Privacy policy

Controller and contact

The operator is responsible for processing personal data on this website. The full operator details appear below. Send privacy requests through the contact form using the Privacy topic. Identify the relevant account or request without sending unnecessary sensitive information.

Technical operation and security

Serving this website requires connection information such as your IP address, request time, requested address and browser information. This information is processed to deliver content and detect faults or abuse. Private data is available only to authorised people. Where the GDPR applies, necessary security processing relies on Article 6(1)(f); the legitimate interest is operating a secure and functioning website.

Contact requests

We process the name, email address, topic and message you supply to answer your request. Required fields are necessary for a response; the form cannot be submitted without them. Processing relies on the consent given in the form (Article 6(1)(a) GDPR where applicable), which you may withdraw for the future. Requests to prepare or perform a contract may rely on Article 6(1)(b). Sending a message does not subscribe you to marketing.

Retention

Closed general contact and support records are scheduled for deletion 90 days after their last update. Delivered email texts are removed after 30 days. Open requests are retained for handling. Account, organisation and published profile records are retained while needed for their purpose. Legal retention obligations or the necessary protection of legal claims may require longer retention.

Recipients and transfers

General contact requests go to the responsible operator team. The website stores requests with the operator. Technical suppliers may process information only for their assigned services and agreed access permissions. External links lead to independent websites with their own privacy information.

Your rights

Subject to the applicable legal conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may withdraw consent for future processing; earlier lawful processing remains unaffected. You may complain to a competent supervisory authority, particularly where you live, work or believe an infringement occurred. A proportionate identity check may be needed to handle a request.

Automated decisions and changes

The general contact form and site search do not make decisions producing legal or similarly significant effects. Search ranks relevant public information using your search terms. This notice is updated when features or services change.

Internal request statistics

We count public page and profile requests internally from incoming server requests. Only hourly counters per project, public page path, market, language and profile are stored. Query parameters and form contents are excluded. There are no analytics cookies, fingerprints, visitor or session identifiers, stored IP addresses, user agents or device profiles. Counts are not linked to accounts. Known bots are transiently excluded using request information; browser information is not stored. Repeat requests count again; these are not unique people. These request counters do not identify unique visitors. Browsing trails, contact clicks and active time are not measured. Internal counting is independent of external-content permission and Do Not Track. Received enquiries are counted separately from operational records. Aggregated counts are removed after 180 days. Historical figures used consent-based measurement and are not directly comparable.

Internal visitor statistics with consent

With your separate consent, we use our own analytics cookie containing a randomly generated, signed identifier. We read no device, canvas, audio or graphics characteristics and use no fingerprinting. Our own backend stores only a separately hashed identifier per website, the visit date, the first collection time on that day and the consent version. No IP addresses, user agents, browsing trails, profile associations or account associations are stored with the identifier. Identifiers are never sent to external providers. These pseudonymous identifiers serve only our internal visitor count; they are not anonymous data or a reliable count of people. One browser counts once per website during the selected period. Other devices, cookie deletion and missing consent limit the figures. The cookie and locally stored choice last up to 180 days; visit records are removed after 180 days. Use the cookie/privacy preferences in the footer to withdraw consent for future collection and delete the analytics cookie. Previously lawfully collected visit records are not automatically removed by withdrawal. External-content permission is separate. The basis is your consent (GDPR Article 6(1)(a) and section 25 TDDDG where applicable).

External content and providers

External maps and media load only after permission. The displayed provider receives your IP address and technical connection data and, for embedded players, the website origin; its own privacy information also applies. Permission is specific to each provider and website, stored locally for 180 days without a visitor identifier and can be withdrawn for future loads through External content & providers on the privacy page. Withdrawal does not recall data already transmitted. This choice does not control internal request statistics. Requested account and email services, form consent and newsletter subscriptions are handled separately. Where consent is required, loading relies on your permission (Article 6(1)(a) GDPR and applicable terminal-equipment rules).

External content & providers

Search this website

Site search processes terms to find published pages. Terms appear in the page address; do not enter confidential information.

Email delivery with Brevo

We send the recipient address, sender, subject and message, including personal confirmation or recovery links where applicable, to Brevo through an encrypted API connection for delivery. This covers account messages, requested notifications and newsletters after consent. Brevo also processes technical sending and delivery information. Our application does not transfer the full project database or visit analytics to Brevo. Recipient records remain separated per project in our shared system.

Brevo currently adds opening pixels and may rewrite links to measure clicks. Loading a pixel or following a measurement link sends Brevo the associated recipient identifier, time and technical connection information, including IP address and browser details. Tracking is currently not anonymised in the Brevo account. Confirmation emails respond to a requested newsletter subscription; the subscription becomes active only after confirmation.

Hosting with Hetzner

Hetzner hosts the application server and database. Account, profile and request data and necessary technical connection information are processed there. Backups also contain stored project data.

Delivery and protection through Cloudflare

Website requests pass through Cloudflare to our server. Cloudflare processes your IP address, requested address, technical connection information and submitted requests, including forms and sign-ins. Cloudflare provides HTTPS and delivery and security functions. Processing may take place across its worldwide network. Website access protection does not replace application sign-in and permission checks.

Submitting offers

When you submit an offer, we store business information, offer terms, subscription links, your business contact details and your authorization statement for review and management. Submitter contact details are not shown publicly. These data are retained for managing the offer; the shared retention period applies to closed general contact enquiries.

Subscribing with a business

WelcomePromos does not collect newsletter subscriptions for listed businesses. Following a subscription link takes you to the business website or WhatsApp, where the provider’s information applies. We do not record confirmed newsletter subscriptions or voucher redemptions here.