Privacy Policy

Last updated: 10 October 2026

1. Who is responsible for your personal data?

The controller responsible for personal data processed by TWO CONJUNCT is Bianca Brooke Werth, trading as TWO CONJUNCT, Jakob-Rullmann-Straße 7, 63628 Bad Soden-Salmünster, Germany. For privacy enquiries or to exercise your rights, contact email@twoconjunct.com.

This policy covers our website at twoconjunct.com, associated TWO CONJUNCT sales pages, customer communications, physical-product orders, digital downloads and individually prepared readings. It explains the purposes and legal bases of processing, the recipients of information, retention and your rights. It is an information notice, not a request for blanket consent. Visiting the website or accepting our Terms and Conditions does not itself constitute consent to tracking, newsletters or other processing requiring consent.

2. The information we process

Depending on your interaction with us, we process identifying and contact information such as your name, email address and postal address; order information such as products, selected variants, price, payment status and transaction references; messages and information you submit in forms; and technical information necessary to provide and protect our website.

For an individual reading, we process the details requested for the selected product. These may include your birth date, birth time, birthplace and answers relevant to the reading. Such information is personal data even where it is not accompanied by your full name. We use it for the agreed reading and related customer support, not as a general authorisation for advertising or unrelated uses.

Please do not submit health information, religious or philosophical beliefs, sexual information or other special-category data unless we specifically request it through a process that provides the required additional information and lawful basis. Purchasing a reading does not, by itself, constitute explicit consent to process all such information under Article 9 GDPR. If such data is required for a particular offer, we provide the applicable information and obtain any legally required explicit consent before processing it. Please provide another person's data only where you are entitled to do so; the applicable legal basis and information duties must also cover that person.

3. Visiting the website and hosting

Our website is hosted using Hostinger services. To deliver pages and maintain security, the hosting infrastructure processes technical connection data, which can include your IP address, the date and time of a request, requested pages, browser and operating-system information, referring page and error or security records. An IP address can be personal data; visiting without entering your name does not mean no personal data is processed.

This processing supports delivery, stability, troubleshooting and protection against misuse. Where based on legitimate interests, the basis is Article 6(1)(f) GDPR; the relevant interests are operating a reliable website and protecting visitors and our systems. Processing necessary for a requested transaction may additionally fall under Article 6(1)(b) GDPR.

Hosting recipient: Hostinger, [INSERT THE CONTRACTING HOSTINGER ENTITY AND ADDRESS SHOWN IN YOUR ACCOUNT OR AGREEMENT]. Hosting location and relevant international-transfer arrangements: [INSERT THE ACTUAL HOSTING LOCATION AND APPLICABLE TRANSFER INFORMATION]. Routine server-log retention: [INSERT THE ACTUAL RETENTION PERIOD OR SPECIFIC DELETION CRITERIA]. Logs needed to investigate a specific security incident may be retained for the time necessary for that investigation and related legal claims.

Hostinger's privacy information is available at https://www.hostinger.com/legal/privacy-policy. Its data-processing terms are available at https://www.hostinger.com/legal/dpa. These provider documents supplement, rather than replace, information about our own use of the service.

4. Contact enquiries and customer communication

When you email us or use a contact form, we process your contact details, message and attachments to respond and handle follow-up questions. Enquiries concerning a purchase or prospective purchase are processed under Article 6(1)(b) GDPR. Other enquiries are generally processed under Article 6(1)(f) GDPR, based on our interest in responding to communications and managing our business. A legal obligation may provide a separate basis under Article 6(1)(c) GDPR where applicable.

Email and form-service recipients: [INSERT THE ACTUAL EMAIL AND CONTACT-FORM PROVIDERS, THEIR ROLES AND RELEVANT INTERNATIONAL-TRANSFER INFORMATION]. Messages are retained according to the purpose of the enquiry and the retention criteria in section 12. A message does not automatically subscribe you to marketing.

5. Orders, payments and refunds

We process the information necessary to accept and fulfil your order, provide downloads or readings, send confirmations, manage deliveries and handle withdrawals, refunds and complaints. The legal basis is Article 6(1)(b) GDPR. Accounting and other legally required records are processed under Article 6(1)(c) GDPR. Where necessary to establish, exercise or defend legal claims or prevent abuse, processing may be based on Article 6(1)(f) GDPR, with our interests limited to those purposes.

