices. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting the platform and its members from abuse and manipulation.
You can delete your account at any time in the settings. After a period of 30 days, during which the deletion can be cancelled, your profile data and content are removed or anonymized.
We retain certain data beyond account deletion: the core account record, ban and moderation notes, block lists and mailbox contents. This serves to enforce bans that have been issued (preventing circumvention through re-registration) and to establish, exercise and defend legal claims. The legal basis is Art. 6 (1) (f) GDPR. The criterion for the retention period is the standard limitation periods under sections 195 and 199 of the German Civil Code (BGB).
Content you publish on Parfumo (ratings, statements, reviews, comments, forum posts, blog articles, collection details, uploaded images) is stored together with your username and the time of publication and displayed publicly. The legal basis is Art. 6 (1) (b) GDPR, as publication is the core of the community feature. The content remains stored until you delete it, it is removed through moderation, or your account is deleted.
So that reviews, statements and comments can also be read in the other language versions of Parfumo, we have published texts translated by machine. For this purpose we transmit the text (without your username or account data) to DeepL SE, Maarweg 165, 50825 Cologne, Germany, or to OpenAI. The contracting entity for OpenAI in the EEA is OpenAI Ireland Ltd., Dublin; processing may partly take place in the USA by OpenAI, L.L.C., which is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is making community content available across languages.
New forum posts and blog articles are automatically checked for spam characteristics; for this purpose, too, the text may be transmitted to OpenAI. Flagged posts are reviewed by us manually; no decision with legal effect is made solely by automated means. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting the community from spam.
Images you upload for a perfume are automatically checked for markers of AI generation (Content Credentials under the C2PA standard and the SynthID watermark) before publication. For this purpose we transmit the image file, without your username or account data, to OpenAI (contracting entity in the EEA: OpenAI Ireland Ltd., Dublin; processing may partly take place in the USA by OpenAI, L.L.C., which is certified under the EU-US Data Privacy Framework). If such a marker is found, the upload is refused automatically and the image is not stored by us; you can contact our support team in that case. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is publishing only genuine photos in our database.
Registered members can exchange private messages via the mailbox. Messages are stored until both participants have deleted them, subject to the retention described in section 5. The legal basis is Art. 6 (1) (b) GDPR.
To protect against fraud in connection with the marketplace (Souk), outgoing messages are automatically analyzed for characteristics such as payment addresses and known fraud patterns. Flagged matches are reviewed by us manually; no decision with legal effect is made solely by automated means. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting our members from fraud.
In the Souk, verified members can offer and purchase perfumes among each other. The purchase, including payment, is handled directly between the members; we are not involved in it. So that the buyer can make the payment, we store the payment details the seller has entered in their settings (e.g. IBAN, BIC, account holder or PayPal address) and show them to the respective buyer after a trade has been agreed. The legal basis is Art. 6 (1) (b) GDPR.
Participation requires a one-time verification, for which we collect your name and postal address and verify them via a letter code. The verification fee is processed via the payment provider Stripe (see section 15). The legal basis is Art. 6 (1) (b) GDPR; the verification also serves to protect all trading partners (Art. 6 (1) (f) GDPR).
To enforce our community rules, we process data in the course of moderation: reports from other members, complaint procedures, moderation notes on accounts, and warnings and bans issued. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting the community and operating a moderated platform. We retain ban records beyond account deletion as described in section 5.
To fend off automated access (scraping) and attacks, we use an IP-based filter that detects suspicious access patterns and temporarily blocks the IP addresses concerned. The legal basis is Art. 6 (1) (f) GDPR.
In the event of suspicious access behavior, we check IP addresses against and may report them to the AbuseIPDB service operated by Marathon Studios Inc., USA. This involves transferring the IP address to the USA. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is defending against attacks and automated abuse. Further information: https://www.abuseipdb.com/legal/privacy
If you contact us via the contact form, the support system or by email, we process your details to handle your request. The legal basis is Art. 6 (1) (b) GDPR or Art. 6 (1) (f) GDPR. Requests are deleted once they have been resolved and no retention grounds remain.
