Privacy Policy

mycashbacks GmbH ("mycashbacks," "we," "us," or "our") understands that the careful handling of your personal information is important to you. Protecting personal data is therefore one of our highest priorities. We respect every individual's right to informational self-determination and are fully committed to complying with the data protection laws applicable in Germany and the European Union.

This Privacy Policy is written in U.S. English for readability. It does not change the applicable legal framework: the processing described below is governed in particular by the General Data Protection Regulation ("GDPR") and applicable German data protection law.

We process personal data, such as a person's name, mailing address, email address, or telephone number, in accordance with the GDPR and the country-specific data protection laws applicable to mycashbacks GmbH. Depending on the processing activity, the legal basis may include consent under Article 6(1)(a) GDPR, performance of a contract or steps taken before entering into a contract under Article 6(1)(b) GDPR, compliance with a legal obligation under Article 6(1)(c) GDPR, or our legitimate interests under Article 6(1)(f) GDPR.

This Privacy Policy explains the nature, scope, and purposes of the personal data we collect, use, and otherwise process, as well as the rights available to data subjects. As controller, mycashbacks GmbH has implemented technical and organizational measures designed to protect personal data processed through our services. Internet-based data transmission may nevertheless involve security vulnerabilities, so absolute protection cannot be guaranteed. You may therefore provide personal data to us through alternative means, such as by telephone, where appropriate.

This Privacy Policy applies to all of our services and offerings, including our website at www.mycashbacks.com, our mobile apps for iOS and Android, and our browser extension (the mycashbacks Cashback Finder). Where a processing activity applies only to a particular offering, such as the mobile app, we identify that in the relevant section. References to the "website" or "webpage" also include our apps where the processing is carried out in the same manner.

1. Definitions

This Privacy Policy uses the terminology employed by the European legislator in the GDPR. In particular, "personal data," "processing," "controller," "processor," and "data subject" have the meanings assigned to them in Article 4 GDPR.

2. Name and Address of the Controller

The controller within the meaning of the GDPR, other data protection laws applicable in Member States of the European Union, and other data protection provisions is:

mycashbacks GmbH
Stefan-Heym-Platz 1
10367 Berlin
Germany
Phone: +49 (0)30 530 49 669
Email: privacy@mycashbacks.com
Website: www.mycashbacks.com

3. Data Protection Officer

You may contact the data protection officer directly at:

Data Protection Officer
mycashbacks GmbH
Stefan-Heym-Platz 1
10367 Berlin
Germany
Email: privacy@mycashbacks.com

Any data subject may contact our data protection officer at any time with questions or comments concerning data protection.

4. Cookies and Pixels

We use cookies to provide a broad range of functions and make our website easier to use. Cookies are small files stored on your device through your web browser. If you do not want cookies to be stored, you can adjust your browser settings accordingly. Please note that disabling cookies may limit the functionality and features of our services. Where consent is required for storing or accessing information on your device, we use the relevant technology only after obtaining your consent in accordance with Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, "TDDDG").

We and, where applicable, third parties may also use tracking pixels. Tracking pixels are small graphics embedded in webpages or messages that enable log-file recording and analysis and are frequently used for statistical evaluation. When you visit a page containing such a pixel, your browser may establish a direct connection with a server operated by us or the relevant third party. The server may receive information that the page was accessed from your device. If you are logged in to an account with that third party, the third party may be able to associate your visit with your account.

We may use pixels to determine whether an advertisement was successful and to measure advertising effectiveness for statistical and market-research purposes. The applicable legal basis depends on the specific technology and purpose. Where the technology is not strictly necessary, we obtain consent before using it. You may withdraw consent at any time with effect for the future through the available cookie or privacy settings.

5. Log Data: Collection of General Data and Information

Each time a person or automated system accesses our website, our systems may collect general data and information and store it in server log files. This information may include:

1. browser type and version;

2. the operating system used by the accessing device;

3. the website from which the accessing system reached our website (the referrer);

4. the subpages accessed on our website;

5. the date and time of access;

6. the Internet Protocol (IP) address; and

7. similar data and information used to protect our information technology systems against attacks.

We do not use this general data to identify the data subject. We need it to:

1. deliver our website content correctly;

2. optimize our website content and advertising;

3. maintain the long-term functionality of our information technology systems and website technology; and

4. provide law-enforcement authorities with information necessary for prosecution in the event of a cyberattack, where legally required.

The legal basis for temporarily storing this data is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable, and efficient operation of our website and the protection of our systems. Log-file data is deleted no later than seven days after collection unless longer retention is necessary to investigate a specific security incident or to comply with a legal obligation. Anonymous server-log data is stored separately from personal data submitted by a data subject.

6. Contacting Us Through the Website

Our website provides information that enables you to contact and communicate with us electronically, including by email. If you contact us by email or through a contact form, we store the personal data you voluntarily transmit for the purpose of handling your request and communicating with you. We do not disclose this data to third parties unless disclosure is necessary to process your request, required by law, or otherwise permitted under applicable data protection law.

We use the Contact Form 7 plugin to transmit data submitted through our contact form.

7. Routine Erasure and Restriction of Personal Data

We process and store personal data only for the period necessary to achieve the relevant purpose or for as long as retention is required by the European or national legislator in laws or regulations applicable to us. When the purpose no longer applies or a statutory retention period expires, the personal data is routinely restricted or erased in accordance with applicable law.

8. Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics creates pseudonymous usage profiles and uses cookies or comparable technologies. Information generated about your use of our website may include the time of access, referrer URL, browser and operating-system information, device and interaction data, and an IP address used transiently to derive general location information. Google states that Google Analytics 4 does not log or store individual IP addresses.

We use Google Analytics only with your consent under Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Google processes the information on our behalf to evaluate use of our website, compile reports on website activity, and provide other services relating to website and internet usage for market research and the needs-based design of our services. We have entered into a data processing agreement with Google under Article 28 GDPR.

Google Analytics retention settings determine how long user-level and event-level data is retained. Our configured retention period is two months. Aggregated reports may remain available after this period where they no longer permit identification of an individual user.

Data may be processed on servers in the United States. Where Google is certified under the EU-U.S. Data Privacy Framework ("DPF"), transfers to Google in the United States may be based on the European Commission's adequacy decision under Article 45 GDPR. Google also makes the European Commission's Standard Contractual Clauses available as a transfer safeguard where applicable.

You may withdraw or change your consent at any time with effect for the future through our cookie settings. Further information is available here:

• Google privacy frameworks and data transfers

• Google Analytics privacy and data safeguards

• Google Privacy Policy

9. Facebook and Meta

We have integrated components provided by Facebook and Meta into our website and, where indicated, our app. Facebook is a social media platform operated by Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, United States. For individuals residing outside the United States or Canada, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, is generally the responsible Meta entity.

9.1 Facebook Social Plugins

When a page containing a Facebook component is accessed, the component may cause your browser to download content from Facebook. Through this process, Facebook may learn which specific subpage of our website you visited. An overview of Facebook plugins is available in the Meta developer documentation.

If you are logged in to Facebook while visiting our website, Facebook may associate information about the pages you visit with your Facebook account for the duration of your visit. If you interact with a Facebook button or submit a comment, Facebook may assign that information to your account and store it. If you do not want Facebook to associate your visit with your account, log out of Facebook before visiting our website and consider adjusting your Meta privacy settings.

Our use of Facebook social components is based, where applicable, on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. To the extent a component is used without accessing nonessential information on your device, the processing may be based on our legitimate interest in the appropriate presentation and efficient operation of our services under Article 6(1)(f) GDPR, provided that your interests, rights, and freedoms do not override that interest.

9.2 Meta Pixel and Meta SDK

We also use the Meta Pixel and, where applicable in our app, the Meta SDK. These technologies allow us to measure the effectiveness of advertisements on Meta platforms, particularly Facebook and Instagram, and to identify visitors to our website or users of our app as target audiences for advertising (Custom Audiences). Meta may determine whether and which actions you take after clicking an advertisement (conversion tracking).

For these purposes, pseudonymous identifiers, technical device information, and information about your interactions with our services may be processed and transmitted to Meta. Transfers to the United States may be safeguarded through the DPF where the recipient is certified.

The Meta Pixel and Meta SDK are used only on the basis of your consent under Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. On iOS devices, we also obtain permission through Apple's App Tracking Transparency framework where required (see Section 23.2). You may withdraw your consent at any time with effect for the future through our cookie settings or your device tracking settings.

For more information, see Meta's Privacy Policy.

10. Affiliate Tracking Networks

We work with affiliate networks and partner programs to track referrals, attribute qualifying purchases, and process commission payments between merchants, affiliate networks, and mycashbacks. The following subsections identify the networks and operators listed in this Privacy Policy.

For each listed network, a tracking cookie or comparable identifier may be placed on your device. It may store a pseudonymous affiliate identifier, a reference number assigned to the website visit, and information identifying the advertising material or referral link clicked. The purpose is to attribute a transaction and facilitate commission processing. These identifiers may constitute personal data under the GDPR even if they do not directly identify you by name.

You may prevent or delete cookies through your browser or device settings. Doing so may prevent a purchase from being attributed to mycashbacks and may therefore prevent cashback from being tracked. Unless consent is required under Section 25 TDDDG or another applicable rule, the processing described in this section is based on our legitimate interest in operating, evaluating, and efficiently administering our affiliate and cashback services under Article 6(1)(f) GDPR, provided that your interests, rights, and freedoms do not override that interest.

10.1 Awin

We have integrated components of Awin into our services. Awin is a German network or partner program that provides affiliate marketing services. Awin is operated by AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany.

Awin may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Awin.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Awin from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.2 ADCELL

We have integrated components of ADCELL into our services. ADCELL is a German network or partner program that provides affiliate marketing services. ADCELL is operated by Firstlead GmbH, Rosenfelder Str. 15-16, 10315 Berlin, Germany.

ADCELL may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and ADCELL.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent ADCELL from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.3 CJ Affiliate

We have integrated components of CJ Affiliate into our services. CJ Affiliate is an international network or partner program that provides affiliate marketing services. CJ Affiliate is operated by Conversion Europe Limited, 1st Floor, 40 Dukes Place, London EC3A 7NH, United Kingdom.

CJ Affiliate may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and CJ Affiliate.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent CJ Affiliate from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.4 Tradedoubler

We have integrated components of Tradedoubler into our services. Tradedoubler is an international network or partner program that provides affiliate marketing services. Tradedoubler is operated by Tradedoubler GmbH, Herzog-Wilhelm-Straße 26, 80331 München, Germany.

Tradedoubler may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Tradedoubler.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Tradedoubler from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.5 Webgains

We have integrated components of Webgains into our services. Webgains is an international network or partner program that provides affiliate marketing services. Webgains is operated by ad pepper media GmbH, Frankenstraße 150C, FrankenCampus, 90461 Nürnberg, Germany.

Webgains may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Webgains.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Webgains from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.6 Otto

We have integrated components of Otto into our services. Otto is a German network or partner program that provides affiliate marketing services. Otto is operated by Otto GmbH & Co. KG, Werner-Otto-Straße 1-7, 22179 Hamburg, Germany.

