Privacy Notice

This Privacy Notice informs you about the processing of your personal data by us when you visit our website www.everwish.be and when you purchase or redeem a gift card via our website.

Name and contact details of the controller

Wunschgutschein GmbH

Dr. Andreas Betzer, Verena Argauer, Florian Pauthner & Valentin Schütt

Rosental 6

80331 München, Germany

Telephone: 0032-800 261 91

E-mail: info@everywish.be

Name and contact details of the data protection officer

Oliver Baldner

bITs GmbH

Detmolder Strasse 204

33100 Paderborn, Germany

E-mail:oliver.baldner@bits.gmbh

Phone: +49 (0) 5251-6889480

Categories of personal data, purposes of processing and legal bases

The below table identifies which categories of your personal data we process for which purposes and on which legal basis the processing is based on.

Depending on the purpose for which we process your personal data, the following legal basis generally come into consideration:

Consent: We have your specific consent to carry out the processing for the purpose in question;

Contract: The processing is necessary to perform a contract that we are about to enter into, or have entered into, with you;

Legal obligation: The processing is necessary for compliance with a legal obligation;

Legitimate interest: The processing is necessary to pursue our legitimate interests or those of a third party and we are confident that your interests are not overridden.

Recipients

We transfer your personal data to service providers we engage for the provision of our services and our business operations such as

IT service providers (e.g., for hosting or fraud prevention),

Legal advisors, auditors

Group companies / subsidiaries

Newsletter/marketing service providers,

customer support service providers and

payment service providers e.g., Shop Pay by Shopify, Amazon Pay (Amazon.com, Inc.), Stripe, Inc. and PayPal Holdings, Inc.

In case our service providers process your personal data on our behalf, we enter into a data processing agreement with them.

In case required by law, necessary for the assertion or defense of legal claims, or requested in an official order or by court, we transfer your personal data to a court or a public authority.

Cookies

We use cookies on our website to make our internet presence more user-friendly and functional. Some cookies remain stored on your end device.

These are small text files that are sent from our web server to your browser and stored on your computer's hard disk. Only an individual pseudonym will be stored. This information is used, for example, to recognize you when you navigate our website and to make navigation easier for you.

Cookies are divided into the following categories depending on their purpose and function:

Technically necessary cookies to ensure the technical operation and basic functions of our website. This type of cookie is used, for example, to maintain your settings while you navigate the website or they can ensure that important information is retained throughout the session (e.g. login, shopping cart).

Performance cookies to understand how users interact with our website by collecting and analyzing information anonymously only. This provides us with valuable insights to optimize both the website and our products and services.

Advertising cookies to set targeted advertising activities for users on our website.

The legal basis for the use of technically necessary cookies is based on our legitimate interest in the technically flawless operation and smooth functionality of our website. It is not necessary to obtain consent for these cookies, as the use of these cookies is necessary to provide important functions of the website.

The use of performance and advertising cookies is based on the consent previously obtained from you. You can withdraw your consent to the use of cookies at any time for the future. Consent is voluntary. If you do not consent, there are no disadvantages.

Alternatively, you can also view this website without cookies. You can preset this in your browser. Please note that some functions of the website may no longer be available in whole or in part as a result.

Further information about the cookies we use (in particular about their purpose and storage duration) can be found in our cookie table (

Consent to the use of cookies.

).

We also use so-called local storage functions (also known as "local storage") on our website. This involves storing data locally in your browser's cache, which continues to exist and can be read even after you close the browser - unless you delete the cache or it is session storage. Third parties cannot access the data stored in the local storage. If you do not want data to be stored in the local storage, you can control this in the settings of your respective browser. We would like to point out that this may result in functional restrictions.

Google reCAPTCHA

We use the Google reCAPTCHA tool, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), to detect bots on this site.

Google reCAPTCHA is integrated into this website in order to ensure that entries made in online forms, for example, are actually made by real persons and are not automated by software (or bots). For this purpose, reCAPTCHA will display a clickable checkbox "I am not a robot". In addition, users may have to click on the checkbox to display various images, which must be assigned to a given image theme by clicking on the relevant images (e.g. selection of all images with cars).

