Privacy Policy

Privacy Policy

*Pursuant to Art. 13 and 14 GDPR*

1. Data Controller

P&P Management GmbH

Leebgasse 70

1100 Vienna

Austria

Email: [kaiserin@sissydeals.de](mailto:kaiserin@sissydeals.de)

Website: https://www.sissydeals.de

2. General Information on Data Processing

Protecting your personal data is important to us. We process your data exclusively on the basis of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and the Telecommunications Act (TKG).

Personal data is only processed when necessary for:

  • providing our website,
  • fulfilling contractual obligations,
  • ensuring system security,
  • analyzing and improving our services,
  • or based on your consent.

3. User Account Registration

When creating an account, we process the following data:

  • Email address
  • Password hash (bcrypt, 10 rounds)
  • First and last name
  • Language settings (locale)
  • Account tier (free / pro)
  • Registration timestamp

Plain-text passwords are never stored or accessible.

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Retention period: Until account deletion

4. Payments via Stripe

For Pro subscriptions, we use Stripe Payments Europe Ltd., Dublin, Ireland.

Stripe processes:

  • Name
  • Billing address
  • Email address
  • Payment information

We do not have access to full credit card details.

Stripe acts as a data processor under Art. 28 GDPR. A data processing agreement is in place.

https://stripe.com/de/privacy

Legal basis: Art. 6(1)(b) GDPR

5. Affiliate Links and Click Tracking

SissyDeals participates in the Amazon Associates Program.

When clicking affiliate links, the following data may be processed:

  • Timestamp
  • Pseudonymized IP address (SHA-256 hashed and truncated)
  • Browser information
  • Referrer / source channel
  • Device information

The full IP address is not stored.

Purpose: fraud prevention, analytics, attribution

Legal basis: Art. 6(1)(f) GDPR

Retention period: 13 months

6. Google Analytics 4 (GA4)

Google Analytics 4 is only activated with your explicit consent via the cookie banner.

Data processed includes:

  • Page views
  • Device and browser data
  • Approximate geographic region
  • Interaction data

IP anonymization is enabled.

Legal basis: Art. 6(1)(a) GDPR

Provider: Google Ireland Ltd.

https://policies.google.com/privacy

Data transfers to the USA may occur under the EU–US Data Privacy Framework or Standard Contractual Clauses.

7. AI Processing and Wishlists

Pro users may submit wishlist entries and product queries in natural language.

These inputs may be processed by external AI providers (e.g. OpenRouter, Meta Llama, Google Gemini, DeepSeek) for:

  • product discovery
  • ranking
  • semantic analysis
  • recommendation systems

No direct personal identifiers (such as name or email) are transmitted. Processing is done using internal pseudonymous IDs only.

Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR

International transfers: possible under Standard Contractual Clauses (Art. 46 GDPR)

https://openrouter.ai/privacy

8. Cookies and Local Storage

We use strictly necessary cookies and local storage technologies.

Strictly necessary cookies:

  • bd_session (login session)
  • bd_install_dismissed_at (PWA banner state)
  • bd_sidebar_expanded (UI preference)
  • i18nextLng (language setting)
  • bd_cookie_consent (cookie preferences)

Non-essential cookies are only used with consent.

Legal basis: Art. 6(1)(b) GDPR / § 165 TKG 2021

9. Server Log Files

Our hosting provider automatically collects technical logs:

  • IP address
  • Timestamp
  • User agent
  • Requested URL
  • HTTP status code

Purpose: system security, abuse prevention, error analysis

Retention period: 14 days

Hosting provider: AltusHost B.V. https://altushost.com

10. Contact Requests

If you contact us via email or forms, we store your data to process your request.

Data processed:

  • Name
  • Email address
  • Message content

Legal basis: Art. 6(1)(b) or 6(1)(f) GDPR

11. Newsletter (Brevo)

We use Brevo (Sendinblue GmbH) for newsletter distribution.

Brevo processes:

  • Email address
  • usage data (e.g. opens, clicks, if enabled)

Processing is based on a data processing agreement under Art. 28 GDPR.

Double Opt-In

Subscription is only completed via a double opt-in process. After registration, you receive a confirmation email. Only after confirmation will you be added to the mailing list.

Legal basis: Art. 6(1)(a) GDPR

Unsubscribe: possible at any time via the unsubscribe link

https://www.brevo.com/de/legal/privacypolicy/

12. Data Security

We implement appropriate technical and organizational security measures, including SSL/TLS encryption, to protect your data against loss, misuse, or unauthorized access.

13. Minors

Our services are intended exclusively for individuals aged 18 and older.

14. Automated Decision-Making

We do not use automated decision-making within the meaning of Art. 22 GDPR.

15. Your Rights

You have the following rights under GDPR:

  • Access (Art. 15)
  • Rectification (Art. 16)
  • Erasure (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Objection (Art. 21)
  • Withdrawal of consent

Contact: [kaiserin@sissydeals.de](mailto:kaiserin@sissydeals.de)

16. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority:

Austrian Data Protection Authority

https://www.dsb.gv.at

17. Advertising – Google AdSense

This website uses Google AdSense, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to display advertisements. Google AdSense uses cookies and similar technologies to serve ads and measure their delivery. In doing so, data such as your (truncated) IP address, device and browser information, and the pages you visit may be transmitted to and processed by Google; transfer to third countries (including the USA) is possible.This processing takes place solely on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG, which you give via our consent banner and can withdraw at any time with effect for the future via the cookie settings. No advertising cookies are set without your consent.You can also turn off personalised advertising at https://adssettings.google.com. More information: https://policies.google.com/privacy. Publisher ID: ca-pub-7962590093707429.

18 Profile picture / public trust signals

If you voluntarily upload a profile picture, it may be shown as a public trust signal — for example, as a small avatar next to deals you have upvoted. Your name and email address are not shown. You can remove your profile picture at any time in your account (an anonymous initial icon is then used again). Legal basis: your consent given by uploading the picture (Art. 6(1)(a) GDPR).

SissyDeals participates in the Amazon Associates Programme and earns a commission on qualifying purchases at no extra cost to you. We are an intermediary, not the seller.