Otto may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Otto.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Otto from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.7 Verivox

We have integrated components of Verivox into our services. Verivox is a German network or partner program that provides affiliate marketing services. Verivox is operated by Verivox GmbH, Am Taubenfeld 10, 69123 Heidelberg, Germany.

Verivox may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Verivox.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Verivox from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.8 TradeTracker

We have integrated components of TradeTracker into our services. TradeTracker is an international network or partner program that provides affiliate marketing services. TradeTracker is operated by TradeTracker Deutschland, Uhlandstraße 26, 22087 Hamburg, Germany.

TradeTracker may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and TradeTracker.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent TradeTracker from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.9 Saturn

We have integrated components of Saturn into our services. Saturn is a German network or partner program that provides affiliate marketing services. Saturn is operated by Saturn online GmbH, Wankelstr. 5, 85046 Ingolstadt, Germany.

Saturn may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Saturn.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Saturn from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.10 Adtraction

We have integrated components of Adtraction into our services. Adtraction is an international network or partner program that provides affiliate marketing services. Adtraction is operated by Adtraction Deutschland GmbH, Eichhornstraße 3, 10785 Berlin, Germany.

Adtraction may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Adtraction.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Adtraction from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.11 retailAds

We have integrated components of retailAds into our services. retailAds is a German network or partner program that provides affiliate marketing services. retailAds is operated by retailAds GmbH & Co. KG, Kaiserstraße 23, 90403 Nürnberg, Germany.

retailAds may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and retailAds.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent retailAds from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.12 Admitad

We have integrated components of Admitad into our services. Admitad is an international network or partner program that provides affiliate marketing services. Admitad is operated by Admitad GmbH, Lise-Meitner-Str. 8, 74074 Heilbronn, Germany.

Admitad may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Admitad.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Admitad from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.13 Partnerize

We have integrated components of Partnerize into our services. Partnerize is an international network or partner program that provides affiliate marketing services. Partnerize is operated by Performance Horizon Group Limited, 8th Floor, West One, Forth Banks, Newcastle upon Tyne NE1 3PA, United Kingdom.

Partnerize may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Partnerize.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Partnerize from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.14 uppr

We have integrated components of uppr into our services. uppr is an international network or partner program that provides affiliate marketing services. uppr is operated by uppr GmbH, Am Waldthausenpark 11, 45127 Essen, Germany.

uppr may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and uppr.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent uppr from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.15 lead alliance

We have integrated components of lead alliance into our services. lead alliance is an international network or partner program that provides affiliate marketing services. lead alliance is operated by lead alliance GmbH, Karlstraße 9, 90403 Nürnberg, Germany.

lead alliance may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and lead alliance.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent lead alliance from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.16 MCANISM

We have integrated components of MCANISM into our services. MCANISM is an international network or partner program that provides affiliate marketing services. MCANISM is operated by MCANISM Technology GmbH, Bei dem Neuen Krahn 2, 20457 Hamburg, Germany.

MCANISM may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and MCANISM.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent MCANISM from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.17 Media Intelligence Network

We have integrated components of Media Intelligence Network into our services. Media Intelligence Network is an international network or partner program that provides affiliate marketing services. Media Intelligence Network is operated by AMNET GmbH, Alsterufer 3, 20354 Hamburg, Germany.

Media Intelligence Network may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Media Intelligence Network.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Media Intelligence Network from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.18 communicationAds

We have integrated components of communicationAds into our services. communicationAds is a German network or partner program that provides affiliate marketing services. communicationAds is operated by communicationAds GmbH & Co. KG, Karlstraße 9, 90403 Nürnberg, Germany.

communicationAds may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and communicationAds.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent communicationAds from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.19 Vitrado

We have integrated components of Vitrado into our services. Vitrado is a German network or partner program that provides affiliate marketing services. Vitrado is operated by vitrado GmbH, a freenet AG company, Deelbögenkamp 4, 22297 Hamburg, Germany.

Vitrado may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Vitrado.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Vitrado from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.20 Tarifcheck

We have integrated components of Tarifcheck into our services. Tarifcheck is a German network or partner program that provides affiliate marketing services. Tarifcheck is operated by TARIFCHECK24 GmbH, Zollstraße 11b, 21465 Wentorf bei Hamburg, Germany.

Tarifcheck may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Tarifcheck.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Tarifcheck from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.21 TK-World

We have integrated components of TK-World into our services. TK-World is a German network or partner program that provides affiliate marketing services. TK-World is operated by TK-World AG, Oberes Feld 6, 33106 Paderborn, Germany.

TK-World may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and TK-World.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent TK-World from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.22 Impact Radius

We have integrated components of Impact Radius into our services. Impact Radius is an international network or partner program that provides affiliate marketing services. Impact Radius is operated by Impact Radius Limited, 15 Rathbone Place, London W1T 1HU, United Kingdom.

Impact Radius may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Impact Radius.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Impact Radius from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.23 Rakuten LinkShare Network

We have integrated components of Rakuten LinkShare Network into our services. Rakuten LinkShare Network is an international network or partner program that provides affiliate marketing services. Rakuten LinkShare Network is operated by Rakuten Marketing Europe Limited, 71 Queen Victoria Street, 7th Floor, London EC4V 4AY, United Kingdom.

Rakuten LinkShare Network may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Rakuten LinkShare Network.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Rakuten LinkShare Network from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.24 Amazon

We have integrated components of Amazon into our services. Amazon is an international partner network or partner program that provides affiliate marketing services. Amazon is operated by Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg, Luxembourg.

Amazon may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Amazon.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Amazon from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.25 Effiliation

We have integrated components of Effiliation into our services. Effiliation is an international network or partner program that provides affiliate marketing services. Effiliation is operated by Effiliation, Münchener Str. 23a, 85540 Haar, Germany.

