Privacy policy

Data controller

Matthias Bilger
Guardinistr. 175
81375 München, Germany
Email: wichteln@pb42.de

What data we process

When a group is created, we process its name, registration deadline and any optional spending limit. If the organiser asks us to email the private organiser link, that email address is used to send the message and is not saved in the group database.

When someone joins, we process their name, email address, selected language, confirmation status and, if provided, spending limit, gift preferences, things to avoid, private wish and draw exclusions. We also store group, draw and email-delivery status and relevant timestamps.

An organiser may also add someone by entering their name, email address and optional preferences. In that case, we receive those details from the organiser and send the person a confirmation email.

The name and email address are required to join and receive a confirmation and result. Other preference fields are optional. Please do not enter sensitive information such as health details in free-text fields.

Purposes and legal bases

We use these data to create and manage groups, confirm registrations, run the draw, send requested emails and let organisers and participants manage or view their private results. This processing is necessary to provide the service you requested (Article 6(1)(b) GDPR).

We process limited technical and error information to keep the service secure, prevent misuse and diagnose failures. The legal basis is our legitimate interest in operating a reliable service (Article 6(1)(f) GDPR).

Who can receive the data

The group organiser can view participant details and preferences in the private dashboard. A participant's assigned gift giver can view that participant's likes, things to avoid and private wish. Draw exclusions are not shown to other participants. Emails are sent through the SMTP email service configured for this deployment; the hosting provider stores the application and its database.

The SMTP email provider receives email addresses and message contents, which can include confirmation messages and private organiser or match links.

Hosting and email providers are selected for each deployment. Their identity and processing location, and whether a transfer outside the European Economic Area takes place, therefore depend on the current configuration. Contact me for the provider details and information about any safeguards used for such a transfer.

Storage period

Group data are kept while the group is active. Groups are archived after six months without activity and permanently deleted six months after archiving. The organiser can extend the storage period or delete a group and its data earlier from the dashboard.

Cookies and storage on your device

The site uses a cookie to remember your language choice for one year and a private organiser-recovery cookie for up to six months. These cookies support features you request and are not used for advertising or tracking.

If you create a group, this browser may also save its name and private organiser link in local storage so the link can be shown again on the home page. The organiser link grants access to the dashboard. Anyone with access to this browser profile may be able to use it. You can remove this browser data in your browser settings.

We do not use analytics or advertising tools, and the site does not load third-party tracking resources.

Server logs

The application does not keep a log of successful page requests or visitor IP addresses. It does write limited technical error and email-delivery diagnostics to the server output. The hosting provider may process connection data such as IP address, request time and requested path to deliver and protect the service, and may retain server logs under its own settings and retention periods.

Your rights

You can request access to, correction or deletion of your personal data, restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests. Contact me at wichteln@pb42.de to exercise these rights.

You also have the right to complain to a data protection supervisory authority. No data are transferred to third parties for advertising, and no profiling or decisions with legal or similarly significant effects are made.

Last updated: 9 November 2026.