Privacy policy

This is a translation. The German privacy policy is the legally binding version.

1. Privacy at a glance

General information

The following gives an overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified.

In short

• No user accounts, no sign-in, no newsletter.
• No analytics or tracking scripts.
• We do not pass your data on to shops or partner networks. Only when you click “To the shop” does your browser itself connect to the partner network and the shop (section 4).

How do we collect your data?

When you visit the website, our server processes your IP address as technically necessary — to protect the site against overload and the links to the shops against abuse (sections 3 and 4). We receive further data only if you contact us yourself.

2. General and mandatory information

Controller

Storage period

We store personal data only as long as the respective purpose requires. The specific periods are given with each processing in section 3.

Legal bases

Processing the IP address for abuse prevention, detecting automated access, request limits and logs is based on our legitimate interest in the secure and functioning operation of the website (Art. 6(1)(f) GDPR). Handling enquiries is based on Art. 6(1)(b) GDPR where they relate to a contract, otherwise on Art. 6(1)(f) GDPR.

Recipients

We do not pass your personal data on to third parties.

Your further rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Please contact the address above.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen).

Obligation to provide data

You are not obliged to provide us with any data. Without the technically necessary processing of the IP address, however, the website cannot be delivered.

Automated decisions

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

SSL/TLS encryption

This website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

3. Data collected on this website

Cookies

This website itself does not set cookies.

Application logs

The application writes the following logs, which are deleted automatically:

• Search log (90 days): time, search term (at most 100 characters), storefront, number of results, selected category, whether a fuzzy search was used and which spelling suggestion was shown, plus yes/no flags: whether the browser identifier points to automated access, whether the identifier the browser sends on its own (the "Sec-CH-UA" client hint) matches the browser identifier, whether the search started on a page of this website, whether the IP address belongs to a known data centre, whether unusually many searches came from the same IP address within a minute, and whether the same term was searched from the same IP address within the last half hour. No IP address, no browser identifier. For the last two flags the server keeps a hash (HMAC, formed with a secret key) of the IP address, or of the IP address and the search term, in its cache; it is deleted after one minute or 30 minutes respectively and is not logged. Purpose: analysing searches without results to improve the search, and telling searches by people from those by programs.
• Redirect log (30 days): time, target address and referring page (referer) of the redirects (section 4). For a click to a shop it contains the shortened IP address (IPv4 without its last byte, IPv6 cut to the first 48 bits), which reveals a provider's network, not the individual connection. It contains the full IP address only when a redirect was blocked, throttled or refused, and the browser identifier (user agent) only when automated access was refused.
• Error log (14 days): technical errors of the application; it may contain the requested address.

Daily totals are derived from these logs and kept permanently: numbers of clicks, searches and refused requests, the most frequent search terms and the networks with the most clicks, shortened as above, plus the domains of the websites from which visitors followed a link here (without path or parameters), counted from the web server's access log. They contain no full IP addresses and no browser identifiers.

Request limits

To protect the website against overload, the number of requests per IP address is limited. The counters expire after one minute and are not logged. Your location is not determined.

Storage in your browser

Some features store data only in your browser (localStorage), not on our server: the wish list (up to 100 products), the comparison (up to 4 products), recently viewed products (up to 24), recent search terms (up to 6) and the light/dark setting. When you open the wish list or the comparison, only the product identifiers are sent to our server to load current prices. You delete this data by clearing the site data in your browser; the wish list and the comparison also directly on the page. Shared links to a wish list or a comparison contain only product identifiers.

The legal basis for storing data in your browser is § 25(2) no. 2 of the German TDDDG: it is strictly necessary for the feature you use.

Enquiries by email or phone

If you contact us by email or phone, we process your enquiry and the data you provide in order to handle it. We delete the data once the enquiry is settled; statutory retention obligations remain unaffected.

4. Redirects and partner links

Clicking “To the shop”

Every click to a shop passes through our server. Your IP address is used briefly to prevent abuse of the partner links: automated access (bots) and access from data centres is refused, and clicks per IP address are counted per minute and per day. The counters expire after one minute or at midnight. If a click is not forwarded to the shop, you land on this website's search for the product.

From our server you reach the shop through the partner network's server (currently adindex, adindex.com). Your browser connects to the partner network directly; it processes your IP address and may set cookies to attribute a purchase to the commission. The partner network's privacy notice applies to this, and from the shop on the shop's.

If an offer is no longer available at the partner network, we send you instead to a page of this website with similar offers or, if there are none, to its search. To detect this, our server first calls the partner network's link itself; no data of yours is passed on. The similar offers come from the partner network Connexity (connexity.com) and are marked “Anzeige” (advertisement). Our server requests them from Connexity and sends only the search term. If you click such an offer, the click passes through our server like every click to a shop; from there your browser connects via rd.bizrate.com to Connexity and on to the shop. Connexity processes your IP address and may set cookies to attribute a purchase to the commission. Connexity's privacy notice applies to this.

Clicks from advertising networks

Visitors arriving through an advertisement are also redirected through our server. If an IP address sends very many requests within a short time, it is blocked for one hour, and for one day if this repeats. The IP address is logged only for blocked or invalid requests.

Partner links

The links to the shops are partner links: if you buy through them, we may receive a commission.

5. Images and shop logos

Our server loads product images and shop logos and delivers them itself; your browser does not connect to third parties for them. For shop logos our server may query Google's icon service with the shop's address — without any information about you.