Privacy Policy

1. Controller

The controller responsible for data processing under the GDPR is:

2. Overview

We only process personal data to the extent necessary to provide a functional website and our services. Legal bases are Art. 6 (1) (a), (b) and (f) GDPR.

3. Data We Collect

• Server log files: IP address, timestamp, page accessed, browser type, referrer (legitimate interest, Art. 6 (1) (f) GDPR).
• Cookies and similar technologies: see our Cookie Policy.
• Newsletter sign-up: email address, confirmation timestamp (double opt-in, Art. 6 (1) (a) GDPR).
• Price alerts: email address, product reference, target price (Art. 6 (1) (b) GDPR).

4. Cookies and Tracking

We use strictly necessary cookies based on Art. 6 (1) (f) GDPR. Analytics and marketing cookies (e.g. Google Analytics, affiliate tracking) are only set after your explicit consent (Art. 6 (1) (a) GDPR). You can withdraw consent at any time via the cookie banner.

5. Affiliate Tracking

We link to partner shops via affiliate networks (e.g. Awin, Amazon Associates). When you click such a link, a click identifier (and possibly a cookie) is transmitted to the network so commissions can be attributed. This is based on your consent (Art. 6 (1) (a) GDPR).

6. Recipients

• Hosting: Vercel Inc. (EU SCCs in place).
• Database: All-Inkl.com, servers in Germany.
• Analytics: Google Analytics (with consent).
• Affiliate networks: Awin AG (Berlin), Yieldkit GmbH (Hamburg), solute GmbH (Karlsruhe – operator of billiger.de), Amazon EU S.à r.l. (Luxembourg) and other partners visibly disclosed on the respective links.
• Email delivery (newsletter and price alerts): Resend, Inc. (USA). Processing under EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) plus a Data Processing Agreement with Resend.

7. Retention

Server logs and click data are deleted after 30 days. Newsletter and price-alert data are deleted on request or unsubscribe. Analytics data is retained for 14 months by default.

8. Your Rights

Under the GDPR you have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object (Art. 21 GDPR)
• Withdraw consent at any time (Art. 7 (3) GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

Competent authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Security

We use HTTPS encryption, regular updates and access controls. No method of transmission is 100% secure, however.

10. Changes

We may update this policy as legal requirements or features of our site change. The current revision date appears at the top.

11. Contact

For privacy questions or to exercise your rights: