Privacy policy.

SOE Health Limited ("we", "us", "our") is committed to protecting the privacy of visitors and customers using our website forest-air.com. Our former address forestairforeverywhere.com redirects here; the same policy applies to both.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data under:

• UK GDPR
• EU GDPR (Regulation (EU) 2016/679, for EU/EEA visitors and customers)
• Data Protection Act 2018

By using our website, you acknowledge the practices described in this policy.

We are the data controller for personal data processed through our website.

We may collect and process the following categories of personal information.

• Name
• Email address
• Telephone number
• Billing and delivery address
• Payment details (processed securely by Stripe / PayPal)
• Order details and purchase history
• Messages or enquiries you send us
• Warranty and serial number information
• Account registration data (if applicable)

When you visit our website, our hosting provider Cloudflare processes technically necessary connection data:

• IP address
• Device type and browser information
• Pages viewed and the time they were accessed
• Referral source (referrer), if your browser transmits it

This serves the secure operation and delivery of the site. We do not use any analytics services. There is no Google Analytics, no Meta pixel and no other audience measurement tools. We do not evaluate your behaviour on this website and we do not create usage profiles.

• Stripe, Square or PayPal (payment confirmations, fraud prevention) — depending on which payment method you choose
• Zoho CRM (customer records, invoices, warranty registration)

We do not receive your full credit card numbers.

We process your data only where there is a legal basis under Article 6 UK/EU GDPR.

• Process and deliver your orders
• Provide invoices and payment confirmations
• Manage returns, warranties, and customer support
• Maintain product authenticity and serial numbers

• Improve website functionality and security
• Prevent fraud
• Maintain internal records
• Respond to customer enquiries
• CRM and operational administration

• Email newsletters
• Promotions or updates via email
• Non-essential cookies

You can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

• Tax and accounting records
• Responding to lawful requests by authorities

We only share data with trusted third parties (processors) essential for our operations.

• Cloudflare (Cloudflare, Inc.) — hosting and delivery of this website. Videos are loaded from the Cloudflare R2 storage service as soon as you play them.
• Brevo (Sendinblue GmbH) — delivery of all emails arising from the forms on this website: your enquiry to us, our acknowledgement of receipt to you, and order confirmations.
• Supabase (Supabase, Inc.) — database for orders, redeemed vouchers and enquiries to the partner portal.
• Stripe, Square and PayPal — secure payment processing. Data is only transmitted once you start the payment process, and only to the provider you have chosen. If you pay in advance by bank transfer, no payment service provider is involved.
• Calendly (Calendly LLC) — appointment booking. The "Book a call" button is an ordinary link, not an embedded window: data is only transmitted once you click it and open the page there.
• YouTube (Google Ireland Ltd.) — videos we link to. These are links as well, not embedded windows; merely visiting our page transmits nothing to YouTube.
• Zoho CRM (Zoho Corporation) — customer management, invoices, warranties.
• Shipping companies (e.g. FedEx) — delivery of your orders.

Wix (our former hosting provider) and IONOS (our former email delivery service) are no longer used. Neither receives any data from this website any more.

We may disclose data if required by law or to establish, exercise or defend legal claims.

We never sell your data or share it with third parties for their own marketing.

Because we operate internationally and use services such as Cloudflare, Supabase, Stripe, Square, PayPal, Calendly and Zoho, your data may be processed outside the EU and the United Kingdom, in particular in the USA.

We ensure protection through:

• UK/EU adequacy decisions (where applicable)
• Standard Contractual Clauses (SCCs)
• Data processing agreements with all providers

These ensure GDPR-compliant safeguards for your data.

We retain personal data only as long as necessary:

• Orders, invoices, warranties: 6–10 years (legal/tax requirement)
• Customer accounts: until deleted
• Marketing data: until you unsubscribe
• Messages and enquiries: up to 3 years

You may request deletion at any time, unless a legal obligation requires continued retention.

We take appropriate technical and organisational measures, including:

• Encrypted servers
• Secure payment processing via Stripe/PayPal
• SSL website encryption
• Access controls and password protection
• Regular system monitoring

No system is 100% secure, but we follow industry best practices.

Under the GDPR, you have the right to:

• Access your data
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a data protection authority

To exercise any of these rights, contact us at info@forestair.life.

Information Commissioner's Office (ICO) — ico.org.uk

You may contact the data protection authority in your country of residence.

This website sets three cookies, and none of them serves advertising or observation. We do not use any analytics, advertising or cross-site tracking cookies — neither our own nor those of third parties.

• fa_ref — remembers which partner recommended Forest Air to you, so that the recommendation can be attributed. Lifetime 90 days. It is only set if you expressly agree.
• fa_ref_nein — records that you have declined this attribution, so that you are not asked again. Lifetime 90 days.
• fa_gefragt — records that the question has already been asked. Lifetime one year.

The latter two store nothing but your own decision. They are necessary under Section 25(2) of the German TDDDG (§ 25 Abs. 2 TDDDG) in order to respect that decision, and therefore require no separate consent.

Because there would be nothing to put in one. The only cookie requiring consent is fa_ref, and it concerns only those visitors who arrive through a partner's referral link. Precisely those visitors — and only they — see a single line at the bottom of the page once, asking whether we may remember the referral. If you say no, nothing is stored; the referral can then still be attributed by means of a discount code that you enter yourself.

Holding up a banner to all other visitors for something that does not concern them at all is, in our view, wrong.

Your shopping basket is held in your browser's local storage, not in a cookie and not with us. It only leaves your device when you go to the checkout. This storage is necessary for a service you have expressly requested — a basket that forgets everything when you move to another page would be no basket at all.

You can delete or block cookies and local storage at any time in your browser settings.

All fonts are held on our own server. Nothing is loaded from Google Fonts or any other external server, and your IP address is not transmitted to anyone for that purpose.

Our website and products are intended for adults. We do not knowingly collect personal data from children under 16.

If you believe a child has provided us with personal data, please contact us and we will delete it.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

Our website may contain links to external websites.

We are not responsible for their content or privacy practices.

We may update this policy occasionally.

The revised version will always be posted on this page with the relevant date.

For privacy-related requests: