1. Controller

The controller responsible for data processing on this website is: Margaux Huth, The Understory Club, Feldbrunnenstrasse 7, 20149 Hamburg, Germany (“we”). E-mail: margaux@canopy-cities.com

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Overview

We process personal data only where necessary to provide the website, to manage your subscription, or on the basis of your consent. The legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (contract), (c) (legal obligation) and (f) (legitimate interests).

3. Hosting and server log files

This website is hosted by Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland. When you visit the website, data transmitted by your browser is processed automatically: IP address, date and time, page visited, referrer URL, browser type and operating system. This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with the provider under Art. 28 GDPR. 

4. Cookies

We only use technically necessary cookies, for example for the shopping cart and checkout (§ 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR). 

5. Contacting us

If you contact us by e-mail, phone or contact form, we process your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data once the enquiry is settled and no retention obligations apply.

6. Orders and subscription

To conclude and manage your subscription, we process your name, delivery and billing address, e-mail address and order and payment data (Art. 6(1)(b) GDPR). We keep invoices and accounting records for the periods required by commercial and tax law (Art. 6(1)(c) GDPR).

7. Cancellation and withdrawal function

If you submit a statement using the “Manage your order” button, we process the data you enter (e.g. name, e-mail address, order number, time of the statement) to identify and carry out your request and to confirm receipt (Art. 6(1)(c) GDPR in conjunction with §§ 312k, 356a BGB).

8. Payment providers

To process payments, we pass the necessary data to the payment provider you choose (Art. 6(1)(b) GDPR). These providers also process the data under their own responsibility; their privacy notices apply.

9. Shipping

To deliver your box, we pass your name and delivery address to DHL, Charles-de-Gaulle-Straße 20, 53113 Bonn, Deutschland (Art. 6(1)(b) GDPR). We only pass on your e-mail address or phone number if you consented when ordering, so that the carrier can notify you about delivery (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.

10. Newsletter

If you subscribe to our newsletter, we process your e-mail address on the basis of your consent (Art. 6(1)(a) GDPR). The newsletter is sent via Substack, Inc., 548 Market St, PMB 72296, San Francisco, CA 94104, USA, with whom we have a data processing agreement. You can unsubscribe at any time via the link in every e-mail.

11. Storage period

We store personal data only as long as necessary for the purpose concerned. Where statutory retention obligations apply, we restrict the data and delete it once those periods have expired.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, simply e-mail margaux@canopy-cities.com.

13. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).

Last updated: 2.10.2026