Privacy Policy

1. Controller

GeschenkOn GmbH, Königsallee 2b, 40212 Düsseldorf, Germany

Email: [email protected]

2. Purposes and legal bases of processing

We process personal data in order to provide our website, user accounts, order and voucher functions, partner processes, security mechanisms and the documentation and billing processes required by law.

• Provision of the website, public content, search functions, user accounts and platform functions for the initiation and performance of contracts (Art. 6(1)(b) GDPR).
• Processing of orders, vouchers, redemptions, refunds, invoices and partner settlements, including electronic invoice formats (Art. 6(1)(b) and (c) GDPR).
• Review, activation and ongoing support of partners, contract management, onboarding, role assignment, invitation and approval processes and preparation of payouts (Art. 6(1)(b), (c) and (f) GDPR).
• Sending transaction-related emails, delivery monitoring, security and evidence logs, support handling and abuse prevention (Art. 6(1)(b) and (f) GDPR).
• Securing the platform, authentication, fraud prevention, audit logging, technical error analysis, load balancing and operational stability (Art. 6(1)(f) GDPR).
• Obtaining, managing and documenting cookie and tracking consents via our consent management (Art. 6(1)(a), (c) and (f) GDPR).
• Delivery, provision and redemption of vouchers for recipients named by the buyer, a business customer or an issuing partner (Art. 6(1)(f) GDPR, section 6a).
• Promotional push notifications in the GeschenkOn app only with your consent (Art. 6(1)(a) GDPR, section 7a).

Our legitimate interest lies in particular in the secure, stable and economically sensible provision of the platform, in the prevention of abuse, in audit-proof documentation and in the defence and enforcement of legal claims.

3. Categories of personal data

• Account data: email address, display name, language settings, optionally date of birth and status information.
• Authentication and security data: IP address, user agent, device and session data, social login identifiers, passkey/WebAuthn-related credential data, challenge and verification logs, step-up events.
• Usage and access data: requested URLs, referrers, timestamps, response codes, request IDs, device and browser characteristics and server-side logs.
• Transaction data: order numbers, order items, voucher IDs, voucher type, versions of legal notices, checkout confirmations, payment status, invoice data, tax-relevant data, shipping and fulfilment information, refund and cancellation processes.
• Partner and contract data: contact persons, business master data, contract status, onboarding status, role and invitation data, review and approval notes, payout and bank verification data, settlement triggers, holding periods, billing cycles and technical approval status.
• Communication data: support requests, transaction-related emails, delivery status, delivery events, dispatch metadata and communication histories.
• Consent and cookie data: consent ID, consent status, categories, timestamps and technically necessary cookie information.
• Billing and e-invoice data: billing months, net, tax and gross amounts, correction and cancellation processes, file metadata and structured document content. For a multi-purpose voucher redemption receipt exceeding EUR 250.00, this may include the name, address and country of the actual recipient of the service.
• Audit and abuse data: approval histories, role changes, security events, delivery and webhook metadata, abuse signals and technical evidence.

4. User account, authentication and social login

For registration, login and account management we currently use Google Cloud Identity Platform. Depending on the method chosen, we process in particular the email address, technical user IDs, session information, status data and security-relevant authentication data.

In addition, we support passkey/WebAuthn-based login and security functions. For this purpose we store the necessary technical credential data and security logs, but no raw biometric data. The biometric or device-based authorisation takes place locally on the user's device.

We currently offer social login via Google. Depending on the information released, we process in particular the email address, the technical account ID and basic profile data.

5. Partner onboarding, contracts and role management

When companies or representatives apply as partners via our platform, or when existing partner access is managed administratively, we process additional business-related and personal data.

This includes in particular the company name, contact persons, business contact and address data, onboarding and contract status, intended use of the platform, review and approval notes and contract and document metadata.

The KYC, identity, representation, tax, document and payout bank data required for a Stripe connected account are collected and verified directly by Stripe in its embedded components during active onboarding. For this process GeschenkOn generally stores only the Stripe account reference, technical status and requirement codes, timestamps and necessary audit data, but not newly entered identity documents, selfies, complete bank details or KYC form contents.

Historical onboarding profile data collected before the changeover may continue to exist in blocked form until a documented retention and deletion review has been completed. It is not reused or displayed in active Stripe onboarding. Contract and company data required by law is processed separately from Stripe KYC data.

For controlled assignment of rights, we also process operator invitations and role information. This includes the recipient's email address, the target role, the associated franchise, brand or shop, the invitation status, the expiry date, dispatch, acceptance, rejection, cancellation and re-dispatch events and the responsible administrator.

When a partner contract is concluded electronically through our partner portal, we store the following as proof of conclusion: the time the contract offer was submitted and accepted, the contract version and language displayed, checksums of the contract documents shown and of the contract summary, the wording of the confirmed declarations, the company and representation details provided, and hash values of the IP address and the browser identifier. We do not store the IP address and the browser identifier in plain text for this purpose. We likewise store offers to renew or amend the contract, reasons for rejection and the dispatch of the related notifications. The legal bases are the performance of the contract (Art. 6(1)(b) GDPR), compliance with statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with section 147 of the German Fiscal Code and section 257 of the German Commercial Code) and our legitimate interest in securing evidence (Art. 6(1)(f) GDPR). We keep this evidence for ten years after the end of the calendar year in which the contract ends; the hash values of the IP address and the browser identifier are deleted three years after the end of that calendar year.

6. Orders, vouchers, payments, settlement and e-invoicing

To perform contracts, we process order, voucher, payment, communication and status data. This includes order numbers, order item data, voucher IDs, recipient references, payment references, invoice numbers and tax-relevant documentation data.

Payment is processed in live operation via Stripe as the technical payment service provider. In this context we process payment, checkout, payment status, webhook and reconciliation data to the extent necessary for contract performance, fraud prevention, evidence and tax documentation.

To show Kakao Pay and Naver Pay only for access from South Korea, we use a country indication. It is determined by our network and security service provider Cloudflare, Inc. (USA), acting as our processor, from the IP address of your access; Cloudflare passes only the country code to us. We do not use an IP address ourselves for this check, and we do not store or log the country code.

Payment methods. Payment is processed via Stripe. If you choose Klarna, the data required to process the payment (name, billing address, email address, order amount and order items) is transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, which may carry out identity and credit checks as an independent controller; Klarna's privacy notice applies. If you choose Google Pay, payment is made with the payment details stored in your Google account; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes these data as an independent controller in accordance with its privacy policy. GeschenkOn does not receive full card details. The legal basis is Art. 6(1)(b) GDPR.

In addition to end-customer orders, we process partner-related settlement, payout and e-invoice data. This includes in particular billing periods, net, tax and gross amounts, payout references, Stripe Connect-related verification and payout status data, correction or cancellation processes and structured data for electronic invoice formats such as XRechnung or ZUGFeRD.

For new voucher structures, we store for each order item the voucher type, the applicable version of the legal notice, the required checkout confirmations and a snapshot of the settlement policy. This data serves contract performance, evidence, partner settlement, tax documentation and the handling of queries or reversals.

In the SC&T payment flow, we also process immutable allocation and audit data relating to the checkout batch, seller order, franchise, payment reference, partner gross revenue, commission, tax, cross-border transfer service fee, small-order surcharge, partner transfer, transfer reversal, refund, dispute, chargeback and correction. Every economically relevant entry is given a unique event key, a reference to the originating object and an integrity hash; corrections are made by means of offsetting or correcting entries. This evidence is processed only to the extent necessary and for contract performance, billing, fraud prevention, legal defence and statutory tax and retention obligations.

If an individual multi-purpose voucher redemption receipt exceeds EUR 250.00, GeschenkOn records in the gift box the details of the actual recipient of the service required for a full invoice. The editable profile is stored in encrypted form and used only to create future redemption receipts. For each redemption concerned, an immutable, encrypted documentation snapshot is additionally created so that the invoice issued can be proven later. The details are not used for Stripe KYC and do not replace any KYC data.

