Πολιτική απορρήτου

This privacy policy explains which personal data we process when you use giftshappiness.com, for what purposes, and what rights you have. Terms such as “personal data” or “processing” are used as defined in Art. 4 of the General Data Protection Regulation (GDPR).

1. Controller

InnoHub UG (haftungsbeschränkt)
Schniederkoppel 15
24558 Henstedt-Ulzburg
Germany

Represented by: Niklas Christopher Flechsig and Vincent Freitag
Phone: +49 176 42 09 77 80
Email: [email protected]

We have not appointed a data protection officer, as we are not required to do so. If you have any questions about data protection, please contact us at the email address above.

2. Overview

We only process personal data where this is necessary to run the website and our wish list features, where you have given your consent, or where we have a legitimate interest. Depending on how you use the site, this includes in particular:

• master and contact data (e.g. name, email address),
• content data (e.g. wish lists, wishes, photos, messages, optionally a delivery address),
• usage and metadata (e.g. pages visited, time of access, IP address, browser and device information).

The data subjects are visitors to the website, registered users, and people who view a shared wish list or reserve gifts from it.

3. Legal bases

Unless stated otherwise, we base the processing on the following legal grounds:

• Art. 6(1)(a) GDPR – your consent, which you can withdraw at any time with effect for the future;
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures, in particular providing your user account and your wish lists;
• Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. retention obligations);
• Art. 6(1)(f) GDPR – our legitimate interests, in particular a secure, stable and economical operation of the website.

Storing information on your device and accessing it (e.g. cookies) takes place without consent only where it is strictly necessary for the service you requested (Section 25(2) of the German TDDDG); in all other cases only with your consent (Section 25(1) TDDDG).

4. Hosting

Our website and database are operated by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, on servers in Germany. We have concluded a data processing agreement with netcup pursuant to Art. 28 GDPR. The legal basis is Art. 6(1)(b) and (f) GDPR.

5. Cloudflare

All requests to our website pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides our domain (DNS), protects the website against attacks and delivers content faster. In doing so, Cloudflare processes in particular your IP address and technical details of your request.

Cloudflare also tells us which country each request comes from. We use this country information solely to suggest a suitable currency and language. Your IP address is not passed on to any other service for this purpose.

We have concluded a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the European Commission's standard contractual clauses apply. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing the website securely and quickly.

6. Server log files

Each time the site is accessed, our server automatically stores information in log files: IP address, date and time, requested address, amount of data transferred, status code, the previously visited page (referrer), and browser and operating system. We use this data only to ensure the operation and security of the website and to investigate errors or attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 14 days unless, exceptionally, they are needed for longer to investigate a specific incident.

7. Cookies and consent management

Strictly necessary cookies. We use cookies that are required to run the website: a session cookie (giftshappiness_session) that recognises you during your visit or after you log in, and a security cookie (XSRF-TOKEN) that protects forms against misuse. Both expire after 120 minutes of inactivity. If you create a wish list without a user account, we additionally store a random identifier in a cookie (guestUUID, stored for 24 days) so that you can edit your list again. The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(b) or (f) GDPR.

Consent management (CookieYes). For cookies and services that are not strictly necessary, we obtain your consent via the consent banner of CookieYes Limited, 3 Warren Yard, Warren Park, Stratford Road, Milton Keynes, MK12 5NW, United Kingdom. CookieYes stores your choice in a cookie (cookieyes-consent, stored for up to one year) and processes technical data such as your IP address for this purpose. The European Commission has issued an adequacy decision for the United Kingdom. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 25 TDDDG. You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page.

8. User account

You can create a user account for many features. In doing so, we process your name, your email address, your password (stored only in encrypted form), your preferred currency and – if you upload one – your profile picture. To confirm your email address, we send you an email with a confirmation link. The legal basis is Art. 6(1)(b) GDPR.

You can delete your user account at any time in your profile. We then permanently delete your account data, your wish lists with all wishes, reservations, messages, delivery addresses and uploaded images, as well as your newsletter subscription. If you delete only a single wish list, it is hidden at first and permanently deleted at the latest together with your user account; on request, we delete it immediately.

9. Sign-in with Google, Facebook or Apple

Instead of using an email address and password, you can sign in with an existing account with one of these providers:

• Google – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;
• Facebook – Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland;
• Apple – Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

You are redirected to the provider's page and sign in there. The provider then sends us your name, your email address (with Apple, possibly an anonymous relay address) and an identifier of your account, which we use to create your user account or sign you in. The provider's own processing of your data is governed by its privacy policy. The providers or their parent companies in the USA are certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR.

10. Wish lists

Creating. When you create a wish list, we store its content: title, occasion, description, wishes with links, prices and images, and – if you wish – a delivery address. The legal basis is Art. 6(1)(b) GDPR.

Wish lists without a user account. You can also create a wish list without an account. So that we can assign it to you and later transfer it to a user account, we store a random identifier and the IP address from which the list was created. The legal basis is Art. 6(1)(b) GDPR.