Effiliation may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Effiliation.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Effiliation from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.26 eBay

We have integrated components of eBay into our services. eBay is an international network or partner program that provides affiliate marketing services. eBay is operated by eBay GmbH, Albert-Einstein-Ring 2-6, 14532 Kleinmachnow, Germany.

eBay may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and eBay.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent eBay from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.27 Medialead

We have integrated components of Medialead into our services. Medialead is a German network or partner program that provides affiliate marketing services. Medialead is operated by The Reach Group GmbH, Am Karlsbad 16, 10785 Berlin, Germany.

Medialead may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Medialead.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Medialead from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.28 DG Max

We have integrated components of DG Max into our services. DG Max is an international network or partner program that provides affiliate marketing services. DG Max is operated by DG Max Interactive, 555 8th Ave #401, New York, NY 10018, United States.

DG Max may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and DG Max.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent DG Max from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.29 Kwanko

We have integrated components of Kwanko into our services. Kwanko is an international network or partner program that provides affiliate marketing services. Kwanko is operated by Kwanko Deutschland GmbH, c/o WeWork Stadthaus, Axel-Springer-Platz 3, 20355 Hamburg, Germany.

Kwanko may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Kwanko.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Kwanko from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.30 belboon

We have integrated components of belboon into our services. belboon is an international network or partner program that provides affiliate marketing services. belboon is operated by belboon GmbH, Weinmeisterstr. 12-14, 10178 Berlin, Germany.

belboon may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and belboon.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent belboon from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.31 SIXT

We have integrated components of SIXT into our services. SIXT is an international partner network or partner program that provides affiliate marketing services. SIXT is operated by Sixt GmbH & Co. Autovermietung KG, Zugspitzstraße 1, 82049 Pullach, Germany.

SIXT may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and SIXT.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent SIXT from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.32 Douglas

We have integrated components of Douglas into our services. Douglas is an international partner network or partner program that provides affiliate marketing services. Douglas is operated by Parfümerie Douglas GmbH, Luise-Rainer-Straße 7-11, 40235 Düsseldorf, Germany.

Douglas may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Douglas.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Douglas from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.33 CHECK24 Private Network

We have integrated components of CHECK24 Private Network into our services. CHECK24 Private Network is an affiliate network or partner program that provides affiliate marketing services. CHECK24 Private Network is operated by TARIF CHECK24 GmbH, Zollstraße 11b, 21465 Wentorf bei Hamburg, Germany.

CHECK24 Private Network may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and CHECK24 Private Network.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent CHECK24 Private Network from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.34 Daisycon

We have integrated components of Daisycon into our services. Daisycon is an affiliate network or partner program that provides affiliate marketing services. Daisycon is operated by Daisycon B.V., P.J. Oudweg 5, 1314 CH Almere, Netherlands.

Daisycon may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and Daisycon.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent Daisycon from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

10.35 financeads

We have integrated components of financeads into our services. financeads is an affiliate network or partner program that provides affiliate marketing services. financeads is operated by financeAds GmbH & Co. KG, Karlstraße 9, 90403 Nürnberg, Germany.

financeads may place a tracking cookie or comparable identifier on your device. As explained above, the identifier may store a pseudonymous affiliate ID, a reference number assigned to the website visit, and information identifying the advertising material or referral link selected. The purpose is to attribute a transaction and facilitate commission payments between the merchant, affiliate, and financeads.

You may prevent or delete cookies through your browser or device settings. Such settings may also prevent financeads from placing an identifier and may prevent a qualifying purchase from being attributed to mycashbacks. The legal bases and safeguards described in the introduction to Section 10 apply.

11. Advanced Tag

We use advanced tag to optimize the delivery of relevant advertising. advanced tag is a product of advanced store GmbH, Stefan-Heym-Platz 1, 10367 Berlin, Germany. The technology collects technical information and data about visitors' browsing behavior through cookies stored on the device.

Based on an algorithmic analysis of browsing behavior, advanced store may display advertising banners for products and offers that are likely to be relevant to your interests on this and other websites. The cookies are used to optimize recommended advertising content. The technology is not intended to identify website users directly by name.

Where consent is required, we use advanced tag only on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time through our cookie settings. You may also use advanced store's opt-out page. Further information is available in the advanced store Privacy Policy.

12. mycashbacks Advertising Technology

Our website includes a technology component provided by mycashbacks GmbH, Stefan-Heym-Platz 1, 10367 Berlin, Germany. The component may collect technical information and data about visitors' browsing behavior using cookies stored on the device. Based on an algorithmic analysis of browsing behavior, products and offers that are likely to match a user's interests may be displayed in advertising banners on other websites.

mycashbacks may infer interests from browsing behavior and may share pseudonymous information with partners that display relevant interest-based advertising. We follow the European Interactive Digital Advertising Alliance (EDAA) framework for online behavioral advertising. Information and preference-management options are available through Your Online Choices.

We use this technology only with your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future through our cookie settings and may also use the available industry preference-management tools.

13. mycashbacks Cashback Finder Browser Extension

mycashbacks offers a browser extension called the mycashbacks Cashback Finder. The extension allows you to sign in to www.mycashbacks.com and activate cashback directly while visiting a participating merchant's website. When you sign in or use the extension, we process personal data such as your email address, user or account identifier, IP address, browser and extension information, and the data required to activate, attribute, and track cashback.

Processing that is necessary to provide the extension and attribute cashback is based on Article 6(1)(b) GDPR. Processing necessary for security, fraud prevention, and reliable technical operation may be based on our legitimate interests under Article 6(1)(f) GDPR. Where the extension stores or accesses nonessential information on your device, we obtain consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

14. Trustpilot Review Invitations

We work with the review platform Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark, to obtain authentic customer feedback and continuously improve our service. After you use our services, you may receive an email invitation to submit a review through Trustpilot.

For this purpose, we may transmit the following personal data to Trustpilot:

• your name; and

• your email address.

We process this data on the basis of our legitimate interest in measuring and presenting customer satisfaction under Article 6(1)(f) GDPR. You may object to this use at any time by contacting privacy@mycashbacks.com. Trustpilot processes personal data in accordance with its Privacy Policy for reviewers.

15. Chatbot Provided by melibo (ThinkingTech GmbH & Co. KG)

We use the melibo chatbot service provided by ThinkingTech GmbH & Co. KG, Darmstädter Str. 5, 64625 Bensheim, Germany. When you use the chatbot, the following personal data may be processed:

• connection data required to provide the service, such as your IP address;

• the content of conversations conducted through the chatbot; and

• background information required to answer your request.

The chatbot processes personal data after you actively consent by selecting the relevant acceptance control. The legal basis is Article 6(1)(a) GDPR. You may withdraw consent with effect for the future by closing the chatbot and deleting the applicable browser storage or using the available privacy settings.

After a chatbot conversation ends, dialogs may be stored in anonymized form and used to improve the service. Data is transmitted using SSL encryption, and access is protected through technical security measures, including layered firewalls. In some cases, the chatbot may ask for additional information, such as your name or email address, which is processed only if you actively provide it.

Background information stored by the chatbot may include:

• User ID: A randomly generated user ID is created when the chatbot is first used and stored locally in the browser. It remains until you delete the applicable browser data. If you return without deleting it, the chat history may remain available.

• Session ID: A new session ID is automatically generated for each new conversation and remains active for the duration of that session.

16. Freshdesk Support Ticketing

We use the Freshdesk ticketing system provided by Freshworks GmbH, Neue Grünstraße 17, 10179 Berlin, Germany, to efficiently receive, organize, and handle support requests submitted by email, chatbot, or contact form.

The following data may be transmitted to and stored in Freshdesk:

• your email address;

• your user ID, if you are registered on our platform;

• the information and content you provide through the chatbot, contact form, or email; and

• any additional information required to handle the support ticket.

Where processing is necessary to perform a contract or take steps at your request before entering into a contract, the legal basis is Article 6(1)(b) GDPR. For other inquiries, processing is based on our legitimate interest in handling requests efficiently and in a user-friendly manner under Article 6(1)(f) GDPR.

We have entered into a data processing agreement with Freshworks under Article 28 GDPR. Data is retained only for as long as necessary to handle your request, document the outcome, comply with legal obligations, or establish, exercise, or defend legal claims. Further information is available in the Freshworks Privacy Notice.

If you do not want your support request processed through Freshdesk, you may contact us by an alternative method, such as postal mail.

17. Google Fonts

We may use Google Fonts provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States. Where fonts are loaded from Google servers rather than hosted locally, your browser connects to Google and transmits technical connection data, including your IP address. If your browser does not support this function, a standard font available on your device will be used.

Where Google Fonts are loaded from Google servers, we do so only with your consent under Article 6(1)(a) GDPR. If information is stored on or accessed from your device, Section 25(1) TDDDG also applies. You may withdraw consent at any time through our cookie settings.

Further information:

• Google Fonts FAQ

• Google Privacy Policy

• Google ad and privacy settings

18. Google Hosted Libraries

We may use Google Hosted Libraries provided by Google Ireland Limited and Google LLC. When libraries are loaded from Google servers, your browser connects to Google and transmits technical connection data, including your IP address. If the libraries cannot be loaded, some website functions may be limited.

Where the libraries are required to provide a function you request, processing is based on Article 6(1)(f) GDPR and our legitimate interest in the secure and efficient operation of our website. Where consent is legally required, processing occurs only on the basis of Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

Further information:

• Google Hosted Libraries

• Google Privacy Policy

19. Hotjar

We use Hotjar to better understand user needs and improve the experience and performance of our website. Hotjar helps us understand, for example, how long users spend on particular pages, which links they select, and which parts of the service are easy or difficult to use.

Hotjar uses cookies and similar technologies to collect data about user behavior and devices. This may include a shortened or otherwise protected IP address, screen size, device type or unique device identifiers, browser information, country-level location, and preferred language. Hotjar processes this information on our behalf in a pseudonymous user profile and is contractually prohibited from selling data collected on our behalf.

We use Hotjar only with your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent at any time through our cookie settings. Further information is available through the Hotjar/Contentsquare privacy and trust portal.

20. IPQualityScore

We use IPQualityScore, a service provided by IPQualityScore LLC in the United States, to validate email addresses and telephone numbers and to assess fraud or abuse risk. This helps protect the integrity and security of our platform. The legal basis is our legitimate interest in preventing fraudulent or abusive use of our services under Article 6(1)(f) GDPR.

Where personal data is transferred to the United States, we use an applicable transfer mechanism under Chapter V GDPR. Further information is available in the IPQualityScore Privacy Policy.

21. Marketing: The mycashbacks Newsletter

If you expressly consent, we use your email address to send you our newsletter with information about mycashbacks, offers, and special promotions. The legal basis is Article 6(1)(a) GDPR. We record your consent as required by law. An email address is sufficient to subscribe.

You may unsubscribe at any time by using the link at the end of each email or by emailing support@mycashbacks.com. We then remove your email address from the active mailing list and may place it on a suppression list to ensure that no further newsletter is sent. Withdrawal applies only to future processing and does not affect the lawfulness of processing carried out before withdrawal.

21.1 Newsletter Tracking

We evaluate newsletter performance using pseudonymous usage statistics. Emails may contain web beacons, tracking pixels, and tracked links associated with an individual identifier. These technologies may record when an email is opened or forwarded, which links are selected, the IP address used to estimate the location of access, and information about the email client.

We evaluate aggregated statistics such as delivery, open, click-through, forwarding, and bounce rates and the country of access. In the event of an unsubscribe request or failed delivery, we also receive the name and email address needed to remove the recipient or resolve the delivery issue.

Where tracking requires storing or accessing information on your device, it is carried out only with consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Other pseudonymous evaluation that does not require consent may be based on our legitimate interest in measuring and improving our email marketing under Article 6(1)(f) GDPR. You may withdraw consent or object to processing based on legitimate interests at any time with effect for the future.

21.2 Delivery and Evaluation Through Mailchimp

We use Mailchimp, a service provided by Intuit Inc. and The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, United States, to deliver and evaluate newsletter emails.

Data processed in connection with newsletter delivery and evaluation may be stored on servers in the United States. Where the recipient is certified under the DPF, the transfer may be based on the European Commission's adequacy decision under Article 45 GDPR. Mailchimp acts as our processor under Article 28 GDPR. Further information is available in the Mailchimp Privacy Statement and the Mailchimp legal information.

22. Disclosure to Technical Partners for Cashback, Miles, Voucher, and Payout Processing

22.1 TBNS.io (Topbonus Loyalty & Bonus GmbH)

We work with TBNS.io, operated by Topbonus Loyalty & Bonus GmbH, Stefan-Heym-Platz 1, 10367 Berlin, Germany, for the technical processing of cashback payments and bonus points.

Where necessary to process cashback transactions and fulfill contractual obligations, we may transmit personal data such as transaction information, email address, user ID, cashback data, and bonus data to TBNS. The legal bases are Article 6(1)(b) GDPR and, where applicable, our legitimate interest in providing the service under Article 6(1)(f) GDPR.

TBNS is contractually required to process the data in accordance with applicable data protection law and to maintain appropriate technical and organizational safeguards. Further information is available in the TBNS Privacy Policy or from the data protection contact at marc@advanced-store.com.

22.2 qiibee AG (Miles & More)

In connection with participation in the Miles & More rewards program, we work with qiibee AG, Alpenstrasse 7, 6300 Zug, Switzerland.

If you convert cashback into Miles & More award miles, we transmit the data required to fulfill that request, such as the invoice amount, transaction information, and Miles & More service card number, to qiibee AG for processing and forwarding to Miles & More. The legal basis is Article 6(1)(b) GDPR. Further information is available in the qiibee Privacy Policy.

22.3 adjoe myCashGames

myCashGames is a gaming area within our platform where users can earn cashback or points by installing and using game apps. The technical service is provided by adjoe GmbH, An der Alster 42, 20099 Hamburg, Germany.

To display suitable games and attribute activity to a user account, we transmit a pseudonymous user identifier and technical device information to adjoe, including device identifier, device type, and operating-system information. On iOS, the Identifier for Advertisers (IDFA) is transmitted only after the required system-level permission has been granted.

adjoe may also process information about installed apps and usage events within newly installed game apps where necessary to provide the service, prevent fraud, and calculate compensation. mycashbacks receives only information relevant to compensation, such as the game name and compensation amount, and does not receive detailed information about the user's activity within individual apps.

Processing is based on Article 6(1)(b) GDPR for performance of the contract and Article 6(1)(f) GDPR for fraud prevention. Further information is available in the adjoe Privacy Policy.

22.4 CPX Research Surveys

We allow users to participate in compensated online surveys. The technical service is provided by Make Opinion GmbH, Elfenallee 5, 13127 Berlin, Germany.

To provide suitable surveys, we transmit a pseudonymous user identifier, technical device and browser information, and a shortened IP address. If you voluntarily provide information in a survey, basic demographic information such as age, gender, or country may also be processed. Participation-status information may be processed, including whether a survey was completed, abandoned, or resulted in disqualification.

Processing is based on Article 6(1)(b) GDPR to provide the service and Article 6(1)(f) GDPR for fraud prevention and the secure and economically viable operation of the service. Further information is available in the CPX Research Privacy Policy.

22.5 Runa Shopping Vouchers

Where mycashbacks offers the option to redeem a balance for shopping vouchers, the technical provision and delivery of vouchers is handled through Runa. For users in the European Union, the relevant provider is Runa Network GmbH, Eschersheimer Landstraße 42, 60322 Frankfurt am Main, Germany ("Runa").

If you choose a shopping-voucher redemption, we transmit the data required to provide and deliver the voucher, in particular your name and email address, to Runa. The legal basis is Article 6(1)(b) GDPR.

Runa may process personal data outside the European Union. Where required, international transfers are protected by appropriate safeguards under Article 46 GDPR, in particular the European Commission's Standard Contractual Clauses. Further information is available in Runa's Privacy Policy.

22.6 Bank Transfer Payouts

This section does not apply to users in the United States because bank-transfer payouts are not available to users in the United States.

Where bank-transfer payouts are available and you select this option, we process the payment information required to execute the payout, including the account holder's name, IBAN, BIC where applicable, payout amount, and transaction reference. The legal basis is Article 6(1)(b) GDPR. Banks and payment-service providers involved in the transaction process data under their own legal obligations and privacy notices.

22.7 PayPal Payouts

You may choose to receive cashback through PayPal. We process the information required to execute the payout, in particular your name, the email address associated with your PayPal account, the payout amount, and transaction information, and initiate the payment through our PayPal account. The legal basis is Article 6(1)(b) GDPR.