Google reCAPTCHA analyses the behaviour of visitors of this website using different characteristics. Google reCAPTCHA processes personal data such as your IP address, your length of stay on our website and further information about your use of this website.

If personal data is transferred to the service provider Google in the USA when using Google reCAPTCHA, the data is transferred on the basis of the adequacy decision of the European Commission EU-U.S. Data Privacy Framework (EU-U.S. DPF) within the meaning of Art. 45 para. 3 GDPR.

The privacy policy with the description of data processing by Google can accessed .

Google Analytics 4

The use of the tool on the website involves the use of cookies (see below) only if you have consented to the use of this service.

The tool Google Analytics 4 is used to analyze your use of our websites (web analytics service).

Google Analytics 4 regularly uses so-called cookies to analyze your use of our websites. Cookies are small text files that are sent to your browser, stored on your device, and subsequently evaluated. The information collected via the cookies is regularly transmitted to a server in Ireland and, where applicable, the USA, where it is processed.To carry out these analyses and ensure the functionality of the tool, we have implemented the code that enables Google Analytics 4 on our website, which you are visiting.

On our behalf, the service provider will use the information collected on the website to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics 4 are used to analyze the performance of our website.

As a rule, the use of Google Analytics 4 on our website is pseudonymous, unless the User-ID function (see below, if applicable) is used.

Additionally, Google Analytics 4 is used to analyze the effectiveness of our marketing campaigns. We use the User-ID feature, which allows us to assign a unique, persistent ID to one or more sessions (and the activities within those sessions), enabling us to analyze user behavior across devices.We also use the Google Signals feature, which collects additional information about users who have enabled personalized ads. This includes, in particular, personal interests and demographic data. This allows ads to be delivered in cross-device remarketing campaigns to the respective users of personalized ads.

To protect your privacy, your IP address, which is transmitted to the service provider, is anonymized by default.Due to the activation of IP anonymization on this website, your IP address is shortened by Google within member states of the EU or in other EEA countries. Only in exceptional cases is the full IP address transmitted to a server of the service provider in the USA and shortened there. According to Google, the IP address transmitted by your browser within the framework of Google Analytics 4 is not merged with other data.As part of the use of Google Analytics 4 on the website, extensive processing of personal data takes place. Depending on the type of implementation and the options used, different data may be processed by us. If Google Analytics 4 is implemented in its default configuration, the following information is automatically collected in particular:

• Number of users

• Session statistics

• Approximate location

• Browser and device information

If you would like more information about the data that is automatically collected, you can view it at the following link:

Information regarding predefined user dimensions (depending on the option used) or enhanced measurement and events can be found at the following links:

Regarding predefined user dimensions: Regarding enhanced measurement and events:

Google is a part of Google LLC, located at 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. If personal data is transferred to the service provider Google LLC in the USA when using Google Analytics 4, the data is transferred on the basis of the adequacy decision of the European Commission EU-U.S. Data Privacy Framework (EU-U.S. DPF) within the meaning of Art. 45 para. 3 GDPR.

Google Ads

We use the Google Ads tool, a service provided by Google Ireland Limited, Gordon House Barrow Street, Dublin 4, Ireland ("Google").

Google Ads (formerly known as "Google AdWords") is an advertising system that allows advertisers to place ads on the Internet that are primarily based on the search results when using the company's own services.

We use the conversion tracking service. Google defines conversion as the performance of a desired action by users (recipients of an advertising message) from the advertiser's perspective. Conversions are measured (conversion tracking) to determine whether users have viewed the respective ad or the displayed content as an opportunity to perform the desired action from the advertiser's point of view. This is used to measure the success of the advertisers' respective advertising campaigns.

We also use the remarketing service (also known as retargeting). Google Ads remarketing or retargeting is a technology that allows advertisers to follow their potential customers when users of an advertiser's website visit that website. In this case, a remarketing code is generated and added to a remarketing or retargeting list on the website of the respective advertiser. If users visit another website that belongs to the Google advertising network, the information and/or the ad of the respective advertiser will be displayed to the users on the resources that belong to the Google advertising network.

Google is a part of Google LLC, located at 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. If personal data is transferred to the service provider Google LLC in the USA when using Google Analytics 4, the data is transferred on the basis of the adequacy decision of the European Commission EU-U.S. Data Privacy Framework (EU-U.S. DPF) within the meaning of Art. 45 para. 3 GDPR.

Google informs you about the processing of your personal data in the context of the use of the Google Ads tool and in general in the context of the use of Google services .

The service provider Google informs you about the types of processing that take place and the data processed .

Data processing conditions for Google's advertising products have been concluded between Google and us, which you can access .

Google Ad Manager

We use the Google Ad Manager tool, a service provided by Google Ireland Limited, Gordon House Barrow Street, Dublin 4, Ireland ("Google").

Google Ad Manager is an ad management platform for publishers (advertisers) and offers detailed control options and supports multiple ad platforms and ad networks, such as AdSense, Ad Exchange and third-party ad platforms and ad networks.

We use Google Ad Manager to define, create and manage our advertising campaigns, and Google Ad Manager generates the associated reports for us. In doing so, we define ad inventories or so-called ad units. Ad units are the areas on our website (or app) in which ads are to be presented. In Ad Manager, a tag (a code snippet) is generated for each ad unit. This snippet is inserted on our website (or app, if applicable). When a user visits the website (or app, if applicable), a request is sent to Google Ad Manager via the ad tag.

We create orders and advertising bookings through the Google Ad Manager. An ad for this request can then be delivered via campaigns that refer to or are targeted at the ad unit. The best ad presented at the time of the request is selected in Ad Manager. In the customizable Google Ad Manager reports, we can see which ads are delivered in which inventory (in which project), how much revenue you are likely to generate and much more.

When using the Google Ad Manager tool, we and the service provider Google generally act as independent controllers and only when using individual functions of the tool does Google act in the role of a processor bound by instructions, with whom we have concluded a data processing agreement in accordance with Art. 28 GDPR for this case. See the information provided by Google .

To find out more about Google's privacy policy in general, you can access this policy .

Google is a part of Google LLC, located at 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. If personal data is transferred to the service provider Google LLC in the USA when using Google Analytics 4, the data is transferred on the basis of the adequacy decision of the European Commission EU-U.S. Data Privacy Framework (EU-U.S. DPF) within the meaning of Art. 45 para. 3 GDPR.

Google Tag Manager

We use the Google Tag Manager tool, a service provided by Google Ireland Limited, Gordon House Barrow Street, Dublin 4, Ireland ("Google").

We use the Google Tag Manager service to integrate various website tags from Google into our website (e.g. website analysis products).

In programming language, tags are parts of code that are used to track the activities of visitors to a website. The word "tag" refers to a label or a marker and is used to mark a database with certain (additional) information. Depending on the type of activity tracked and the function of the respective tag, a distinction is made in particular between so-called counter tags, conversion tags, remarketing tags and container tags.

As a processor, Google processes your personal data on our behalf. For this purpose, we have concluded a data processing agreement with Google in accordance with Art. 28 GDPR. Google is authorized to commission subcontractors. You can access a list of approved subcontractors .

To find out more about Google's privacy policy in general, you can access this policy .

Google is a part of Google LLC, located at 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. If personal data is transferred to the service provider Google LLC in the USA when using Google Analytics 4, the data is transferred on the basis of the adequacy decision of the European Commission EU-U.S. Data Privacy Framework (EU-U.S. DPF) within the meaning of Art. 45 para. 3 GDPR.

Meta-Pixel

We use the Meta-Pixel tool on our website, a service by Meta Platforms Limited, based in 4 Grand Canal Place, 2 CO Dublin (Ireland).

The meta pixel tool is used to analyze and measure the success of advertising placed on the online platform of the social network Facebook.

If we place advertisements for our products and services on our Facebook page, we only want to show them to people who are actually interested in our products and services. The meta pixel tool allows us to better tailor our advertising measures to the wishes and interests of potential customers. In this way, Facebook users who have consented to the display of personalized advertising are presented with suitable advertising. Meta Platforms also uses the data collected when using the meta pixel for its own analysis purposes and to display its own advertisements.