Payment is processed through Stripe. Depending on the selected payment method, Stripe and the relevant payment participants process identifying, transaction and payment details, as well as technical and fraud-prevention information. We receive the transaction information necessary to administer the order, such as payment status and references. Your full payment credentials should be entered into the payment interface, not sent to us by email.

The applicable Stripe entities and other payment participants depend on our account and your payment method. Provider details: [INSERT THE STRIPE ENTITY OR ENTITIES APPLICABLE TO THE ACTUAL INTEGRATION]. Stripe may act as a processor for some activities and as an independent controller for others, including its own compliance and risk-management purposes. Further information is available at https://stripe.com/privacy and https://stripe.com/legal/dpa. Any provider decisions affecting your payment are explained under the relevant provider's information; this policy does not waive your rights concerning automated decisions.

Providing the information marked as required at checkout is necessary for the requested order. Without necessary payment, contact or delivery information, we may be unable to conclude or perform the contract. Information not required for the order is identified as optional where collected.

6. Production and direct shipping through Spreadshirt

For physical-product orders, we place the production order with Spreadshirt, sprd.net AG, Gießerstraße 27, 04229 Leipzig, Germany, and arrange direct delivery to the recipient's address. We transfer the information necessary for that fulfilment, particularly the recipient's name, delivery address and the ordered product and variants. Spreadshirt uses shipping carriers and other relevant fulfilment participants, who receive the information necessary for their tasks.

Where necessary to perform our purchase contract with you, our transfer is based on Article 6(1)(b) GDPR. A separate consent checkbox is not required solely for that necessary transfer. Where the delivery recipient is another person, the processing of that recipient's information requires its own applicable basis and information arrangements; the purchaser's contract does not automatically constitute a contract with the recipient.

Only information required for the production and delivery is transferred for this purpose. Information supplied for readings is not part of the shipping order. Accepting our terms does not authorise independent marketing to you by Spreadshirt. Further information about Spreadshirt's processing is available at https://www.spreadshirt.de/datenschutz.

TWO CONJUNCT remains your seller and contact for the order, returns and refunds. Privacy responsibilities depend on the actual processing arrangement and are not transferred merely because a parcel is sent by another company.

7. Digital downloads and Google Drive

Ready-made PDF products such as Rising Sign Blueprints are made available for download after successful payment. We process order and delivery information to provide access and resolve download problems, under Article 6(1)(b) GDPR.

PNG bundles are stored on Google Drive and supplied through a link sent after purchase. No Google sign-in is required for the intended download access. Opening the link connects your browser to Google's service. Google can process technical connection and usage information, such as IP address, browser information and request time, even when you are not signed in. If you choose to use the service while signed in, Google's account-related processing may also apply.

The applicable Google provider is [INSERT THE ENTITY AND ROLE APPLICABLE TO THE GOOGLE DRIVE ACCOUNT USED FOR DISTRIBUTION]. Google's privacy information is available at https://policies.google.com/privacy. Our use of Drive to provide the purchased bundle serves fulfilment of the contract under Article 6(1)(b) GDPR; Google's independent purposes and legal bases are described in its own notice.

The shared bundle folder is intended to contain the purchased product files, not other customers' contact details, birth information or individual readings. Sending a download link does not itself require us to add your email address to a publicly visible sharing list. The applicable provider arrangement and any international transfers are described in section 11 and must reflect the actual account configuration.

8. Individual readings and external preparation tools

You provide the information required for your selected reading during checkout. We use it to prepare the reading personally and deliver the result to the email address you supplied. The basis for information objectively necessary to fulfil that contract is Article 6(1)(b) GDPR. Optional additional processing requires an appropriate separate basis. Missing necessary reading details may prevent us from preparing the agreed product.

External tools used in preparation or delivery must be identified in the following disclosure:

Service and recipientInformation suppliedPurpose and legal basisProvider role, retention and international transfers[INSERT EACH ACTUAL READING OR AI TOOL AND ITS PROVIDER][SPECIFY WHETHER BIRTH DETAILS, CUSTOMER ANSWERS, NAMES OR READING TEXT ARE SUPPLIED][SPECIFY THE ACTUAL PURPOSE AND APPLICABLE BASIS; DO NOT ASSUME ALL TOOL USE IS NECESSARY FOR THE CONTRACT][SPECIFY THE ACTUAL ACCOUNT TERMS, PROCESSOR OR CONTROLLER ROLE, RETENTION, TRAINING USE AND TRANSFER SAFEGUARD]

Any required consent for a particular tool or additional purpose is requested separately and can be withdrawn for future consent-based processing. This policy and acceptance of our Terms and Conditions do not grant blanket permission to submit personal data to any AI service or permit that service to use it for its own model training. Removing a name alone does not necessarily make birth information or a detailed personal story anonymous.

Reading information and the resulting content are retained only for the purposes and periods explained in section 12. We do not publish a personal reading as a testimonial or marketing example merely because it was purchased; any such publication requires an appropriate separate lawful basis.

9. Cookies, analytics and advertising technologies

Cookies, local storage, pixels and similar technologies can store information on your device or access information already stored there. The relevant rules apply to more than cookies alone.

Technologies strictly necessary to provide a service you expressly request may be used without consent under section 25(2) TDDDG where its conditions are met. Subsequent processing of personal data also needs an applicable GDPR basis, such as Article 6(1)(b) or Article 6(1)(f), depending on the purpose.

Non-essential analytics, advertising or other device access requiring consent is subject to your prior consent under section 25(1) TDDDG. Consent-based processing of personal data relies on Article 6(1)(a) GDPR. Visiting the site, continuing to browse or accepting required cookies does not automatically constitute consent to optional technologies or third-party marketing.

The services actually used must be disclosed here and in the consent interface:

Service or technology and providerPurpose and data processedConsent or applicable exceptionDuration and recipients or international transfers[INSERT NECESSARY TECHNOLOGIES ACTUALLY USED BY THE WEBSITE AND CHECKOUT][INSERT SPECIFIC PURPOSES AND DATA][INSERT THE APPLICABLE NECESSITY EXCEPTION AND GDPR BASIS][INSERT SESSION OR EXPIRY PERIODS AND RECIPIENT INFORMATION][INSERT EACH ACTIVE ANALYTICS OR ADVERTISING SERVICE][INSERT DATA, IDENTIFIERS, EVENTS AND ANY PROFILE OR CONVERSION USE][INSERT THE APPLICABLE CONSENT REQUIREMENTS AND ANY DIFFERENT BASIS THAT HAS BEEN SPECIFICALLY ASSESSED][INSERT RETENTION, PROVIDER DETAILS AND ACTUAL TRANSFER SAFEGUARD]

You can review or withdraw optional consent through [INSERT THE ACTUAL LOCATION OF THE COOKIE-SETTINGS FUNCTION]. Withdrawal does not affect the lawfulness of processing before withdrawal. Browser settings can additionally restrict cookies, but they do not replace our obligations to obtain consent where required. Refusing optional tracking does not itself require you to give up access to unrelated essential functions.

10. Marketing email and external links

Order confirmations, download links, reading delivery and messages about your purchase are transactional communications, not a subscription to a newsletter.

Marketing-email processing, if operated, must be described before collecting a subscription: [CONFIRM WHETHER A NEWSLETTER IS ACTIVE; IF YES, INSERT ITS PROVIDER, DATA, CONSENT PROCEDURE, UNSUBSCRIBE METHOD, RETENTION, ANY OPEN OR CLICK TRACKING AND INTERNATIONAL TRANSFERS; IF NO, REMOVE THIS PLACEHOLDER PARAGRAPH]. Consent to receive email marketing does not automatically cover every form of tracking within those emails.

Ordinary external links take you to another provider's website when you follow them. That provider's privacy information then applies to its own processing. This does not remove our responsibility for personal data we ourselves transfer or for services we embed within our pages. Embedded media, remotely loaded fonts, affiliate tracking and social-media technologies, if used, must be described under the relevant actual services rather than assumed to be covered by a general link disclaimer.

11. Recipients and international transfers

Data is disclosed where necessary for the purposes described above, to relevant hosting, email, payment, fulfilment, download and specifically identified preparation or tracking providers. Professional advisers or authorities may receive information where required by law or necessary on an assessed lawful basis to handle accounting, a dispute or legal proceedings. We do not authorise unrestricted disclosure merely because a third party requests it.

Where a provider processes personal data on our behalf, the required arrangements under Article 28 GDPR must govern that processing. Where a provider determines its own purposes, its independent responsibilities also apply. If processing is jointly determined, the applicable Article 26 arrangements and their essential information must be provided. A provider's general statement that it complies with GDPR does not resolve these obligations.

