Privacy

Draft for legal review. Reviewed by a qualified lawyer on: ____________

Who we are

, registered with the Dutch Chamber of Commerce (KvK) under , VAT number . We are the controller for the processing described here. You can reach us at .

The short version

This website does not use cookies, does not ask you to create an account, and does not build a profile of you. We do not know who you are and we have deliberately built it so that we cannot find out. There is exactly one exception, and it only happens if you ask for it: if you sign up for a price alert we hold your email address until you tell us to stop.

Analytics

We use Plausible Analytics, which is hosted in the EU, stores no cookies, and does not collect or store any personal data or cross-site identifiers. It counts page views in aggregate. Because nothing is stored on your device and no personal data is processed, there is no consent banner on this site. If we ever change analytics provider to one that does store something on your device, we will ask you first.

When you click through to a shop

Links to shops open a new tab on this site at /out/..., which names the shop and then goes through /go/... so that we can (a) check the link is safe before sending you there and (b) count that the click happened. We record: which offer was clicked, which shop, which network, which of our own pages you came from, and the time.

We do not record your IP address, your browser, a device fingerprint, a cookie, or any identifier for you. The click record cannot be linked back to a person, by us or by anyone who obtained our database. It answers “was this offer clicked”, not “who clicked it”.

We attach a random reference to the outgoing link so that the shop’s affiliate network can tell us later that a sale happened. That reference is generated randomly, is not derived from anything about you, and means nothing outside our own click table.

Price alerts, the one thing we store about you

If you ask us to tell you when a product gets cheaper, we store three things: your email address, the product you searched for, and the price you named. Nothing else. Not your name, not which other products you looked at, not the address you connected from, and nothing that links this to the click records described above.

We use it to send you one email, once, when that product reaches that price. If the price goes back up and falls again you will hear once more. We do not send anything else to that address - no newsletter, no offers, no “we noticed you were looking at” - and we never pass it to a shop, an affiliate network or anybody else. Legal basis: your consent (Art. 6(1)(a)), given by asking for the alert.

Every one of those emails carries a link that deletes the record. It deletes it - it does not mark it as unsubscribed and keep it, because a kept record is still your address in our database. Your mail program’s own unsubscribe button does the same thing. After that we hold nothing about you again.

The email itself is sent for us by a mail provider, who therefore processes your address on our behalf under a data processing agreement. We check the price using searches other visitors were already making, so asking for an alert does not cause us to go looking on a schedule.

What the shop does after you leave

Once you land on a shop’s website you are on their site under their privacy policy, and they will typically set their own cookies including affiliate tracking. We have no control over and no access to that.

Server logs and abuse prevention

Our hosting provider processes connection data, including IP addresses, in order to deliver the site and to prevent abuse. We limit how many redirects a single address can request in a minute; to do that the address is hashed in memory for the length of that minute and then discarded. It is not written to disk or to our database. Legal basis: legitimate interests (Art. 6(1)(f)) in keeping the service available and preventing click fraud.

Legal bases

• Providing the comparison, including the click record: legitimate interests (Art. 6(1)(f)). The click record contains no personal data, so this concerns the connection data our host processes to serve it.
• Security and abuse prevention: legitimate interests (Art. 6(1)(f)).
• Price alerts: consent (Art. 6(1)(a)), given by asking for one and withdrawn by the link in every email, which deletes the record.
• Any future feature that stores something on your device or identifies you: consent (Art. 6(1)(a)), requested first, refusable, and withdrawable.

Processors

Our hosting provider, our database provider, our error-tracking provider, our analytics provider and the mail provider that sends price alerts process data on our behalf under written data processing agreements. UNCERTAIN: list them by name here before launch, and confirm the transfer position for any provider outside the EEA.

Retention

Click records and price history are kept indefinitely, because they contain no personal data and the price history is the point of the site. A price alert is kept until you unsubscribe, at which point the record is deleted rather than archived. Server logs are kept for as long as our hosting provider retains them - UNCERTAIN: state the actual period once the provider is chosen.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability under the GDPR. Unless you have asked for a price alert we hold no personal data about you at all, so there is usually nothing to access or erase - but write to us and we will tell you exactly that, in writing, and explain what we checked. You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Changes

If this notice changes materially we will say so on this page with the date. Last updated: unreleased draft.