Sharing. A wish list can be viewed by everyone you give the link to; optionally, you can protect it with a password. A delivery address you add is visible to people with access to the list. Please therefore consider carefully with whom you share the link.

Reservations and messages. Anyone reserving a gift from a list can enter a name; we store the name and quantity so that others can see the wish has already been taken. Messages about individual wishes are stored together with the display name entered. The legal basis is Art. 6(1)(b) GDPR.

Product information. When you paste a link to a product, our server retrieves the linked page to take over the title, price and image. No data about you is sent to the shop. For the product search, we send your search terms – without any information about you – to the Amazon Creators API of Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg.

11. Affiliate programmes (affiliate links)

Giftshappiness is free of charge. We finance it partly through commissions: many product links on our website and in wish lists are so-called affiliate links. If you buy something after clicking such a link, the retailer pays us a commission; the price does not change for you.

In particular, we participate in the Amazon Associates Programme of Amazon Europe Core S.à r.l. As an Amazon Associate we earn from qualifying purchases. We also use affiliate networks such as AWIN, Tradedoubler, Webgains, ADCELL and Sovrn (VigLink) to turn links to online shops into affiliate links. In doing so, we only transmit the product address, not any data about you.

An affiliate link contains a partner ID so that the retailer or affiliate network can attribute the purchase to us. When you click such a link, you leave our website; the retailer or network may then set its own cookies and process data. They are responsible for this themselves; details can be found in their privacy policies. The legal basis for including affiliate links is Art. 6(1)(f) GDPR; our legitimate interest lies in financing our free service.

12. Emails from us

We send system emails – for example to confirm your email address, to reset your password or to confirm a newsletter subscription – via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Brevo processes your email address, the content of the email and technical delivery data for this purpose. We have concluded a data processing agreement with Brevo. The legal basis is Art. 6(1)(b) GDPR.

13. Contact by email

If you contact us by email, we process your details in order to answer your enquiry. Emails to addresses @giftshappiness.com are forwarded via Cloudflare Email Routing (see section 5) to our mailbox at WEB.DE (1&1 Mail & Media GmbH, Brauerstraße 48, 76135 Karlsruhe, Germany) and stored there. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete your enquiry once it has been dealt with and no retention obligations apply.

14. Newsletter

You can subscribe to our newsletter using the form on our website. We then store your email address and the time of subscription and send you an email to confirm your subscription (double opt-in). We do not currently send a newsletter. Should we start sending one, we will inform you in this privacy policy beforehand. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time, for example by email to the address above; your email address will then be removed from the list.

15. Google Tag Manager, Google Analytics and Google Ads

We use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”):

• Google Tag Manager manages the integration of the following services. It does not set cookies or analyse data itself; however, your IP address is transmitted to Google when it loads.
• Google Analytics 4 compiles statistics on how our website is used (e.g. pages visited, time spent, approximate location, device information). It sets cookies and creates pseudonymous usage profiles. Google Analytics 4 does not store IP addresses.
• Google Ads conversion tracking and remarketing measure how successful our ads are and make it possible to show you ads for Giftshappiness on other websites.

We only use Google Analytics and Google Ads with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We use Google's consent mode for this: without your consent, no cookies of these services are set. You can withdraw your consent at any time via the cookie settings. Data may be transferred to Google LLC in the USA in the process; Google LLC is certified under the EU-US Data Privacy Framework.

16. External script libraries (CDN)

On some pages – for example when creating a wish list, in the profile settings and in the product search – your browser loads program libraries from external servers (content delivery networks): cdnjs (Cloudflare, Inc., USA), jsDelivr (Prospect One sp. z o.o., Poland) and code.jquery.com (OpenJS Foundation, USA). Your IP address is transmitted to the respective provider in the process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in displaying the pages reliably and quickly.

17. Links to other websites and social networks

Our website contains links, for example to our profiles on Instagram, TikTok, Facebook and YouTube, to the gift finder on joyzy.de, or to online shops. These are plain links: only when you click on one are you taken to the respective provider, who is then itself responsible for processing your data. Content from these providers is not embedded in our website.

18. Storage period

We store personal data only for as long as necessary for the respective purpose. We store the data of your user account and your wish lists until you delete them or your account. Statutory retention obligations (e.g. under commercial and tax law) remain unaffected; in these cases we restrict processing until the retention period expires.

19. Your rights

You have the right

• to request information about the data we process (Art. 15 GDPR),
• to have incorrect data corrected (Art. 16 GDPR),
• to request the deletion of your data (Art. 17 GDPR),
• to request the restriction of processing (Art. 18 GDPR),
• to receive your data in a common, machine-readable format (Art. 20 GDPR),
• to withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, simply contact [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

20. No automated decision-making

We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

21. Changes

We update this privacy policy when our website or the legal requirements change. The version published on this page applies.

As of: November 2026