Depending on the individual case, the legal bases are the performance of the contract and compliance with statutory invoicing, tax and retention obligations. The editable profile can be corrected or deleted unless there is an obligation to continue processing; evidence data already assigned to an issued invoice remains stored in blocked form for the statutory retention period.

For physically delivered products, we process, where necessary, the delivery address, shipping status, tracking references, fulfilment status and partner-related Shopify references. Shopify serves only as the connected fulfilment system of the respective partner, where such a connection has been set up.

6a. Data of voucher recipients

If you receive a voucher as a gift, we did not collect your email address from you. It comes from the person who bought the voucher, from a business customer who sends vouchers to several recipients, or from a partner company that issues its own vouchers via the platform (Art. 14 GDPR). We process your email address and the details belonging to the gift solely to deliver and provide the voucher to you, to enable redemption, to document delivery and to handle support requests and cases of misuse. The legal basis is our legitimate interest and the sender’s legitimate interest in the reliable delivery of the requested gift (Art. 6(1)(f) GDPR).

We do not use your address for advertising. Receiving a voucher does not subscribe you to any newsletter or other advertising.

We keep your email address only briefly: it is masked 90 days after the voucher has been delivered successfully. If a dispatch is not carried out or a gift request is abandoned, it is masked after 30 days. We keep payment and issuance records only for the paying person or company (buyer, business customer or issuing partner) for the statutory periods; after masking, your email address is no longer readable in them either. If you take the voucher over into a user account of your own, the other sections of this privacy policy apply to that account.

Recipients of these data are Mailgun for sending the email (EU region) and the issuing partner where this is necessary for redemption. You have the rights set out in section 13, in particular the right to object to the processing under Art. 21 GDPR.

6b. Business customer accounts

For business customer accounts we additionally process the necessary company, contact, representation and approval details. These include in particular the company name, legal form, business address, country, where applicable the VAT ID, commercial register or tax number, first and last name and email address of the acting person, the confirmation of that person’s authority to represent the company, the review and approval status and the authorisation and contract information needed to conclude and document orders, such as the incorporated version of the General Terms and Conditions for Business Customers. Company name, address and, where applicable, VAT ID are included in the invoices and documents for the order. We process personal details of company representatives only to the extent necessary for these purposes.

The legal bases are the initiation and performance of the contract with the company (Art. 6(1)(b) GDPR), statutory invoicing and retention obligations (Art. 6(1)(c) GDPR) and, for the details of acting persons, our legitimate interest in verifying business status and authority to represent and in preventing misuse (Art. 6(1)(f) GDPR). If a business customer sends vouchers to several recipients, section 6a applies to the recipient data. A CSV file used for this is read only in your browser and is not uploaded to our servers; only the confirmed list of recipients is transmitted.

7. Transaction-related emails and communication metadata

We use Mailgun as the technical email service provider for sending transaction-related emails. Mailgun is preferably used in the EU region.

In particular, the recipient address, template and delivery information, dispatch times, message and delivery status, bounce or error events, technical delivery events, security and webhook metadata and related support and evidence information are processed.

7a. No advertising emails; push notifications in the app

GeschenkOn does not send advertising by email or SMS and does not send a newsletter. You receive emails only where they are necessary for your user account, your orders, the delivery of vouchers, security or legally required communications.

You can receive notifications in the GeschenkOn app. We send service-related notifications, for example about orders, vouchers or security events, to perform the contract (Art. 6(1)(b) GDPR). We send promotional push notifications, for example about promotions by GeschenkOn or by partners, only if you have expressly agreed to this in the app (opt-in); without your agreement this category is switched off. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future in the notification settings of the app; you can also switch off notifications in the system settings of your device.

For this we process the push token and platform of your device, your language setting, the status of your consent with its time and the sending and delivery status of the notifications. Delivery takes place via Google’s Firebase Cloud Messaging and the push service of your device’s operating system.

8. Website access, hosting, logs and technical security

When our website and app are accessed, we process server and access logs. These include in particular the IP address, the date and time of access, the requested URL, header information, technical response data, device and browser characteristics, referrer and request IDs.

For hosting, delivery and central platform functions we use services of Google Cloud. These include in particular Firebase Hosting, Cloud Run, Identity Platform, Cloud Storage, Cloud SQL and Cloud Tasks.