The PayPal entity responsible for PayPal's own processing depends on the country in which your PayPal account is registered. For accounts in the European Economic Area, this is generally PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. U.S. PayPal accounts are generally provided by PayPal, Inc. For further information, see the U.S. PayPal Privacy Statement. PayPal may direct you to the policy applicable to your account and jurisdiction.

23. Data Processing in Our Mobile Apps (iOS and Android)

When you use our iOS or Android app, we process, in addition to the data described elsewhere in this Privacy Policy, certain information generated specifically in connection with app use.

The app is made available through the Apple App Store and Google Play Store. When you download the app, the relevant app-store operator processes information associated with the download and your store account. Apple or Google is responsible for that processing under its own privacy policy. Further information is available in Apple's Privacy Policy and Google's Privacy Policy.

23.1 Device Identifiers and Advertising IDs

Our app may process device identifiers and advertising identifiers associated with your device or app installation. On iOS, this includes the Identifier for Advertisers (IDFA); on Android, it includes the Google Advertising ID, also known as the Android Advertising ID or AAID. App-specific installation identifiers may also be used.

These identifiers allow us and our service providers to recognize app use without directly using your name. We use them to maintain app functionality and stability, analyze app use statistically, correctly attribute and settle cashback transactions, and prevent fraud.

On iOS, we access the IDFA only if you have granted permission through Apple's App Tracking Transparency dialog (see Section 23.2). On Android, you may reset the advertising ID or restrict its use in your system settings. Where consent is required, the legal basis is Article 6(1)(a) GDPR. Otherwise, processing may be based on Article 6(1)(b) GDPR where necessary to provide or attribute cashback, or on our legitimate interest in operating the app securely, reliably, and efficiently under Article 6(1)(f) GDPR.

23.2 App Tracking Transparency on iOS

On Apple devices running iOS or iPadOS, we use Apple's App Tracking Transparency ("ATT") framework where required by Apple. Before we or a service provider accesses your device's IDFA or performs tracking across apps or websites owned by other companies, your device displays a system prompt allowing you to permit or decline tracking.

If you do not grant permission, we do not access the IDFA or perform the tracking covered by the ATT prompt. The legal basis for processing based on that permission is Article 6(1)(a) GDPR. You may change your choice at any time under Settings > Privacy & Security > Tracking, with effect for the future.

23.3 Push Notifications Through CleverPush

You may sign up to receive push notifications. We use CleverPush, operated by CleverPush GmbH, Valentinskamp 30, 20355 Hamburg, Germany ("CleverPush"). Our push notifications may contain information about new cashback offers, limited-time promotions and deals, cashback status, and news about our app and website.

To subscribe, you must confirm the notification request displayed by your browser or device. CleverPush documents the subscription and stores the time of registration and a push token or device ID. This information is used to send notifications and document the subscription. The legal basis is your consent under Article 6(1)(a) GDPR.

CleverPush may statistically analyze whether and when notifications were displayed and selected. We may also store the topics or interests to which you subscribed so that notifications can be tailored. Where this evaluation is not covered by consent, it is based on our legitimate interest in understanding and improving notification relevance under Article 6(1)(f) GDPR.

You may withdraw consent at any time with effect for the future using the push-notification settings in your device or browser. You may also object to processing based on Article 6(1)(f) GDPR. Withdrawal does not affect processing carried out before withdrawal. Subscription data is deleted when it is no longer needed and is generally retained for as long as your push subscription remains active.

To accelerate retrieval of general content, such as text and images, and protect against attacks, CleverPush uses services provided by Cloudflare, Inc. as a subprocessor. When your device retrieves this content, it connects to Cloudflare and the device IP address is processed. Transfers to the United States may be based on the DPF where the recipient is certified or another valid transfer mechanism under Chapter V GDPR.

We have entered into a data processing agreement with CleverPush under Article 28 GDPR. Further information is available on CleverPush's GDPR page.

23.4 Firebase (Google)

We use services from the Firebase platform in our app. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Firebase in particular for:

• Firebase Cloud Messaging, to technically deliver push notifications to your device;

• Firebase Crashlytics, to collect and analyze crashes and stability issues so that we can identify and fix errors; and

• Google Analytics for Firebase, to perform pseudonymous statistical analysis of app use and improve our services.

Technical and usage data may be processed, including a device or app-instance identifier, device type and operating-system version, app version, crash and diagnostic data, approximate location such as country, and information about interactions with the app. Information may be processed on Google servers, including servers in the United States. Transfers to the United States may be safeguarded by the DPF where Google is certified and, where applicable, the European Commission's Standard Contractual Clauses.

Where consent is required for analytics, diagnostics, advertising identifiers, or access to information on your device, we process the data only on the basis of Article 6(1)(a) GDPR and any required ATT permission. Processing required to deliver push notifications through Firebase Cloud Messaging is carried out in connection with your consent to receive push notifications. You may withdraw consent at any time with effect for the future.

We have entered into a data processing agreement with Google under Article 28 GDPR. Further information is available in the Firebase Privacy and Security documentation and the Google Privacy Policy.

23.5 App Permissions

To provide certain features, the app requests permissions on your device, including permission to send push notifications. If another permission is required, the app requests it in the relevant context and explains its purpose. You can review, change, or revoke granted permissions at any time in your device settings with effect for the future.

Depending on the feature, processing of data accessed through a permission is based on consent under Article 6(1)(a) GDPR, performance of a contract under Article 6(1)(b) GDPR, or our legitimate interest in providing the requested feature securely and reliably under Article 6(1)(f) GDPR.

