Privacy Policy
Last updated: 7 October 2026
This policy explains how dunagency collects and uses personal data when you browse our website, purchase digital products, subscribe to our emails or contact us.
1. Who is responsible for your data?
dunagency.com is operated by:
Stun and Awe UG (haftungsbeschrΓ€nkt)
Cantianstrasse 2
10437 Berlin, Germany
Privacy enquiries: support@dunagency.com
We are the controller responsible for the processing described in this policy.
2. Website hosting and technical information
We use Squarespace to host our website and provide website and shop functions.
When you visit, technical information may be processed, including your IP address, browser, operating system, requested pages, referring website and access times. We use this information to deliver the website, maintain its security and investigate technical problems.
Our legal basis is Article 6(1)(f) GDPR. Our legitimate interest is operating a secure and reliable website.
Technical information is retained for as long as necessary to operate the service and investigate technical or security incidents, then deleted or anonymised unless further retention is legally required.
3. Cookies and your choices
We use Squarespaceβs cookie banner to manage your choices about optional cookies and similar technologies.
Strictly necessary technologies support functions such as shopping carts, checkout, security and remembering privacy choices. Where they are necessary to provide a service you request, device storage or access is permitted under Section 25(2) TDDDG. Associated personal data processing relies on the relevant contractual, legal or legitimate-interest basis.
Non-essential analytics and marketing technologies are used only with your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR.
You can reject optional technologies and change or withdraw your consent through our websiteβs cookie preferences. Withdrawal does not affect the lawfulness of processing before withdrawal.
We process consent records where necessary to demonstrate compliance with our legal obligations under Article 6(1)(c) GDPR.
4. Purchases and payments
We use Squarespace and ThriveCart to manage purchases, and Squarespace Payments, Stripe and PayPal to process payments, depending on the checkout and payment method selected.
We process information necessary to complete your purchase, including your name, email address, billing details, order information and payment status.
For digital product delivery, we also process the information needed to provide access or transfer a template. This may include the Squarespace account email address you supply.
Our legal bases are:
Article 6(1)(b) GDPR: processing your purchase, delivering products and providing contractual support.
Article 6(1)(c) GDPR: meeting accounting, tax and other legal obligations.
Article 6(1)(f) GDPR: preventing misuse and protecting our business against fraud and legal claims.
Payment information is processed through the selected payment service. Payment providers may also act as independent controllers for processing required by their own legal, security and fraud-prevention obligations.
Information necessary to complete an order must be provided for us to fulfil it.
5. Contact, support and appointments
When you contact us, we process your contact details, message and relevant order information to respond and resolve your request.
Our legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual enquiries. For other communications, we rely on Article 6(1)(f) GDPR, reflecting our legitimate interest in responding to enquiries.
We use Cal.com for appointment bookings. Booking information may include your name, email address, appointment details and information you submit when arranging a meeting.
We retain enquiry and appointment information until the matter is resolved and any applicable contractual, legal or claims-related retention requirements have ended.
6. Newsletters and personalised email campaigns
We use Squarespace Email Campaigns to manage subscriptions and send marketing emails.
We process your email address, any name you provide and records of your subscription and consent. We use double opt-in: you confirm your subscription by email before it becomes active.
With your consent, we also process email engagement information, such as recorded opens and link clicks, to assess campaign performance and tailor future communications.
Newsletter delivery and personalised email tracking rely on Article 6(1)(a) GDPR. Email marketing also follows Section 7 UWG. Where tracking involves storing or accessing information on your device, we obtain the consent required by Section 25(1) TDDDG.
You can unsubscribe using the link in each newsletter or contact support@dunagency.com to withdraw consent to email marketing or personalised tracking.
We retain subscription data while your subscription is active. Following withdrawal, we retain only information necessary to respect your preferences, demonstrate prior consent or establish, exercise or defend legal claims.
Flodesk templates are products we sell. We do not use Flodesk to manage our email marketing.
7. Analytics and advertising
With your consent, we use the following services:
ServicePurposeSquarespace Analytics and Google AnalyticsUnderstanding website use and improving our pagesGoogle AdsMeasuring advertising results and supporting remarketingMeta/Facebook PixelMeasuring conversions and supporting personalised advertisingPinterest trackingMeasuring conversions and supporting advertising
Depending on the service, information processed may include IP addresses, cookie or device identifiers, browser information, pages visited, interactions and purchase events.
Advertising services may associate this information with other information they hold, including information connected to your account with them.
Our legal basis is Article 6(1)(a) GDPR, together with Section 25(1) TDDDG where device storage or access is involved.
You can withdraw consent through our websiteβs cookie preferences.
8. Affiliate programme
We use Peachs to administer our affiliate programme and attribute referred purchases.
For affiliate participants, we process account, referral, transaction and commission information necessary to manage their participation. Our legal bases are Article 6(1)(b) GDPR for administering the affiliate relationship and Article 6(1)(c) GDPR for applicable accounting obligations.
Non-essential cookies or similar technologies used to track visitors for affiliate attribution require consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR.
9. Fomo notifications
We use Fomo to display notifications about customer purchases.
Where you specifically consent to this public display, a notification may show your first name, country and purchased product. We share the information necessary to generate the notification with Fomo.
The legal basis for displaying identifiable purchase information is Article 6(1)(a) GDPR. Consent to receive newsletters does not, by itself, constitute consent to this public display.
You can withdraw your consent by emailing support@dunagency.com. We will stop future display of your information and arrange its removal from active notifications.
Any non-essential visitor tracking associated with Fomo is activated only with the relevant cookie consent.
10. Sharing data and international transfers
We disclose personal data to the service providers described above where necessary for the stated purposes. Other recipients may include providers supporting our business communications, professional advisers and authorities where disclosure is legally required.
Providers acting as processors must process personal data under our instructions and applicable data-processing agreements. Some providers act as independent controllers for particular activities.
Some providers process information outside the European Economic Area, including in the United States.
Such transfers require an applicable legal mechanism under Articles 44β49 GDPR. Depending on the recipient, this may be an adequacy decision, including the EUβUS Data Privacy Framework for appropriately certified organisations, or Standard Contractual Clauses with additional safeguards where necessary.
Contact support@dunagency.com for information about the safeguards applicable to a particular transfer or to request a copy.
Further information about key providers is available here:
11. Data retention
We retain personal data only for as long as necessary for its stated purpose, applicable legal obligations or the establishment, exercise or defence of legal claims.
Retention depends on the type of information, whether an order or enquiry remains active, whether consent remains valid and whether a legal retention requirement applies.
German accounting and tax rules generally require retention of:
Accounting vouchers, including relevant invoices, for eight years.
Books, annual accounts and certain other accounting records for ten years.
Relevant business correspondence for six years.
These periods generally begin at the end of the relevant calendar year and may be extended where legally required.
Information retained solely for legal obligations is restricted to those purposes. Otherwise, information is deleted or anonymised when no longer needed.
12. Your rights
Subject to the applicable legal conditions, you have the right to:
Access your personal data and obtain a copy.
Correct inaccurate or incomplete information.
Request deletion or restriction of processing.
Receive your data in a portable format where applicable.
Withdraw consent at any time.
Where processing relies on legitimate interests, you may object for reasons relating to your particular situation. You may object to direct marketing at any time, including related profiling.
To exercise your rights, email support@dunagency.com. We may request information reasonably necessary to verify your identity.
We generally respond within one month. If a legally permitted extension is necessary, we will inform you within that month and explain why.
You may lodge a complaint with a supervisory authority, particularly where you live, work or believe an infringement occurred. Our local authority is the Berlin Commissioner for Data Protection and Freedom of Information.
13. Policy updates
We update this policy when our processing activities, services or legal requirements change. The latest version is available on this page.