Privacy
What we hold, and why
NOCTIS holds the minimum needed to make a fragrance and send it to you. There is no advertising network on this site, no behavioural profile behind your account, and nothing is sold or shared for anyone else's purposes.
Who is responsible
The controller is Luca-Max Liebenberg, Wahlstedt, Germany. The postal address is on the imprint. Questions about this notice, and any request under the clauses below, go to l.liebenberg@opti-rail.de and are answered within one month.
Your order
Name, delivery address, telephone number, email address, order contents and payment reference. The legal basis is performance of the contract; without these there is no order.
Invoices and the order record are kept for ten years, which is the retention period section 147 of the German Fiscal Code requires. That obligation overrides a request for erasure for the duration; everything not covered by it is deleted on request.
In plain terms: Name, address, telephone, email and what you bought. We need it to send you a bottle and to keep the books.
Your account
Email address, name, telephone number, delivery addresses, saved fragrances and the invitation code the account was opened with. The legal basis is performance of the contract. The account is deleted on request, subject to the retention obligation above.
Saved fragrances are a list you keep. They are not used to recommend anything to you, are not used to build a profile, and are visible to nobody but you.
Payment
Card data is collected and processed by the payment provider under its own controllership. NOCTIS receives an authorisation reference, the last four digits and the card scheme, and nothing else. For SEPA transfers, the bank reference appears on the account statement and is retained with the invoice.
This website
The site stores your cart and, if you sign in, your session in this browser’s local storage. Both are strictly necessary for the service you asked for and neither requires consent. Neither leaves your device except as part of an order you place.
There is no analytics package, no advertising pixel, no session recording and no third-party script of any kind on this site. Web server access logs, which contain the requesting IP address, are kept for seven days for security and are then discarded.
In plain terms: One cookie, which remembers your cart. No analytics, no advertising, no tracking.
Who else sees it
Three categories of processor, each under a contract restricting them to our instructions: the payment provider, the carrier that delivers the parcel, and the hosting provider that runs this site. Names and locations are supplied on request.
Nothing is transferred outside the European Economic Area. Nothing is sold, and nothing is shared with anyone for their own purposes.
What you can require
Access to everything held about you, correction of anything wrong, erasure of anything not covered by a retention obligation, restriction of processing, portability of the data you provided, and objection to any processing based on legitimate interests.
A request is answered within one month and costs nothing. You may also complain to the competent supervisory authority: Unabhaengiges Landeszentrum fuer Datenschutz Schleswig-Holstein, Holstenstrasse 98, 24103 Kiel, Germany.
Changes to this notice
The version and date below change whenever this notice does. Where a change materially affects how your data is used, account holders are told by email before it takes effect.
Version 2 · in force from 1 March 2025