Privacy policy

Privacy Policy

Last updated: September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

ffount GmbH
Heumarkt 7
96047 Bamberg
Germany

Managing Director: Maximilian Neukum
Register court: Amtsgericht Bamberg (Local Court of Bamberg), HRB 9593
VAT ID: DE323804756

Phone: +49 951 120 929 27
Email: hello@sense5.me

A data protection officer is not legally required and has not been appointed. Please direct data protection inquiries to the email address above.

2. General information

2.1 Scope of data processing

We generally process our users' personal data only to the extent necessary to provide a functioning website as well as our content and services. Processing regularly takes place only with the user's consent or where processing is permitted by legal provisions.

2.2 Legal bases

Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary to perform a contract, Art. 6(1)(b) GDPR applies. Where processing is necessary to comply with a legal obligation, Art. 6(1)(c) GDPR applies. Where processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6(1)(f) GDPR serves as the legal basis.

2.3 Data erasure and storage period

The data subject's personal data will be erased or blocked as soon as the purpose of storage ceases to apply. Data may be stored beyond this if provided for by European or national laws to which the controller is subject. Data will also be blocked or erased when a storage period prescribed by these standards expires, unless there is a need for continued storage of the data.

3. Hosting and provision of the website

Our website is hosted on servers of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify is a provider of an e-commerce platform that enables us to operate our online shop.

When our website is accessed, Shopify collects various log files including your IP address. This serves the technical provision of the website and the security of our IT systems.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation and optimisation of our website.

A data processing agreement pursuant to Art. 28 GDPR is in place with Shopify. Shopify may also process data outside the EU, in particular in Canada and the USA. Details can be found in section 12.

Further information on data processing by Shopify can be found in Shopify's privacy policy: https://www.shopify.com/legal/privacy

4. Collection of general information when visiting the website

When our website is accessed, information of a general nature is collected automatically. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your internet service provider, your IP address, the referrer URL (the previously visited page), the sub-pages accessed as well as the date and time of access.

Processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

The data is not passed on or otherwise used. However, we reserve the right to review the server log files subsequently should specific indications point to unlawful use.

5. Cookies and consent management

Our website uses cookies. Cookies are small text files that are stored in or by the browser on your device when you visit a website. They serve to make our offering user-friendly. In addition to cookies, we use comparable technologies such as pixels and the browser's local storage mechanisms.

5.1 Technically necessary cookies

Some cookies are technically necessary so that certain functions of the website (in particular Shopify's cart and session management) work properly. Without these cookies, services you have expressly requested could not be provided.

Legal basis: Art. 6(1)(f) GDPR in conjunction with § 25(2)(2) TDDDG.

5.2 Cookies requiring consent

We only use cookies that are not technically necessary with your express consent, which you can give via our cookie banner when you first visit our website. This applies in particular to the analytics and marketing services described in section 7.

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or so that a notice always appears before a new cookie is created. Fully disabling cookies may, however, mean that you cannot use all functions of our website.

5.3 Cookie banner and withdrawal of your consent

To obtain and manage your consent, we use the cookie banner integrated in Shopify (Shopify consent management via the Customer Privacy API). When you first access our website, you can decide there which categories of cookies and services you agree to. Your selection is stored together with the time and scope of the consent so that we can demonstrate it.

Analytics and marketing services are only loaded and executed after you have given your consent. As long as no consent has been given, Google services are operated in what is known as consent mode (Google Consent Mode v2) without cookies and without identifiers.

You can withdraw or adjust your consent at any time with effect for the future by opening the cookie banner again via the corresponding link in the footer of our website. The lawfulness of the processing carried out up to the withdrawal remains unaffected. In addition, you can delete the cookies that have been set in your browser.

6. Shopify analytics functions

We use the analytics functions integrated in Shopify to analyse and regularly improve our website. Pseudonymised usage data is collected (including pages visited, time spent, anonymised IP address). This data is not combined with other personal data.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the needs-based design and statistical evaluation of our website.

Processing takes place on the basis of the data processing agreement with Shopify.

7. Web analytics, advertising and reach measurement

In order to evaluate and improve our website and our advertising, we use the services described below. All of these services are loaded exclusively after you have given your consent via the cookie banner. In each case the legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future (see section 5.3).

7.1 Google Tag Manager

We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager is a management interface through which we integrate and control the scripts and tags of the services listed below.

Tag Manager itself does not collect personal data for analytics purposes and does not set any cookies. It merely ensures that the services you have approved are triggered. For technical reasons, however, your IP address is transmitted to a Google server when the container is loaded.

The container is only loaded after you have given your consent via our cookie banner. The selection you make in the banner is passed on to Tag Manager, where it controls which tags may be executed.

Terms of use: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/
Google's privacy policy: https://policies.google.com/privacy

7.2 Google Analytics 4

We use Google Analytics 4, a web analytics service of Google Ireland Limited (address as under 7.1). Google Analytics uses cookies and comparable technologies that enable an analysis of your use of the website.

The data collected includes the pages accessed, the time spent, the origin of the visit (referrer), the device and browser used, the approximate location based on the truncated IP address as well as events such as viewing a product, adding to the cart, starting the checkout and a completed purchase including the order value.

IP addresses are truncated by Google Analytics 4 within the EU or the EEA before they are processed further. The full IP address is not stored. Data collected at user level is automatically deleted after no more than 14 months.

The purpose of the processing is the statistical evaluation of website use so that we can design our offering and our marketing activities according to demand.

In addition to withdrawing your consent via our cookie banner, you can permanently prevent collection by Google Analytics by installing the following browser add-on: https://tools.google.com/dlpage/gaoptout

Further information: https://support.google.com/analytics/answer/12017362 and https://policies.google.com/privacy

7.3 Google Ads: conversion tracking and remarketing

We place ads in Google's advertising network and use Google Ads for this purpose, a service of Google Ireland Limited (address as under 7.1).

If you reach our website via one of our ads, Google sets a cookie for conversion tracking. This allows us to see whether an ad led to an order or another action defined by us. We receive only aggregated statistics from Google, no information that would allow individual users to be identified.

With remarketing, your browser is recognised when you visit other websites in the Google advertising network. On this basis we can show you ads there relating to products you viewed previously.

Where we use enhanced conversions, we transmit details from an order, in particular your email address, to Google exclusively in encrypted form (hashing). This information serves solely to match it against existing Google accounts.

The advertising cookies set by Google generally expire after 90 days.

Independently of our cookie banner, you can deactivate personalised advertising from Google in your Google settings: https://myadcenter.google.com/

7.4 Meta Pixel and Conversions API

On our website we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).

The Meta Pixel records your actions on our website, such as page views, products viewed, adding to the cart, starting the checkout and completed purchases including the order value. These events are transmitted to Meta. If you are also logged in to Facebook or Instagram, Meta can assign the events to your account there.

Meta is integrated technically via the Shopify sales channel “Facebook & Instagram”. The data sharing level set there is “Enhanced”. In addition to the pure event data, we therefore also use enhanced matching: details you enter with us or provide when placing an order are transmitted to Meta as well. This concerns email address, first and last name, telephone number, city, postal code, region and country as well as a pseudonymous customer identifier. These details are made unrecognisable by a hashing procedure before transmission. Meta matches the hash values against existing accounts in order to assign your actions on our website to an account and to attribute purchases to an ad more accurately.

Via the Conversions API we additionally transmit the same events to Meta on the server side. Details such as email address, first and last name, address, telephone number, IP address and browser identifier may be processed in this context. Personal details are encrypted using a hashing procedure before transmission and serve solely to match them against existing Meta accounts.

The Meta Pixel, enhanced matching and the Conversions API are only triggered if you have consented to marketing cookies via our cookie banner. If you withdraw your consent, no further transmission to Meta takes place.

The purpose is to measure the effectiveness of our ads and to build audiences for further advertising. This includes addressing visitors to our website again in advertising campaigns (custom audiences) and Meta addressing users with similar behaviour on the basis of this audience (lookalike audiences). We ourselves have no access to individual profile data, only to aggregated evaluations.

For the collection and transmission of the data to Meta, we are joint controllers together with Meta within the meaning of Art. 26 GDPR. The allocation of obligations follows from the Controller Addendum: https://www.facebook.com/legal/controller_addendum. Among other things, it stipulates that Meta is responsible for the security of the processing and for handling data subject rights under Art. 15 to 20 GDPR. You can therefore address requests for information and erasure directly to Meta. Meta is solely responsible for the further processing of the data in Meta's systems.

Independently of our cookie banner, you can deactivate personalised advertising in the ad settings of your Meta account: https://www.facebook.com/settings?tab=ads

You can view which activities Meta has received from our website in your Meta account under “Off-Facebook activity”, delete them there and disconnect them from your account for the future: https://www.facebook.com/off_facebook_activity/

Meta's privacy policy: https://www.facebook.com/privacy/policy

7.5 TikTok Pixel

We use the TikTok Pixel on our website. For users in the European Economic Area, the controllers are TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited (together “TikTok”).

The TikTok Pixel records your actions on our website, such as page views, products viewed, adding to the cart and completed purchases including the order value, and transmits them to TikTok. Technical details such as IP address, browser and device information as well as a cookie identifier are also processed. Where we use advanced matching, details such as email address or telephone number are additionally transmitted exclusively in encrypted form (hashing).

