Last updated: 06 April, 2026
Abstract Astro | AstroVeo B.V. | KvK: 86478672
Keizersgracht 520 H, 1017EK Amsterdam, The Netherlands
Contact: [email protected]
This is the full privacy policy. A summary is available at abstract-astro.com/privacy-policy.php
This Extended Privacy Policy explains in full how AstroVeo B.V. ("AstroVeo", "we", "us", "our"), operator of Abstract Astro at abstract-astro.com, collects, uses, shares, and protects your personal data. Please read it carefully. A plain-language summary is available at abstract-astro.com/privacy-policy.php.
1. Data Controller and Contact
1.1 The data controller for your personal data is AstroVeo B.V., Keizersgracht 520 H, 1017EK Amsterdam, The Netherlands, Chamber of Commerce: 86478672. Trading as: Abstract Astro.
1.2 For all data protection enquiries: [email protected]. We will acknowledge all data subject rights requests within 5 business days.
1.3 AstroVeo B.V. does not currently appoint a formal Data Protection Officer within the meaning of GDPR Article 37, as we do not conduct large-scale systematic monitoring or processing of special category data. The contact point for all data protection matters is [email protected].
2. Our Two Activities — Why This Matters for Your Data
We operate two legally distinct activities that use your personal data differently. Understanding which applies to you is important.
Activity A — Lead Generation (Free Quiz Funnel)
2.1 The free quiz funnel is a lead generation service. When you complete the quiz and submit your contact details with consent, AstroVeo B.V. transfers your data to selected third-party Partners. Partners pay us or provide commercial consideration for receiving qualified leads — this is how the free service is funded.
2.2 The legal basis for this processing is your explicit consent under GDPR Article 6(1)(a). Without your consent, we do not share your data with Partners for marketing purposes. Consent is obtained by a separate, active, affirmative step at the point of quiz submission — distinct from these terms.
2.3 AstroVeo B.V. and the Partners to whom your data is transferred are joint controllers within the meaning of GDPR Article 26 for the purpose of the initial data collection and transfer. Once your data is received by a Partner, that Partner is an independent controller responsible for its own subsequent processing.
2.4 The essence of our joint controller arrangements with Partners is available on request at [email protected]. As a joint controller, you may exercise your GDPR rights against either AstroVeo B.V. or any Partner that has received your data.
Activity B — Direct Sales (Own Products and Subscriptions)
2.5 AstroVeo B.V. also sells its own astrology products, subscriptions, and digital content directly to users. In these transactions, AstroVeo B.V. is the seller. The legal basis for processing your data in the context of a purchase is contract performance under GDPR Article 6(1)(b).
2.6 Participation in the lead generation funnel and purchase of our own products are legally separate. Your data processing in each context is governed by a different legal basis and serves a different purpose.
3. Personal Data We Collect
3.1 The following table sets out all categories of personal data we collect, the data elements within each category, and how we collect them.
| Category |
Data Elements |
How Collected |
| Identity |
Full name, date of birth, gender |
You provide this in the quiz funnel or at checkout |
| Contact |
Email address, country of residence |
You provide this in the quiz funnel or at checkout |
| Quiz answers |
Areas of interest, stated concerns, quiz responses |
You provide this in the quiz funnel |
| Transaction |
Payment method type, billing amount, subscription status, purchase history |
You provide at checkout; processed by our payment provider |
| Technical |
IP address, browser type and version, device type and OS, session identifiers |
Collected automatically via server logs and cookies |
| Behavioural |
Pages visited, clicks, time on page, quiz funnel progress, feature usage |
Collected automatically via analytics tools |
| Retargeting |
Cookie IDs, pixel data, push notification tokens, advertising interaction data |
Collected automatically via retargeting tools |
| Consent records |
Timestamp, version reference of disclosure shown, record of affirmative consent step, opt-out records |
System-generated at point of submission |
| Communications |
Content of emails you send us, support requests, complaint records |
You provide when contacting us |
3.2 We do not collect or process special category data as defined in GDPR Article 9 (including health data, religious beliefs, racial or ethnic origin, political opinions, or biometric data). Astrology preferences and stated interests do not constitute special category data.
3.3 We do not knowingly collect personal data from persons under 18 years of age. If we discover we have inadvertently collected data from a minor, we will delete it promptly.
