Privacy Policy

1. Privacy at a Glance

We are pleased about your visit to our website. The protection of your personal data is an important concern for us. Below we inform you about which data we process during your visit and how we protect it.

2. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

3. Provision of the Website and Server Log Files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:

• Browser type and version used
• The user's operating system
• The user's Internet service provider
• The user's IP address
• Date and time of access
• Websites from which the user's system accesses our website (referrer)

The legal basis for the temporary storage of this data and the log files is Art. 6 para. 1 lit. f GDPR (legitimate interest in ensuring the stability, functionality, and security of the website). The data is deleted as soon as it is no longer required to achieve the purpose of its collection.

4. Web Hosting

We host the content of our website with the following provider:

Server log files (as described in Section 3) are processed on the web hoster's servers. The legal basis for hosting is our legitimate interest in providing a secure, fast, and efficient online presence (Art. 6 para. 1 lit. f GDPR). Data transfer to the US is based on EU Commission Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework, as the provider is certified accordingly. We have entered into a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with the provider.

5. Redirects and Click Statistics (Supabase)

BoughtToKeep is a price comparison engine. When you click the button for a store offer, you are redirected to the partner shop via our redirect API (`/api/redirect`).

To measure clicks and monitor the functionality of our links, we log the click in our Supabase database. The following data is stored:

• ID of the clicked offer (Offer-ID)
• ID of the associated media item (Media-ID)
• The name of the partner shop (e.g., iTunes, Amazon, Thalia)
• The timestamp of the click

Important: We do not store any personal data such as your name, email address, or IP address in our click log database. The collection is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR to optimize our portal and track partner links.

The database service provider is Supabase Inc., 970 Summer St, Stamford, CT 06905, USA. We have concluded a Data Processing Agreement (DPA) with Supabase.

6. Cookies

Our website uses a functional cookie to store your preferred language setting:

• Name: `locale`
• Purpose: Stores the manually selected language setting (`de` or `en`) so that the page is loaded directly in the correct language on your next visit.
• Storage duration: 30 days

The legal basis for the use of this cookie is Art. 6 para. 1 lit. f GDPR (technically necessary to provide the function explicitly requested by the user, namely language selection).

7. Affiliate Networks, Partner Programs, and External Links

We integrate affiliate links from various platforms (e.g., Amazon Associates, Awin for Thalia, Apple Partnerize). If you click on such a link and subsequently purchase a product in the shop, we may receive a commission.

To track sales, we append parameters to URLs when redirecting via our redirect API (e.g., PartnerTags or Affiliate-IDs). Affiliate networks may use cookies to track that you reached the shop via our portal.

Furthermore, we link to other download stores (e.g., Google Play, Bandcamp, Qobuz) for price comparison. When you click these links, you will be redirected to those external platforms.

Data processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the commercial analysis and operation of our free comparison portal. For more information, please refer to the privacy policies of the respective operators:

• Amazon: Amazon Privacy Notice
• Awin (Thalia): Awin Privacy Policy
• Apple / Partnerize (iTunes): Apple Privacy Policy
• Google / Google Play Books: Google Privacy Policy
• Bandcamp: Bandcamp Privacy Policy
• Qobuz: Qobuz Privacy Policy

8. Your Rights as a Data Subject

You have the right:

• To request information about your personal data processed by us (Art. 15 GDPR).
• To request the correction of incorrect or completion of your data stored by us (Art. 16 GDPR).
• To request the deletion of your data stored by us (Art. 17 GDPR).
• To request restriction of processing of your data (Art. 18 GDPR).
• To receive your data in a structured, commonly used and machine-readable format (Art. 20 GDPR).
• To complain to a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR).

If your data is processed based on legitimate interests, you have the right to object to the processing (Art. 21 GDPR).