Website and app traffic is routed through the network of Cloudflare, Inc. (USA), which, acting as our processor, provides DNS, delivery and protection against attacks and abuse. In doing so, Cloudflare processes in particular the IP address, requested URL, header information and technical connection data.

In addition, we process audit, security and abuse logs. These include in particular role and approval events, invitation and onboarding histories, error states, delivery and webhook events, abuse signals and other technical evidence data, to the extent necessary for secure provision, error analysis, abuse prevention and legal defence. Immutable billing evidence is archived, blocked or deleted after expiry of the applicable retention and limitation periods; operational deletion or overwriting before the period expires is excluded to the extent that statutory obligations or the defence of legal claims preclude it.

9. Cookies and consent management

We use technically necessary cookies and session-related storage mechanisms to provide the website, for login, session management, security control and to ensure central platform functions.

For consent management we use GeschenkOn's own solution. We process in particular a random consent ID, the selected categories, the version of this notice, the language and the time and type of your decision so that we can demonstrate your consent. Your choice is also stored on your device in our own technically necessary cookie (go_consent). No external consent management provider is used. You can change or withdraw your choice at any time in the privacy settings.

Where consent to statistics has been given, GeschenkOn may process its own first-party tracking events in order to measure page views, technical usage events, language settings and the aggregated reach of the platform. No deliberately directly identifying raw data such as email addresses, telephone numbers, payment data, IBAN, delivery addresses or names are stored in the tracking parameters; IP address, user agent and anonymous session references are processed only in hashed or technically minimised form.

Analytics or marketing tags such as Google Analytics, Google Tag Manager, Google Ads or Meta Pixel are loaded or supplied with non-essential events only if the required consent has been given and the respective configuration is activated. Without such consent, only technically necessary platform functions are executed.

10. Categories of recipients

• Google Cloud as technical infrastructure and platform service provider.
• Cloudflare, Inc. as processor for domain, DNS, network and security services (routing of website and app traffic, protection against attacks, country indication for displaying payment methods).
• Stripe for payment processing, payment status, fraud prevention and partner-related Connect and settlement processes.
• Mailgun for transaction-related email delivery and delivery metadata.
• Shopify or Shopify-connected partner systems, to the extent necessary for physical fulfilment, shipping or inventory processes.
• Partner businesses, to the extent necessary for contract performance, redemption, invoicing, partner settlement or the handling of partner-related services.

11. Transfers to third countries

Processing by Mailgun in the EU region and by Cloud Storage in europe-west3 takes place within the EU and is not a transfer to a third country. For Stripe's EEA contracting entity, processing in the USA by appropriately certified recipients is based on the adequacy decision for the EU-US Data Privacy Framework. Cloudflare, Inc. may also process data in the USA; this is based on the adequacy decision for the EU-US Data Privacy Framework and additionally on the EU Standard Contractual Clauses in the data processing agreement.

12. Retention periods

• Server and access logs: generally 30 days, unless longer retention is required for security, evidence or abuse-related reasons.
• Login and security-related event data: generally 90 days, unless longer storage is required to investigate abuse or for legal defence.
• Orders, invoice and tax-relevant transaction data: 10 years, where obligations under commercial or tax law exist.
• Email addresses of voucher recipients: masked 90 days after successful delivery; if a dispatch is not carried out or a gift request is abandoned, after 30 days (section 6a).
• Partner contract, onboarding, payout and verification data: for as long as necessary for contract performance, statutory obligations, audit purposes and legal defence.
• Settlement and e-invoice data: for as long as necessary for bookkeeping, tax evidence, compliance and commercial documentation.

13. Rights of data subjects

You have the right of access, rectification, erasure, restriction of processing, data portability and objection in accordance with the statutory requirements. Where processing is based on consent, you may withdraw it at any time with effect for the future.

14. Right to lodge a complaint and changes

You have the right to lodge a complaint with a data protection supervisory authority. We reserve the right to amend this privacy policy if legal, technical or operational conditions change or if we introduce new services, functions or processing operations.