We send system emails (e.g. registration confirmations, notifications) via Amazon Simple Email Service provided by Amazon Web Services EMEA SARL, Luxembourg. Delivery takes place via an EU region (Stockholm). We have concluded a data processing agreement with AWS pursuant to Art. 28 GDPR. The legal basis is Art. 6 (1) (b) GDPR.
We display advertising to logged-out visitors. Advertising is sold programmatically via our advertising partner mso digital GmbH & Co. KG, Osnabrück, Germany (SYMPLR). In this process, advertising partners (including Google and other providers listed in our ads.txt and in the consent manager) may set cookies and process usage data including your IP address in order to deliver, personalize and measure ads. In addition, a pseudonymous recognition cookie (uniqueUser) with a lifetime of one year is set.
This processing only takes place with your consent, which is requested via the consent manager (Sourcepoint, IAB TCF). The legal basis is § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. The full list of advertising partners with their respective privacy notices can be found in the cookie settings, where you can also withdraw your consent at any time. No advertising is shown to logged-in members.
We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyze the use of the website. The information generated is usually transferred to Google servers, which may involve a transfer to the USA; Google LLC is certified under the EU-US Data Privacy Framework. Your IP address is truncated before processing.
Google Analytics is only used with your consent via the consent manager. The legal basis is § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the cookie settings. In addition, you can set an opt-out cookie that permanently prevents collection by Google Analytics: Disable Google Analytics.
We have concluded a data processing agreement with Google. Further information: https://support.google.com/analytics/answer/6004245?hl=en
On pages with perfumery maps we embed Google Maps, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open such a page, your IP address is transmitted to Google; if you are logged in to Google, Google may associate the visit with your account. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the convenient display of locations. Further information: https://policies.google.com/privacy
To protect forms (e.g. registration, password reset) from automated input, we use Cloudflare Turnstile from Cloudflare, Inc. Turnstile evaluates technical characteristics such as IP address, browser information and interaction data. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protection against spam and abuse. Further information: https://www.cloudflare.com/privacypolicy/
YouTube videos may be embedded on perfume pages and in members' posts. When you open a page with an embedded video, a connection to the YouTube servers (Google Ireland Limited) is established and your IP address is transmitted; if you are logged in to YouTube, Google may associate the visit with your account. The legal basis is Art. 6 (1) (f) GDPR. Further information: https://policies.google.com/privacy
Videos from the provider Vimeo are embedded on some perfume pages. When you open such a page, a connection to the servers of Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA is established and your IP address is transmitted. The legal basis is Art. 6 (1) (f) GDPR. Further information: https://vimeo.com/privacy
On perfume pages we display offers from partner shops. These links are so-called affiliate links: if you make a purchase at the shop after clicking, we receive a commission. The tracking for this (usually via cookies) only takes place after the click, by the respective affiliate network on its own domain, not by us on parfumo.com. When you click, the page you are coming from is transmitted for technical reasons.
Links to partner shops that members post in contributions and forums may also be converted into such affiliate links automatically.
We work with the following networks and partner programs: AWIN, CJ Affiliate, Rakuten Advertising, Adtraction, TradeDoubler, ADCELL (Firstlead GmbH), Webgains, Effiliation, the Douglas partner program, solute (billiger.de), the eBay Partner Network and the Amazon associates program of Amazon EU S.à r.l. Information on how these networks process data can be found in their respective privacy policies.
Donations and the Souk verification fee are processed via the payment provider Stripe. The provider for payments in the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you make a payment, the payment details you enter are processed directly by Stripe; we ourselves do not receive complete payment data. The legal basis is Art. 6 (1) (b) GDPR. Further information: https://stripe.com/privacy
For donations we also offer PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. When you pay via PayPal, your payment details are processed directly by PayPal. The legal basis is Art. 6 (1) (b) GDPR. Further information: https://www.paypal.com/webapps/mpp/ua/privacy-full
All transmissions between your browser and our servers are TLS-encrypted (recognizable by "https://" in the address bar). We store passwords exclusively in encrypted form.
We will update this privacy policy whenever our processing activities or legal requirements change. The version published here applies.
Last updated: September 2026