4. Purposes of Processing and Legal Bases
4.1 We process personal data only where we have a valid legal basis. The table below sets out each processing purpose, the applicable legal basis under GDPR Article 6, and explanatory details.
| Purpose |
Legal Basis |
Details |
| Sharing your data with Partners for commercial marketing (lead generation activity) |
Consent — Art. 6(1)(a) |
Only with your explicit, separate consent at quiz submission. Consent is freely given, specific, informed, and unambiguous. You may withdraw at any time. |
| Fulfilling your subscription or one-off purchase |
Contract — Art. 6(1)(b) |
Necessary to perform the contract you have entered into with us. |
| Processing your payment |
Contract — Art. 6(1)(b) |
Necessary to collect payment for products and services you have purchased. |
| Sending transactional emails (order confirmations, billing notices, renewal reminders) |
Contract — Art. 6(1)(b) |
Necessary communications relating to your direct purchase relationship with us. |
| Managing your account and subscription |
Contract — Art. 6(1)(b) |
Necessary to administer your direct customer relationship with us. |
| Fraud prevention and platform security |
Legitimate interest — Art. 6(1)(f) |
We have a legitimate interest in protecting the Platform, our users, and our business from fraud and abuse. This interest is not overridden by your interests, as the processing is minimised and proportionate. |
| Retargeting advertising (showing you ads on third-party platforms) |
Consent — Art. 6(1)(a) |
Only with your separate cookie consent. You may withdraw via the cookie banner or cookie policy at any time. |
| Basic interest profiling (to personalise Platform content) |
Legitimate interest — Art. 6(1)(f) |
We have a legitimate interest in presenting content relevant to your stated interests. This does not produce legally significant automated decisions. You have the right to object. |
| Statutory accounting and financial records |
Legal obligation — Art. 6(1)(c) |
Required by Dutch accounting law (Boek 2 BW) for 7 years. |
| Retaining consent records as evidence of compliance |
Legal obligation — Art. 6(1)(c) |
Required to demonstrate GDPR compliance under Art. 5(2). |
| Anonymised analytics and reporting |
Not applicable — anonymised data falls outside GDPR scope |
After retention periods, personally identifiable fields are stripped. The resulting anonymised records are not personal data and are retained indefinitely for reporting. |
4.2 Important: there is no legitimate interest basis for the free quiz funnel. The quiz funnel exists to enable lead generation, which is a consent-based activity. If you do not consent to Partner data sharing, we do not process your data for that purpose.
5. Cookies, Tracking, and the Dutch Telecommunications Act
5.1 We use cookies and similar technologies on the Platform. Under the Dutch Telecommunications Act (Telecommunicatiewet, Article 11.7a), which implements the EU ePrivacy Directive, we may only place non-essential cookies with your prior consent.
| Cookie Type |
Purpose |
Legal Basis |
| Strictly necessary |
Platform functionality, session management, security, load balancing |
No consent required — legally exempt |
| Analytics |
Understanding how users interact with the Platform in aggregate (e.g. Google Analytics with IP anonymisation) |
Consent required |
| Retargeting / advertising |
Showing personalised ads on third-party platforms based on your prior visit |
Consent required |
| Functional |
Remembering your preferences, language settings, and quiz progress |
Consent required |
5.2 We use the following third-party retargeting and push notification technologies:
• NotifyAI — push notification and retargeting platform. Data processed: cookie IDs, device identifiers, interaction data. Privacy information: available from NotifyAI directly.
• Pushnami LLC — push notification service, US-based. Data processed: push subscription tokens, device identifiers. Transfer mechanism: Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). Privacy information: available from Pushnami directly.
5.3 You can manage your cookie preferences at any time via the cookie consent banner on our Platform or at
abstract-astro.com/cookie-policy.php. Withdrawing cookie consent does not affect the lawfulness of processing that occurred before withdrawal.
6. Lead Generation — Data Sharing with Partners in Detail
This section is critical. It explains in detail what data is shared with Partners, on what basis, and what your rights are.
6.1 Where you give your explicit consent at the point of quiz submission, the following data is transferred to selected Partners: full name; date of birth; email address; gender; country of residence; and quiz answers including your stated area of interest.
6.2 Partners are third-party companies offering astrology, tarot, clairvoyance, and spiritual services. They use your data to contact you with personalised commercial offers by email or other digital means permitted under the Dutch Telecommunications Act. Partners do not receive your payment data, and they do not receive data about purchases you have made from us directly.
6.3 We do not name individual Partners in this policy because the Partners we work with may change over time. A list of current Partners is available upon request at
[email protected]. We will provide this within one month of any request.
6.4 Legal basis: your explicit consent under GDPR Article 6(1)(a). We also act as the agent through which your consent is conveyed to Partners for the purpose of Article 11.7 of the Dutch Telecommunications Act, authorising Partners to contact you by electronic means for commercial marketing.
6.5 Joint controllership: AstroVeo B.V. and the Partners who receive your data jointly determine the purpose (commercial marketing contact) and the means (quiz funnel data collection and transfer) of the initial processing. They are therefore joint controllers under GDPR Article 26 for that processing activity. Once data is transferred, each Partner is an independent controller for its own subsequent processing.
6.6 The essence of our joint controller arrangement is: AstroVeo B.V. is responsible for obtaining valid consent, making the required disclosures, and transferring data only to Partners who have committed to comply with applicable law. Partners are responsible for their own processing after receipt, including their communications, opt-out mechanisms, and their own retention and deletion obligations.
How to opt out of Partner data sharing
6.7 You may withdraw your consent at any time by:
• clicking the unsubscribe link in any Partner email;
• visiting
abstract-astro.com/data-processing-consent-withdrawal.php; or
• emailing
[email protected].
6.8 Upon receipt of your withdrawal, we will stop transferring your data to Partners without undue delay — in practice, within 24 to 72 hours — and will notify Partners who hold your data that your consent has been withdrawn. Partners must cease processing your data for marketing purposes upon receiving that notification. Withdrawal does not retroactively affect data Partners received and processed before withdrawal. To exercise rights over data a Partner holds, contact that Partner directly.
California (CCPA/CPRA) — Sale and Sharing Disclosure
6.9 Under California law, the transfer of your personal data to Partners in exchange for commercial consideration constitutes a "sale" and/or "sharing" of personal information within the meaning of the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). California residents have the right to opt out of this sale and sharing at any time at:
abstract-astro.com/data-processing-consent-withdrawal.php
7. All Data Recipients
| Recipient Category |
Purpose |
Location |
Transfer Safeguard |
| Lead generation Partners (astrology/spiritual services companies) |
Commercial contact with you (see Section 6) |
EU/EEA and outside EEA |
Consent (Art. 6(1)(a)); SCCs where outside EEA |
| Payment processors (e.g. Stripe, Adyen) |
Secure processing of your payment |
EU/EEA and USA |
EU-US Data Privacy Framework adequacy decision; SCCs as fallback |
| Transactional email platform |
Sending order confirmations, billing notices, renewal reminders |
EU/EEA or USA |
SCCs |
| Analytics providers (e.g. Google Analytics) |
Understanding Platform usage in aggregate |
USA |
SCCs; IP address anonymised before transfer |
| Retargeting platforms (NotifyAI, Pushnami LLC) |
Advertising based on prior Platform visit |
EU/EEA and USA |
SCCs |
| Cloud hosting providers |
Hosting the Platform and storing data |
EU/EEA preferred |
Data processing agreement in place; SCCs where EEA transfer not possible |
| Legal and regulatory authorities |
Compliance with court orders, regulatory requests, legal obligations |
As required by law |
Legal obligation (Art. 6(1)(c)) |
| Potential business purchasers or acquirers |
In the event of a corporate restructuring, merger, or acquisition of AstroVeo |
To be confirmed at time of transfer |
SCCs or adequacy decision as applicable; you will be notified in advance |
7.1 We do not transfer your personal data to any third party except as described in this policy. We do not trade, rent, or sell your personal data for third parties' own unrelated marketing purposes outside the lead generation model described in Section 6 above.
8. International Data Transfers
8.1 AstroVeo B.V. is based in the Netherlands, within the European Economic Area (EEA). Some of our service providers and Partners are based outside the EEA, principally in the United States. When we transfer personal data outside the EEA, we do so only where an adequate level of protection is ensured by one of the following:
• An adequacy decision by the European Commission — for example, the EU-US Data Privacy Framework (adequacy decision of 10 July 2023), where applicable to the recipient.
• Standard Contractual Clauses (SCCs) approved by the European Commission under Decision 2021/914, which contractually bind the recipient to EU-equivalent data protection standards.
• Your explicit consent for a specific transfer, where applicable under GDPR Article 49(1)(a).
8.2 You may request a copy of the SCCs or other transfer safeguards we rely on for any specific transfer by contacting
[email protected].
9. Data Retention and Anonymisation
9.1 We retain personal data for no longer than is necessary for the purpose for which it was collected, subject to legal obligations. Where data is no longer needed for its primary purpose but is required for reporting or analytics, we anonymise it — stripping and irreversibly hashing all personally identifiable fields — rather than deleting it. Anonymised data is not personal data and is not subject to GDPR retention rules.
| Data Category |
Retention Period |
What Happens After |
| Quiz / contact data — active paid subscriber |
Duration of subscription + 24 months after last activity |
Anonymised |
| Quiz / contact data — free user who has engaged (opened email, clicked, etc.) |
24 months from last engagement |
Anonymised |
| Quiz / contact data — free user who never engaged |
12 months from collection |
Anonymised |
| Lead data transferred to Partners — our records of the transfer |
12 months from date of transfer (or 24 months if there is documented subsequent engagement) |
Deleted from our systems. Partners manage their own retention. Contact individual Partners to request deletion of data they hold. |
| Consent records (evidence that consent was given) |
3 years from the date consent was given or last contact — required to demonstrate GDPR compliance |
Deleted |
| Payment and transaction records |
7 years — required by Dutch accounting law (Boek 2 BW, Art. 2:10) |
Deleted after 7 years |
| Cookie consent records |
1 year from date of consent |
Renewed or deleted |
| Server logs (including IP addresses) |
90 days |
Deleted |
| Anonymised analytics records |
Indefinitely — no longer personal data |
Not applicable |
| German users: email marketing contacts who have never engaged |
Reviewed at 6 months; deleted at 12 months — consistent with guidance from German DPAs including the Hamburg DPA |
Anonymised |
9.2 German users: double opt-in confirmation is required before any Partner or AstroVeo B.V. may send email marketing to a German email address. This is in addition to the general consent described in this policy, and is required by German courts regardless of the ePrivacy baseline.
10. Security
10.1 We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. These measures include: TLS encryption for all data in transit; access controls and authentication requirements for staff accessing personal data; regular security reviews; and contractual security obligations imposed on all processors and Partners.
10.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) within 72 hours of becoming aware of the breach, and will notify you without undue delay where required by GDPR Article 34.
10.3 No method of data transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will take prompt action to investigate and mitigate any breach that occurs.
11. Your Rights — EU and EEA (GDPR)
This section applies to users in the EU and EEA.
11.1 Under GDPR you have the following rights regarding your personal data. These rights apply to processing by AstroVeo B.V. as controller. For data held by Partners, you must exercise rights directly against those Partners.
| Right |
What It Means |
How to Exercise |
| Access (Art. 15) |
Obtain a copy of your personal data and information about how, why, and with whom we process it |
Email [email protected] |
| Rectification (Art. 16) |
Correct inaccurate personal data or complete incomplete data |
Email [email protected] |
| Erasure (Art. 17) |
Request deletion of your personal data where there is no overriding legal basis to retain it (e.g. where we no longer need it, or where you have withdrawn consent) |
Email [email protected] |
| Restriction (Art. 18) |
Restrict our processing of your data while a dispute is resolved (e.g. while you contest its accuracy) |
Email [email protected] |
| Portability (Art. 20) |
Receive your personal data in a structured, machine-readable format, and transfer it to another controller (applies to consent-based and contract-based processing) |
Email [email protected] |
| Object (Art. 21) |
Object to processing based on legitimate interest, including profiling, where your particular circumstances justify it. We will stop unless we can demonstrate compelling legitimate grounds. |
Email [email protected] |
| Withdraw Consent (Art. 7(3)) |
Withdraw any consent at any time, without penalty or negative consequence, without affecting the lawfulness of processing before withdrawal |
abstract-astro.com/data-processing-consent-withdrawal.php or email [email protected] |
| Complaint |
Lodge a complaint with a supervisory authority |
See Section 11.3 below |
11.2 We will respond to all rights requests within one calendar month of receipt. Where a request is complex or numerous, we may extend by a further two months — but only where this is genuinely necessary given the complexity and number of requests, and we will notify you of the extension and the reason within the first month. We will not charge a fee for reasonable requests.
National Supervisory Authorities — where to complain
11.3 You have the right to lodge a complaint with the supervisory authority in your country of habitual residence, place of work, or the place of the alleged infringement:
• Netherlands (our home authority): Autoriteit Persoonsgegevens —
www.autoriteitpersoonsgegevens.nl
12. Your Rights — United Kingdom
This section applies to users in the United Kingdom.
12.1 The UK GDPR (as retained in UK law by the Data Protection Act 2018) applies to UK users. You have the same rights as set out in Section 11. The supervisory authority for UK data protection is the Information Commissioner's Office (ICO):
www.ico.org.uk
13. Your Rights — United States
This section applies to users in the United States.
California (CCPA / CPRA)
13.1 California residents have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:
• Right to Know: request disclosure of the categories and specific pieces of personal information we collect, use, disclose, sell, or share, and the categories of sources, business purposes, and third parties involved.
• Right to Delete: request deletion of your personal information, subject to certain exceptions under California law.
• Right to Correct: request correction of inaccurate personal information we hold about you.
• Right to Opt-Out of Sale and Sharing: the transfer of your data to Partners for commercial consideration constitutes a "sale" and/or "sharing" under CCPA/CPRA. You have the right to opt out at:
abstract-astro.com/data-processing-consent-withdrawal.php. We will process opt-out requests within 15 business days and will notify Partners to stop using your data.
• Right to Limit Use of Sensitive Personal Information: we do not collect sensitive personal information as defined under CPRA (including SSNs, financial account details, precise geolocation, racial or ethnic origin, or biometric data).
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights.
13.2 We will respond to verified CCPA/CPRA requests within 45 days. For complex requests, we may extend by a further 45 days with prior written notice. The rights to delete, correct, and opt-out are not limited to two requests per year. The right to know is limited to two requests per 12-month period.
13.3 CCPA Retention Disclosure: we retain each category of personal information for the periods set out in the retention table in Section 9 of this policy.
Other US States
13.4 Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states that have enacted comprehensive privacy laws have analogous rights to those described above, including rights of access, correction, deletion, and opt-out from the sale of personal data. Contact
[email protected] to exercise any state privacy right.
CAN-SPAM Act
13.5 AstroVeo B.V. sends transactional emails to its direct customers (order confirmations, billing notices, renewal reminders). These emails always include: our registered company address; a clear identification of the sender; and honest, non-deceptive subject lines. We honour opt-out requests for marketing emails within 10 business days.
13.6 Partners are independently responsible for complying with CAN-SPAM and applicable US state law in connection with commercial emails they send to you after receiving your data through our lead generation service. Partner emails will include their own unsubscribe mechanism.
14. Automated Decision-Making and Profiling
14.1 We use your quiz answers and browsing behaviour to create a basic interest profile. This is used to: select which Partners may be most relevant to share your data with (if you consent); and personalise the content and advertising shown to you on the Platform and third-party platforms.
14.2 This profiling does not constitute automated decision-making that produces legal effects or similarly significant effects on you within the meaning of GDPR Article 22. No decision that significantly affects your legal rights, financial situation, access to services, or comparable interests is made solely by automated means without human involvement.
14.3 You have the right to object to this profiling at any time under GDPR Article 21. To object, email
[email protected]. We will stop this profiling unless we can demonstrate compelling legitimate grounds that override your interests.
15. Children's Privacy
15.1 The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from persons under 18 years of age. If you believe we have inadvertently collected personal data from a person under 18, please contact
[email protected] immediately. We will delete the data promptly upon verification.
16. Changes to This Policy
16.1 We may update this Extended Privacy Policy from time to time. When we make material changes — particularly changes to our data sharing practices, legal bases, Partner arrangements, or your rights — we will notify you by email at least 30 days before the change takes effect, where we hold your email address. The "Last updated" date at the top of this policy will always reflect the most recent version.
16.2 Previous versions of this policy are available on request at
[email protected].
17. Contact Us
Abstract Astro | AstroVeo B.V.
Registered office: Keizersgracht 520 H, 1017EK Amsterdam, The Netherlands
Chamber of Commerce (KvK): 86478672
All data protection and privacy enquiries:
[email protected]
Consent withdrawal and opt-out:
abstract-astro.com/data-processing-consent-withdrawal.php
Privacy Policy (summary):
abstract-astro.com/privacy-policy.php
Cookie Policy:
abstract-astro.com/cookie-policy.php
Dutch supervisory authority (AP):
www.autoriteitpersoonsgegevens.nl
Last updated on: 06 April, 2026.