Some services or international deliveries may involve processing outside the European Economic Area. The actual country and transfer mechanism must be identified for each relevant flow. Where applicable, a transfer can rely on an adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses with necessary supplementary measures. A recognised framework applies only to a recipient and processing covered by that mechanism; it is not a blanket exemption for every US provider.

Actual provider and country details and safeguards: [COMPLETE THE SERVICE-SPECIFIC TRANSFER INFORMATION IN SECTIONS 3, 4, 5, 7, 8, 9 AND, IF APPLICABLE, 10]. Necessary address transfers for international delivery must likewise be assessed for the particular destination and recipient. Information about applicable safeguards, and a copy where legally available, can be requested at email@twoconjunct.com. This section does not itself create a lawful transfer mechanism.

12. How long information is retained

We retain personal data for the period necessary for its particular purpose, unless a specific legal retention obligation or a justified need to establish, exercise or defend claims requires longer retention. We separate accounting records from information that is not needed for accounting; a duty to retain an invoice does not automatically justify retaining every birth detail or personal narrative.

Order, payment and invoice records are retained for applicable German accounting and tax periods. Where section 147 AO applies, retention generally depends on the document category: accounting vouchers for eight years, business correspondence for six years, and specified books and records for ten years, calculated under the relevant statutory rules. Applicable exceptions or ongoing proceedings can extend retention. These periods do not apply indiscriminately to all customer data.

For individual-reading source information and completed reading files, the actual retention is [INSERT THE DELETION PERIOD OR SPECIFIC CRITERIA AFTER DELIVERY, SUPPORT AND ANY NECESSARY CLAIMS HANDLING]. For general enquiries, the actual retention is [INSERT THE PERIOD OR SPECIFIC CRITERIA AFTER THE ENQUIRY HAS BEEN RESOLVED]. Necessary evidence concerning a dispute is retained for the relevant limitation period and any pending proceedings, restricted to what is required.

Server logs, analytics information, consent evidence and marketing information follow the specific periods stated for those activities. Where a small suppression record is necessary to respect an unsubscribe request or objection, it is limited to that purpose. Deletion from backup systems follows the applicable backup cycle, with access limited and restoration controls intended to prevent deleted information from returning to ordinary use: [INSERT THE ACTUAL BACKUP-DELETION CYCLE WHERE RELEVANT].

13. Your rights

Where GDPR applies and its conditions are met, you have rights of access, rectification, erasure, restriction of processing and data portability. These rights are not limited merely to people described as European residents. You may withdraw consent at any time for future processing without affecting the lawfulness of previous processing.

You have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR, including profiling based on those grounds. If you object, we will stop that processing unless the applicable legal conditions allow it to continue. You may object to processing for direct marketing at any time, including associated profiling; that processing will then stop.

You also have the rights applicable to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. A personally written reading is not, merely by being a reading, a solely automated decision of that kind. Any qualifying automated decision in our own process must be specifically explained, together with its basis, significance, envisaged consequences and safeguards: [CONFIRM WHETHER ANY SUCH DECISION EXISTS; IF NONE, REPLACE THIS PLACEHOLDER WITH THAT FACT].

Contact email@twoconjunct.com to exercise your rights. We may request proportionate additional information where reasonably necessary to verify identity. We respond within the legally applicable period, normally one month after receipt, subject to the conditions for extensions under Article 12 GDPR. We explain any lawful refusal or limitation and your available remedies.

You may complain to a competent supervisory authority, particularly in the country of your habitual residence, place of work or alleged infringement. Our local authority is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Postfach 3163, 65021 Wiesbaden, Germany. Contact and complaint information: https://datenschutz.hessen.de. You do not have to contact us first to lodge a complaint.

14. Security and changes to this policy

We are responsible for implementing technical and organisational measures appropriate to the risks of the actual processing under Article 32 GDPR. Such measures must address confidentiality, access control, availability and secure handling of customer data. No website or provider can guarantee absolute security; this does not remove our legal responsibilities or duties concerning a personal-data breach.

We update this notice when our actual processing or legal requirements change. The date above indicates the latest revision. A policy update does not authorise a new purpose without an appropriate lawful basis or replace a consent that must be separately obtained. For privacy questions, contact email@twoconjunct.com.