The purpose is to measure the effectiveness of our ads on TikTok and to build audiences for further advertising. We ourselves have no access to individual profile data, only to aggregated evaluations.

Insofar as we decide together with TikTok on the purposes and means of the collection and transmission, we are joint controllers within the meaning of Art. 26 GDPR. TikTok is solely responsible for the further processing of the data in TikTok's systems. You can therefore also address requests for information and erasure directly to TikTok.

TikTok also processes personal data outside the European Union, including in the United Kingdom, the USA and Singapore; access from further countries cannot be ruled out. For the United Kingdom, an adequacy decision by the European Commission exists (Art. 45 GDPR). For the other countries, transfers are based on the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

Independently of our cookie banner, you can deactivate personalised advertising in the settings of your TikTok account. TikTok's privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en

8. Orders and contract processing

8.1 What data we process

When you place an order in our online shop, we process the data we need to perform the purchase contract:

• first and last name
• billing and delivery address
• email address
• telephone number, if you provide one
• items ordered, order number, order date and order value
• the payment method chosen and the details required for payment
• IP address and time of the order

No registration is required in order to place an order.

8.2 Purposes and legal bases

We process this data in order to accept your order, ship the goods, process payment, issue an invoice and handle queries, withdrawals, returns and warranty cases.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract and implementation of pre-contractual measures). Where we retain order and invoice data beyond this in order to comply with commercial and tax law obligations, the legal basis is Art. 6(1)(c) GDPR.

Providing this data is necessary for the conclusion of the contract. Without it we cannot carry out your order.

8.3 Payment processing

We use the following providers for payment processing:

• Shopify Payments, offered by Shopify International Limited (address as under section 3). Credit and debit card payments as well as Apple Pay, Google Pay and Shop Pay, among others, are processed through this service.
• PayPal, offered by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If you select one of these payment methods, the data required for payment – including name, address, invoice amount, order number and the payment details – is transmitted to the respective provider. We do not receive complete card details; these are processed directly by the payment service provider.

The payment service providers process part of the data under their own responsibility, in particular for fraud prevention and to comply with legal obligations. The legal basis for the transmission is Art. 6(1)(b) GDPR; insofar as the providers' own purposes are concerned, Art. 6(1)(f) GDPR (legitimate interest in secure payment processing free from misuse).

8.4 Shipping

In order to deliver your order, we pass on your name and delivery address to the shipping company commissioned by us. If you have provided an email address or a telephone number and the shipping company needs these for parcel tracking or delivery notification, we also transmit that information. The legal basis is Art. 6(1)(b) GDPR.

8.5 Invoicing and retention

We retain invoices and the associated order data in order to comply with commercial and tax law obligations. The retention periods are six years under § 257 HGB (German Commercial Code) and ten years under § 147 AO (German Fiscal Code), in each case calculated from the end of the calendar year in which the order was completed. For the duration of the retention period we restrict the processing; the data is no longer used for other purposes. The legal basis is Art. 6(1)(c) GDPR.

8.6 Order-related emails

In connection with your order we send you transactional emails, such as the order confirmation, the shipping confirmation and the invoice. These messages form part of the performance of the contract and are not advertising. You receive them regardless of whether you have subscribed to our newsletter. The legal basis is Art. 6(1)(b) GDPR.

9. Contacting us

9.1 Contact form

A contact form is available on our website through which you can send us messages. The data you enter in the form (name, email address, message) is stored by us to process your inquiry and in case of follow-up questions.

The legal basis is Art. 6(1)(b) GDPR, provided your inquiry is aimed at the performance of a contract or the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of the inquiries addressed to us pursuant to Art. 6(1)(f) GDPR.

Your details will be erased no later than six months after the final processing of your inquiry, unless statutory retention obligations preclude this.

9.2 Contact by email

If you contact us by email, your details including the contact data you provide will be stored by us for the purpose of processing your inquiry. Processing takes place on the same legal bases as described under 9.1.

10. Newsletter and email marketing (Klaviyo)

10.1 Description and scope

Our website offers the option to subscribe to our newsletter. For sending our newsletter and for automated email communication (e.g. the delivery of our Ritual Guide), we use the service Klaviyo, offered by Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA.

When you sign up for the newsletter, the data you enter (email address, and where applicable first and last name) is transmitted to Klaviyo and stored there. Klaviyo processes this data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

In addition, statistical information about the use of the newsletters (e.g. open and click rates) is collected. This helps us measure interest in the content and improve our offering.

10.2 Double opt-in and logging

Subscription to our newsletter takes place using the so-called double opt-in procedure. After you sign up, you will receive an email asking you to confirm your subscription. You will only be added to our distribution list after confirmation. The time of sign-up, the time of confirmation and the IP address are logged in order to be able to prove consent.

10.3 Legal basis and revocation

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

You can revoke your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out up to the revocation. To revoke, an informal notification by email to hello@sense5.me or a click on the unsubscribe link contained in every newsletter email is sufficient.

10.4 Storage period

Your email address is stored for the duration of your subscription and erased after unsubscribing or revocation, unless statutory retention obligations preclude this.

10.5 Data transfer to the USA

Klaviyo is a US provider. A transfer of personal data to the USA takes place. Klaviyo, Inc. is certified under the EU-US Data Privacy Framework and thereby offers an adequate level of data protection pursuant to Art. 45 GDPR.

Further information on data processing by Klaviyo can be found at: https://www.klaviyo.com/legal/privacy

11. Prize draws

If we run prize draws on our website or as part of our pre-launch activities, the data you provide when taking part (e.g. name, email address) is processed exclusively to run the prize draw, to notify any winners and, where necessary, to deliver a prize.

The legal basis is Art. 6(1)(b) GDPR (performance of the participation contract) and, where consent has been given (e.g. for an additional newsletter subscription), Art. 6(1)(a) GDPR.

After the prize draw has ended, the data is erased unless statutory retention obligations exist or a separate consent (e.g. newsletter) justifies further processing. The respective terms of participation contain supplementary information on the specific prize draw.

12. Recipients of data and third-country transfer

12.1 Processors and other recipients

We only pass on your personal data to carefully selected service providers who support us in providing our services. A data processing agreement pursuant to Art. 28 GDPR is in place with each of these service providers insofar as they act on our behalf. We currently use the following service providers:

• Shopify International Limited (Ireland) – e-commerce platform, hosting and payment processing (Shopify Payments)
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) – payment processing where the PayPal payment method is selected
• the shipping company commissioned with delivery in each case – delivery of your order; the shipping company processes the transmitted data under its own responsibility
• Klaviyo, Inc. (USA) – email marketing and marketing automation
• Google Ireland Limited (Ireland) – tag management, web analytics and advertising (Google Tag Manager, Google Analytics 4, Google Ads)
• Meta Platforms Ireland Limited (Ireland) – reach measurement and advertising (Meta Pixel, enhanced matching, Conversions API); joint controllership pursuant to Art. 26 GDPR applies to the collection and transmission of the data, see section 7.4
• TikTok Technology Limited (Ireland) – reach measurement and advertising (TikTok Pixel); joint controllership pursuant to Art. 26 GDPR applies to the collection and transmission of the data, see section 7.5

12.2 Data transfer to third countries

Some of the service providers we use process personal data outside the European Union. This concerns in particular:

• Canada: Shopify server locations. An adequacy decision by the European Commission exists for Canada (Art. 45 GDPR).
• USA: Shopify and Klaviyo server locations as well as transfers to Google LLC and Meta Platforms, Inc. These companies are certified under the EU-US Data Privacy Framework (EU Commission implementing decision of 10 July 2023), so that an adequate level of data protection pursuant to Art. 45 GDPR is ensured.
• Other third countries: TikTok processes personal data in, among others, the United Kingdom, the USA and Singapore. For the United Kingdom an adequacy decision by the European Commission exists (Art. 45 GDPR); for the other countries the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR apply.

In addition, the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR apply.

Despite these safeguards, it cannot be completely ruled out that US authorities may access transmitted data. By consenting to the services described in section 7, you also consent to this transfer (Art. 49(1)(a) GDPR).

13. Your rights as a data subject

You have the right:

• pursuant to Art. 15 GDPR to request information about your personal data processed by us;
• pursuant to Art. 16 GDPR to request without undue delay the rectification of inaccurate or the completion of your personal data stored by us;
• pursuant to Art. 17 GDPR to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
• pursuant to Art. 18 GDPR to request the restriction of the processing of your personal data;
• pursuant to Art. 20 GDPR to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller;
• pursuant to Art. 7(3) GDPR to revoke your consent once given at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future;
• pursuant to Art. 21 GDPR to object to the processing where it is based on Art. 6(1)(e) or (f) GDPR. This applies in particular to processing for the purposes of direct marketing.

To exercise your rights, an informal notification by email to hello@sense5.me or by post to the address stated under point 1 is sufficient.

14. Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data is unlawful.

The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Phone: +49 981 180093-0
Email: poststelle@lda.bayern.de
Web: https://www.lda.bayern.de

You may also contact another supervisory authority in the EU member state of your residence, your place of work or the place of the alleged infringement.

15. Data security

We use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorised access by third parties. Our website is provided via SSL/TLS encryption, recognisable by the padlock symbol in your browser's address bar and the “https://” prefix.

16. Currency and amendment of this privacy policy

This privacy policy is currently valid and dated September 2026.

Due to the further development of our website and offerings, or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed and printed at any time on the website at www.sense5.me.