If the service provider Meta Platforms uses the data for its own purposes, you will find information on the legal basis, the storage period and the assertion of data subject rights in the service provider's data protection information .

In order to display our advertising only to interested persons, as explained above, we have implemented the code that ensures the function of the Meta-Pixel tool on our website that you visit. The implemented code provided by Meta Platforms loads functions that enable Meta Platforms to analyze and measure your actions if you reach our site via Facebook ads.

Once the comparison has taken place, the data is deleted by Meta Platforms. The data collected by Meta Platforms is anonymous and cannot be viewed by us as users of Meta-Pixel. This data is only used by Meta Platforms in the context of displaying advertisements. In the context of the data processing that takes place, it makes a difference whether you have a Facebook user account and are logged in to the Facebook page as a user in your browser, or whether you do not have a Facebook user account.

If you have a Facebook user account and are logged in, Meta Platforms will automatically associate your data with your user account when you visit our site. You can adjust your settings for advertisements if you are logged into your Facebook user account.

If you do not have a Facebook user account, you can click to manage your usage-based advertising and activate or deactivate individual advertising providers.

Meta Platforms Limited is a part of Meta Platforms, Inc., located at 1601 Willow Road Menlo Park, California 94025-1452, USA. If personal data is transferred to Meta Platforms, Inc. in the US, the data is transferred on the basis of the adequacy decision of the European Commission EU-U.S. Data Privacy Framework (EU-U.S. DPF) within the meaning of Art. 45 para. 3 GDPR.

Links to third-party websites

Our website contains links to other websites. We have no influence on whether their operators and controllers comply with data protection regulations. Despite careful checking of the content, we accept no liability for the content of external links. The operators of the linked websites are solely responsible for their content.

Duration of processing

We process your personal data for as long as necessary to achieve the purposes of processing and/or if we have an ongoing legitimate business interest in retaining your personal data. For example, an ongoing legitimate interest would be retaining your personal data for the duration of applicable limitation periods which are usually 3 years. In certain instances, we are required to retain your personal data in order to comply with statutory obligations such as with applicable tax and/or commercial retention obligations. Documents subject to a statutory retention obligation are usually stored up to 10 years. Once the retention of your personal data is no longer necessary for the purpose of its processing, there is no ongoing legitimate business interest in and no statutory obligation for retaining your personal data, we will delete your personal data.

International data transfers

In case we transfer your personal data to recipients located outside the European Economic Area ("EEA"), we will make sure that an appropriate transfer mechanism is in place to safeguard your personal data. Such transfer mechanisms will usually be an adequacy decision under Article 45, GDPR adopted by the European Commission or appropriate safeguards such as standard contractual clauses under Article 46 of the GDPR made by the European Commission. In case necessary, we will take additional measures to safeguard your personal data. You can obtain a copy of the appropriate safeguards by sending an email to oliver.baldner@bits.gmbh.

Your data protection rights

Subject to the statutory requirements, you have the following data protection rights:

Right of access: You have the right to obtain from us confirmation as to whether or not we process your personal data, and, where this is the case, to access your personal data;

Right to rectification: You have the right to request rectification of inaccurate personal data from us, and the right to have incomplete personal data completed by us;

Right to erasure: You have the right to request erasure of your personal data from us;

Right to restriction: You have the right to request restriction of processing;

Right to data portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format and the right to have your personal data transmitted to another controller without hindrance;

Right to object: You have the right to object to the processing of your personal data at any time;

Right to withdrawal: You have the right to withdrawal your consent at any time, without affecting the lawfulness of processing based on consent before your withdrawal; and

Right to lodge a complaint: You have the right to lodge a complaint with the Belgian Data Protection Authority (BDPA) about the processing of your personal data by us. Contact details for the Belgian Data Protection Authority are available .

Provision of your personal data

You are not statutory or contractually required to provide us with your personal data, however, if you refrain from providing your data, we are unable to enter into a contract (i.e., purchasing contract) with you.