24. Retention Period for Personal Data

The applicable statutory retention period is one criterion for determining how long personal data is stored. After that period expires, the relevant data is routinely erased unless it remains necessary to perform or enter into a contract, comply with another legal obligation, or establish, exercise, or defend legal claims.

Where no specific statutory period applies, we retain personal data only for as long as necessary for the purposes described in this Privacy Policy, taking into account the nature and sensitivity of the data, the purposes of processing, and the potential risks to data subjects.

25. Legal or Contractual Requirements to Provide Personal Data

Providing personal data may be required by law, for example under tax rules, or by a contract. In some cases, we cannot enter into or perform a contract unless you provide the personal data required for that purpose. Failure to provide required data may therefore mean that the relevant contract or service cannot be concluded or provided.

Before you provide personal data, you may contact us to ask whether the information is required by law or contract, necessary to enter into a contract, or voluntary, and what consequences may result if it is not provided.

26. Rights of Data Subjects

If the GDPR applies to the processing of your personal data, you have the rights described below, subject to the statutory requirements and exceptions. To exercise a right, contact our data protection officer or another mycashbacks employee using the contact information in Sections 2 and 3. We may need to verify your identity before fulfilling a request.

26.1 Right to Confirmation

You have the right to obtain confirmation as to whether we process personal data concerning you.

26.2 Right of Access

You have the right to obtain, free of charge, information about personal data we process concerning you and a copy of that data. Subject to Article 15 GDPR, this includes information about:

• the purposes of processing;

• the categories of personal data processed;

• the recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organizations;

• where possible, the planned retention period or, if that is not possible, the criteria used to determine it;

• the existence of the right to request rectification or erasure, restriction of processing, or to object to processing;

• the right to lodge a complaint with a supervisory authority;

• where the personal data was not collected from you, any available information about its source; and

• the existence of automated decision-making, including profiling under Article 22(1) and (4) GDPR, and, at least in those cases, meaningful information about the logic involved and the significance and intended consequences of the processing for you.

If personal data is transferred to a third country or an international organization, you also have the right to be informed of the appropriate safeguards relating to the transfer.

26.3 Right to Rectification

You have the right to request the prompt correction of inaccurate personal data concerning you. Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.

26.4 Right to Erasure (Right to Be Forgotten)

You have the right to request the prompt erasure of personal data concerning you where one of the following grounds applies and processing is not otherwise necessary:

• the data is no longer necessary for the purposes for which it was collected or otherwise processed;

• you withdraw consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for processing;

• you object under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object to processing for direct marketing under Article 21(2) GDPR;

• the personal data has been processed unlawfully;

• erasure is necessary to comply with a legal obligation under European Union or Member State law applicable to us; or

• the personal data was collected in relation to information-society services offered to a child under Article 8(1) GDPR.

If one of these grounds applies, you may ask us to erase personal data stored by mycashbacks GmbH. We will arrange for the request to be handled without undue delay, subject to the exceptions in Article 17(3) GDPR.

Where mycashbacks has made personal data public and is required to erase it under Article 17(1) GDPR, we will take reasonable steps, taking available technology and implementation costs into account, to inform other controllers processing the data that you requested erasure of links to, copies of, or replications of that personal data, to the extent required by Article 17(2) GDPR.

26.5 Right to Restriction of Processing

You have the right to request restriction of processing where one of the following conditions applies:

• you contest the accuracy of the personal data, for the period necessary for us to verify its accuracy;

• processing is unlawful and you oppose erasure and request restriction instead;

• we no longer need the personal data for processing purposes, but you need it to establish, exercise, or defend legal claims; or

• you have objected under Article 21(1) GDPR and verification is pending as to whether our legitimate grounds override yours.

If a condition applies, you may ask us to restrict the affected personal data.

26.6 Right to Data Portability

You have the right to receive personal data concerning you that you provided to a controller in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance where:

• processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR, or on a contract under Article 6(1)(b) GDPR; and

• processing is carried out by automated means.

When exercising this right, you may also have the data transmitted directly from one controller to another where technically feasible, provided that doing so does not adversely affect the rights and freedoms of others. This right does not apply to processing necessary to perform a task carried out in the public interest or in the exercise of official authority.

26.7 Right to Object

You have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.

If you object, we will no longer process the personal data unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary to establish, exercise, or defend legal claims.

Where personal data is processed for direct marketing, you have the right to object at any time to processing for that purpose, including related profiling. If you object to direct marketing, we will no longer process the personal data for that purpose.

You may also object, on grounds relating to your particular situation, to processing for scientific or historical research or statistical purposes under Article 89(1) GDPR unless the processing is necessary to perform a task carried out for reasons of public interest. In connection with information-society services, you may exercise your right to object through automated means using technical specifications where available.

26.8 Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, unless the decision:

1. is necessary to enter into or perform a contract between you and the controller;

2. is authorized by European Union or Member State law applicable to the controller and that law provides suitable safeguards for your rights, freedoms, and legitimate interests; or

3. is based on your explicit consent.

Where a decision is necessary for a contract or based on explicit consent, mycashbacks will implement suitable measures to safeguard your rights, freedoms, and legitimate interests, including at least the right to obtain human intervention, express your point of view, and contest the decision.

26.9 Right to Withdraw Consent

You have the right to withdraw consent to the processing of personal data at any time. Withdrawal applies with effect for the future and does not affect the lawfulness of processing carried out before withdrawal.

26.10 Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. You may lodge a complaint in particular with a supervisory authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

The supervisory authority responsible for mycashbacks GmbH is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59-61
10555 Berlin
Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de

27. Changes to This Privacy Policy

We may amend or update this Privacy Policy from time to time, including to reflect changes to our services, processing activities, or legal requirements. We will publish the current version here.

Last updated: August 2026