Privacy Policy

1. Controller

The controller responsible for data processing under the GDPR is:

2. Overview

We only process personal data to the extent necessary to provide a functional website and our services. Legal bases are Art. 6 (1) (a), (b) and (f) GDPR.

3. Data We Collect

• Server log files: IP address, timestamp, page accessed, browser type, referrer (legitimate interest, Art. 6 (1) (f) GDPR).
• Cookies and similar technologies: see our Cookie Policy.
• Newsletter sign-up: email address, confirmation timestamp (double opt-in, Art. 6 (1) (a) GDPR).
• Price alerts: email address, product reference, target price (Art. 6 (1) (b) GDPR).

4. Cookies and Tracking

We use strictly necessary cookies based on Art. 6 (1) (f) GDPR. Analytics and marketing cookies (e.g. Google Analytics, affiliate tracking) are only set after your explicit consent (Art. 6 (1) (a) GDPR). You can withdraw consent at any time via the cookie banner.

5. Affiliate Tracking

With marketing consent, we connect an ad campaign, ad group, creative and optional Google click ID (GCLID, GBRAID or WBRAID) to the landing page and a later intentional shop click. We use a random visit reference, a 30-minute cookie and browser session storage. Google click IDs are not sent to shops or affiliate networks; a separate random click reference may be sent for reconciliation. Visit records including Google click IDs are deleted after 30 days.

We link to partner shops via affiliate networks (e.g. Awin, Amazon Associates). When you click such a link, a click identifier (and possibly a cookie) is transmitted to the network so commissions can be attributed. This is based on your consent (Art. 6 (1) (a) GDPR).

Returning browsers and shop selection

After marketing consent explicitly describing this purpose, we use a random signed browser identifier in the “tt_visitor” cookie for up to 30 days. Our database stores a derived pseudonymous reference linking ad visits, redirects and selected shops. We also store a shortened User-Agent, the browser and operating system versions it reports, device type, preferred language, referring domain without URL parameters and, where provided by our hosting service, approximate country and region. These details can be missing or inaccurate. We do not store a full IP address for this purpose, create a device fingerprint or record screen contents or inputs.

On a new click on the same ad from a recognised browser, automatic routing favours shops not visited in the current round, using current offers for the same product and weighting the remaining shops by price. After a complete round, selection starts again without immediately repeating the last shop when alternatives exist. An explicitly chosen comparison-page shop is never replaced. Without this consent or after cookie deletion, we cannot recognise the browser. The browser reference is not sent to shops or advertising networks.

Technical visit data is deleted after 30 days, including from longer-lived accounting records. Unused shop history expires after 30 days. Processing is based on consent (Art. 6(1)(a) GDPR and section 25(1) TDDDG). Withdrawal through cookie settings stops further recognition and collection for this purpose.

Google Ads: voluntary shop-click measurement

After marketing consent explicitly covering Google Ads, we load the Google tag provided by Google Ireland Limited. The tag sends Google the page address and technical connection data such as IP address and browser information. Ad identifiers and cookies allow Google to attribute a visit to an advertisement. When you voluntarily click a German Solute shop offer from an attributed ad visit, our server sends Google the ad click identifier, shop-click time, a unique event reference and the associated consent signals. We delete these stored events, including the click identifier and consent record, after 30 days. A purpose-specific cookie lasting no more than 30 days allows us to stop pending uploads when you withdraw consent in this browser. The configured value of EUR 1.00 per shop click is used for ad optimisation; it represents neither confirmed revenue nor a purchase at the shop. We do not send email addresses or telephone numbers for this measurement or enable personalised advertising.

Processing is based on consent (Art. 6(1)(a) GDPR and section 25(1) TDDDG), which you can withdraw through the cookie settings in the footer. Earlier affiliate-only consent does not activate this measurement. Google may process data outside the EU, including in the United States. See Google’s privacy policy and cookie information for processing, retention and safeguards. Our Google Ads action uses a 30-day click attribution window; this is not a deletion deadline for all data processed by Google.

6. Recipients

• Hosting: Vercel Inc. (EU SCCs in place).
• Database: All-Inkl.com, servers in Germany.
• Analytics: Google Analytics (with consent).
• Ad measurement: Google Ads (Google Ireland Ltd., with marketing consent explicitly covering this purpose).
• Affiliate networks: Awin AG (Berlin), Yieldkit GmbH (Hamburg), solute GmbH (Karlsruhe – operator of billiger.de), Amazon EU S.à r.l. (Luxembourg) and other partners visibly disclosed on the respective links.
• Email delivery (newsletter and price alerts): Resend, Inc. (USA). Processing under EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) plus a Data Processing Agreement with Resend.

7. Retention

Campaign visits, including stored Google click IDs, are deleted after 30 days. Click and reconciliation references are kept for up to 120 days to handle delayed commission reports; clicks with an attributed commission remain with the accounting records. Newsletter and price-alert data are deleted on request or unsubscribe. Analytics data is retained for 14 months by default.

8. Your Rights

Under the GDPR you have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object (Art. 21 GDPR)
• Withdraw consent at any time (Art. 7 (3) GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

Competent authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Security

We use HTTPS encryption, regular updates and access controls. No method of transmission is 100% secure, however.

10. Changes

We may update this policy as legal requirements or features of our site change. The current revision date appears at the top.

11. Contact

For privacy questions or to exercise your rights: