Effective: July 2026 | This Privacy Policy applies to the website and online store at www.7zen.de.
Herzkarten Service GmbH, Viktor-Frankl-Strasse 22, 86916 Kaufering
Managing Director: Andreas Emmert
Email: datenschutz@7zen.de
If you have any questions regarding the processing of your personal data, please contact us at the address listed above at any time.
We process the following categories of data:
Master data: Name, address, email address, phone number
Birth data: Date of birth, time of birth, place of birth (for personalized products and for the free 7zen star profile)
Payment data: Payment method, transaction ID (no full credit card details—these are processed exclusively by our payment service provider, Mollie)
Usage data: IP address, browser, operating system, pages visited, referrer, time spent on site
Communication data: Emails, support requests
Account data: Email, encrypted password, order history, saved astrology profiles
We process your data based on the following legal grounds in accordance with Art. 6(1) of the GDPR:
Article 6(1)(a) of the GDPR – Consent (e.g., newsletters, non-essential cookies)
Article 6(1)(b) of the GDPR – Performance of a contract (order, customer account)
Article 6(1)(c) of the GDPR – Legal obligation (accounting, tax law)
Article 6(1)(f) of the GDPR – Legitimate interests (website security, fraud prevention, marketing analysis, product recommendations to existing customers in accordance with Section 7(3) of the UWG)
When you visit our website, our hosting provider automatically stores the following data in server log files: IP address, date and time, URL accessed, amount of data transferred, HTTP status code, referrer URL, browser, and operating system.
Legal basis: Art. 6(1)(f) of the GDPR (legitimate interest in security and uninterrupted operation). Retention period: 14 days, followed by automatic deletion.
We use various types of cookies:
Technically necessary cookies: For session management, shopping cart, and login. No consent required (Art. 6(1)(b)/(f) GDPR).
Analytics cookies: Google Analytics (only with consent, Art. 6(1)(a) GDPR).
Marketing cookies: Meta Pixel, Google Ads, TikTok Pixel (only with consent, Art. 6(1)(a) GDPR).
You can adjust your cookie settings at any time via the cookie banner or reject all non-essential cookies.
When you register, we collect: name, email address, and password (stored in encrypted form). Legal basis: Article 6(1)(b) of the GDPR.
One-Time Password (OTP) Login: Upon request, we will send a time-limited one-time password via email. The code is stored as a hash and automatically expires after 15 minutes.
Retention period for account data: until the account is deleted by the user or by us, or until statutory retention periods expire.
To process your order, we process the following data: name, shipping address, email address, products ordered, and payment method. Legal basis: Article 6(1)(b) of the GDPR.
Payment processing via Mollie: Payments are processed by the payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands. Mollie processes your payment data in accordance with its own privacy policy: www.mollie.com/de/privacy. We receive only the transaction status and ID, not the full payment details.
Retention period: Order data is retained for 10 years in accordance with § 147 AO / § 257 HGB.
Our personalized products (astrology posters, star charts, coaching cards) are based on your birth data (date, time, place). This data is processed:
To fulfill the contract (Art. 6(1)(b) GDPR): Creation of the personalized product
Transfer to third parties for calculation: Your birth data is transferred to a specialized API service provider for astronomical calculations. This provider processes the data exclusively on behalf of and under the instructions of Herzkarten Service GmbH (data processing agreement pursuant to Art. 28 of the GDPR).
AI-powered text generation: To create personalized texts (e.g., coaching card content), we use a specialized AI service from a U.S. technology provider. The data transmitted includes the calculated astrological and numerological parameters (zodiac sign, houses, aspects, key figures) as well as your first name; for card sets intended for children, the age in years is also included. The following information is not transferred: last name, date of birth, time of birth, place of birth, address, email address, and payment details. Legal basis: Article 6(1)(b) of the GDPR. The transfer to the U.S. is based on standard contractual clauses pursuant to Article 46(2)(c) of the GDPR. Upon request, we will provide you with the name of the service provider in writing (datenschutz@7zen.de).
You can view and delete saved astrology profiles (personal data, calculated planetary constellations) at any time in your customer account.
Free 7zen Star Profile: You can create a free profile even without placing an order. To do so, we process your first name, date of birth, time of birth, and place of birth, as well as your email address for confirmation. The legal basis is Article 6(1)(b) of the GDPR (fulfillment of the user agreement regarding the provision of the profile). The astronomical calculation is performed by a data processor as described above. To confirm your email address, we will send you a one-time message; without confirmation, the profile will not be calculated. You can delete the profile at any time in your customer account.
Additional AI-powered content: Beyond personalization, we use AI-powered tools for the editorial preparation of website content (blog, knowledge base, glossary), translations, product images, and guided meditations. No personal data is processed in this context. A complete list can be found in Section 13 of our Terms and Conditions.
To produce your personalized print products, the generated PDF files and your shipping address are transmitted to our printing service provider. This transmission is based on Article 6(1)(b) of the GDPR within the framework of a data processing agreement.
To deliver your order, your name, shipping address, and, if applicable, email address and/or phone number are transmitted to the shipping service provider (e.g., DHL, DPD). Legal basis: Article 6(1)(b) of the GDPR.
With your explicit consent (Article 6(1)(a) of the GDPR, Section 7(2)(3) of the UWG), we send out a newsletter containing news and offers. Registration is carried out using the double opt-in procedure: After you register, you will receive an email with a confirmation link. To verify your consent, we store the time of registration and confirmation, the IP address used, and the confirmed text.
The management of your contact information, the selection of recipient groups, and the mailing process take place within our own system on our infrastructure. For the technical delivery of the emails, we use the Postmark service provided by ActiveCampaign, LLC, 1 North Dearborn Street, Chicago, IL 60602, USA, as a data processor in accordance with Art. 28 of the GDPR. Your email address and the content of the respective message are transmitted in this process. This applies to both the newsletter and system-generated emails such as order confirmations. Data is transferred to the United States based on the EU Commission’s Standard Contractual Clauses pursuant to Article 46(2)(c) of the GDPR, in conjunction with the provider’s certification under the EU-U.S. Data Privacy Framework.
Performance Tracking: Our newsletters contain a web beacon and links that are routed through our server. This allows us to determine whether and when an email was opened and which links were clicked. This analysis is based on your consent (Article 6(1)(a) of the GDPR), which you provide when you subscribe to the newsletter, and serves exclusively to tailor our content to the interests of our recipients. If you do not wish to have your engagement tracked, you can unsubscribe from the newsletter; separate use without tracking is not technically possible.
You can withdraw your consent at any time by clicking the unsubscribe link in any email or by sending an email to datenschutz@7zen.de. After you unsubscribe, we will remove your email address from the mailing list. We will then store it in a block list to reliably prevent you from receiving further mailings; this storage is carried out for your protection on the basis of Art. 6(1)(f) of the GDPR.
Following a purchase, you may occasionally receive recommendations from us via email for our own similar products, even if you have not subscribed to our newsletter. The legal basis is Article 6(1)(f) of the GDPR in conjunction with Section 7(3) of the German Unfair Competition Act (UWG); our legitimate interest lies in direct marketing for our own products that are comparable to your purchase. We inform you of this use when we collect your email address during the ordering process.
You may object to this use at any time and without providing a reason, without incurring any costs other than the transmission costs according to the standard rates. To do so, use the unsubscribe link in each of these emails or send your objection to service@7zen.de. The provisions described in Section 11 apply accordingly to delivery and performance measurement.
We use the following Google services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland:
Google Tag Manager: Manages other tracking tags; Google Tag Manager itself does not collect any personal data. Legal basis for loading tags: legitimate interest (Art. 6(1)(f) GDPR) regarding technically necessary tags; consent (Art. 6(1)(a) GDPR) for marketing/analytics tags.
Google Analytics 4: For analyzing website usage. We use IP anonymization; your IP address is truncated before being transmitted to Google. Data may be transferred to servers in the United States (Standard Contractual Clauses). Legal basis: Consent (Art. 6(1)(a) GDPR). You can opt out of data collection via the browser add-on: tools.google.com/dlpage/gaoptout.
Google Ads & Conversion Tracking: To measure the effectiveness of Google ads. If you arrive at our website via a Google ad, a cookie is set. Legal basis: Consent (Art. 6(1)(a) GDPR).
Transfer to a third country (the U.S.): Google LLC is certified under the EU-U.S. Data Privacy Framework; where applicable, supplemented by standard contractual clauses pursuant to Article 46(2)(c) of the GDPR.
Further information: policies.google.com/privacy
With your consent (Art. 6(1)(a) GDPR), we use the Meta Pixel provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. The pixel enables us to measure conversions and display advertising optimized for specific target audiences.
In addition, we transmit conversion events server-side via the Meta Conversions API. The data collected includes completed orders and the creation of a free 7zen star profile after you confirm your email address. Only hashed (SHA-256) data such as your email address and name, as well as technical identifiers (cookie IDs, IP address, browser ID), are transmitted—no plaintext data. This transfer occurs only if you have consented to the “Marketing” category; it does not take place without your consent.
Transfer to third countries: Data may be transferred to Meta Platforms, Inc. (U.S.). Meta is certified under the EU-U.S. Data Privacy Framework.
Opt-out: facebook.com/settings?tab=ads
With your consent (Art. 6(1)(a) GDPR), we use the TikTok Pixel provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland. It is used to measure conversions and to serve personalized TikTok ads.
Transfers to third countries: Data may be transferred to the United States and other countries. Legal basis: Standard contractual clauses.
Further information: tiktok.com/legal/privacy-policy
You have the right to have your customer account and all associated personal data deleted. Here’s how to proceed:
You can request deletion in your customer account under “Account Settings” or by emailing datenschutz@7zen.de.
You will receive a confirmation email with a one-time confirmation link (double opt-in to prevent misuse).
Once you confirm, the account will be flagged for deletion. The actual deletion will take place after 28 days (withdrawal period).
You can revoke the deletion at any time within the 28-day period.
What will be deleted: Account data (name, email, password), saved astrology profiles, addresses.
What is retained: Order data is retained in anonymized form for 10 years in accordance with statutory retention requirements (§ 147 AO, § 257 HGB). Order-related data is anonymized (no longer traceable to an individual).
You have the right to data portability. In your customer account, under “Account Settings,” you can download all your stored data (master data, astrology profiles, order history) as a JSON file.
We only disclose your data to the extent permitted by law or with your consent. Recipients may include:
Processors (Art. 28 GDPR): Hosting providers, payment service providers (Mollie), email marketing service providers (Postmark / ActiveCampaign, LLC, USA), printing service providers, astrology API providers, AI service providers (Anthropic/Claude)
Government authorities: When required by law (tax authorities, law enforcement agencies)
Marketing platforms (with your consent): Google, Meta, TikTok
No data is disclosed for other purposes or to other third parties.
Some of our service providers are based outside the EU/EEA (specifically the U.S.). Unless an adequacy decision has been issued by the European Commission, transfers are made on the basis of standard contractual clauses pursuant to Article 46(2)(c) of the GDPR. We will provide you with a copy of these clauses upon request.
Data CategoryRetention PeriodServer log files14 daysCustomer account dataUntil account deletionOrder data10 years (Section 147 AO / Section 257 HGB)Payment data10 years (Tax Law) Newsletter Consent Until revoked, then 3 years for record-keeping purposes Marketing Cookies / Tracking Until consent is revoked, max. 13 monthsOpen and click data from emails24 monthsBlock list after unsubscription / objectionPermanently, solely to prevent further mailingsFree Sternen profile (unconfirmed)Deleted if the email address is not confirmed
You have the following rights with respect to us:
Art. 15 GDPR – Right of Access: You may request information about the data we have stored.
Art. 16 GDPR – Right to Rectification: You may request that inaccurate data be corrected.
Art. 17 GDPR – Right to erasure: You may request the erasure of your data (see § 15).
Art. 18 GDPR – Right to Restriction of Processing: Under certain conditions, you may request that we restrict the processing of your data.
Art. 20 GDPR – Right to Data Portability: You may receive your data in a machine-readable format (see § 16).
Art. 21 GDPR – Right to Object: You may object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR). In the case of direct marketing, you have an absolute right to object.
Art. 7(3) GDPR – Withdrawal of Consent: You may withdraw any consent you have given at any time with future effect.
To exercise your rights, please contact: datenschutz@7zen.de
You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work, or the location of the alleged infringement.
Competent supervisory authority for our headquarters: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach