Atolls North America LLC is part of the Atolls Group (more information at www.atolls.com). In this Privacy Policy, we would like to inform you about the protection of your personal data and how it is processed when you use the websites, apps, and platforms (collectively, "Platforms") we offer and the services, applications, or services provided through them. We are obliged to do so within the scope of our data protection responsibilities under applicable data protection law, in particular the General Data Protection Regulation (Regulation (EU) 2016/679; "GDPR").
If you are a resident of the US state of California, view our Additional Notice for California Residents (see Part E) for additional information about our information practices and your rights. It also serves as your “Notice at Collection” and “Notice of Right to Opt-Out.”
If you are a resident of other US states that maintain comprehensive data privacy laws, view our Additional US State-Specific Notice (see Part F) for information about rights you may have.
We also refer to you as a data subject in the following as "User," "you," or "Data Subject."
This Privacy Policy contains information about the following Platforms and Platform Offers:
The website under the domain https://www.coupons.com/, including all subpages (hereinafter collectively referred to as the "Coupons.com Website").
The coupons.com app for mobile devices (hereinafter referred to as the "Coupons.com App").
The use of our Platforms and Platform Offers may require registration as a User via the registration process provided there and the associated creation of a user account (hereinafter referred to as "User Account"). Please inform yourself about this and about the type and content of the services available via our Platforms in our General Terms and Conditions.
Our Privacy Policy is structured in a modular fashion. It consists of a general Part A, which applies to all processing of personal data carried out by us, and a specific Part B, the content of which refers only to the processing situation specified there. Part C and Part D contain additional information for US residents. To find the parts relevant to you, please refer to the following overview of the structure of our Privacy Policy:
| Designation | This section is for you... | There you will find information on, among other things |
Part A | General | ...always relevant, as it contains general information that applies to all Platforms. | Terminology, responsible party, contact details, processing principles, your rights |
Part B
| Smart Shopping | ... if you participate in our Cashback Programs and/or use Coupons ("Couponing") and/or purchase gift cards ("Gift Cards") via the Coupons.com Website or the Coupons.com App. | Data categories, processing purposes, legal basis, processing duration, data transfer, cookies |
Part C | Additional Notice for California Residents | … if you are a resident of California. | Personal data we collect under California law, disclosures of your personal data, and rights you may have concerning personal data. |
Part D | Additional US State-Specific Notice | … if you are a resident of a US state that has passed a comprehensive privacy statute. | Information about rights you may have concerning personal data. |
Following the example of Art. 4 GDPR, we explain below some important terms used in this Privacy Policy:
"Personal data" (Art. 4 No. 1 GDPR) refers to any information relating to an identified or identifiable natural person (the "data subject"). A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Identifiability may also result from linking such information or other additional knowledge. The origin, form, or embodiment of the information is irrelevant.
"Processing" (Art. 4 No. 2 GDPR) is any operation involving personal data, whether or not with the aid of automated (i.e., technology-based) procedures. This includes, in particular, the collection (i.e., procurement), recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning, combining, restricting, erasing or destroying personal data, as well as changing the purpose or objective for which the data was originally processed.
"Controller" (Art. 4 No. 7 GDPR) is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
"Third party" (Art. 4 No. 10 GDPR) is any natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorized to process personal data; this also includes other legal entities belonging to the group or corporation.
"Processor" (Art. 4 No. 8 GDPR) is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller, in particular in accordance with the controller's instructions (e.g., IT service providers). In terms of data protection law, a processor is not a third party.
The following companies of the Atolls Group are joint controllers (Art. 26 GDPR) for the processing of your personal data:
Atolls North America LLC
3280 Peachtree Road NE, Suite 525, Atlanta, GA 30305
Further information at: https://www.coupons.com/imprint
Atolls GmbH
Radlkoferstraße 2, D-81373 Munich
+49 (0) 89 416122980
Further information at: https://atolls.com/imprint/
As part of our joint responsibility, we and Atolls GmbH have concluded a joint responsibility agreement that transparently specifies which company fulfills which obligations under the GDPR and the extent of our joint responsibility. Among other things, it stipulates the following:
Atolls GmbH is responsible for processing requests from data subjects and fulfilling your rights as described in Part A, Section XII;
the information obligations under Art. 13 and 14 GDPR are fulfilled jointly by both controllers in this Privacy Policy;
The two controllers also work closely together on all data protection issues.
If you have any questions about data protection, you can contact our company's data protection officer at the following contact details:
Atolls GmbH:
DataCo GmbH
Dachauer Straße 65, D-80335 Munich
We will inform you about the purposes of data processing in the relevant sections below. We will inform you again separately if we intend to use personal data for a purpose other than that for which we originally collected your personal data.
The processing of personal data is only permitted if one of the following legal bases exists:
Art. 6(1)(a) GDPR ("consent"): Where the data subject has voluntarily, in an informed manner and unambiguously indicated by a statement or other unequivocal affirmative action that he or she consents to the processing of personal data relating to him or her for one or more specific purposes;
Art. 6(1)(b) GDPR ("performance of a contract"): Where processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Art. 6(1)(c) GDPR ("legal obligation"): If processing is necessary for compliance with a legal obligation to which the controller is subject;
Art. 6 (1)(d) GDPR: If processing is necessary to protect the vital interests of the data subject or of another natural person;
Art. 6(1)(e) GDPR: If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
Art. 6(1)(f) GDPR ("legitimate interests"): If processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or rights of the data subject (in particular where the data subject is a child).
We specify the applicable legal basis for each of the processing operations we carry out below. Processing may also be based on several legal bases.
Our Platforms use various technologies for the automated collection of user data when you are active on our Platforms ("Tracking Technologies"). These Tracking Technologies are used to provide, analyze, improve, and further develop our Platforms and Platform Offers, as well as to offer you advertising tailored to your browsing activities and interests.
The Tracking Technologies used are either our own or are provided by third-party providers whose technologies we allow or use on our Platforms ("Third-Party Technologies"). These third-party providers may be based in Germany or abroad, including outside the European Union (EU) or the European Economic Area (EEA) and/or your country of residence.
We will inform you about the details of the Tracking Technologies used on the Platforms below in the relevant sections. The Tracking Technologies used may include the following in particular:
Cookies are small data files that are assigned to and stored on your device by the browser you are using, e.g., by means of a characteristic string of characters, and through which certain information flows to the entity that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer and therefore cannot cause any damage. They serve to make the internet offering more user-friendly and effective overall, i.e., more pleasant for you.
Cookies may contain data that enables the terminal device or browser used to be recognized. In some cases, however, cookies only contain information about certain settings that are not personally identifiable. Cookies cannot directly identify a User.
A distinction is made between session cookies, which are deleted as soon as the browser is closed, and permanent cookies, which are stored beyond the individual session.
Plugins are extensions or add-on modules that are integrated into a website to provide additional functions. Plugins (e.g., "share" buttons, integration of map services or videos) can, among other things, display third-party content directly on the website, record user interactions, and in some cases set cookies or access existing cookies. When you visit a website with such a plugin, this plugin may – depending on its configuration – transmit data to the respective third-party provider, even if you are not actively using the plugin yourself.
A pixel (also known as a tracking pixel or web beacon) is a tiny, usually invisible image element that is embedded in a website or email. When the page or message is loaded, this pixel is retrieved from the provider's server, automatically transmitting information about user behavior. A pixel can, for example, record whether and when a page or email was opened, from which device or IP address, and what actions were performed on the page (e.g., scrolling, clicks).
Pixels do not store any data on the end device themselves but can be combined with cookies to track Users across different pages.
Tags are small pieces of code that are embedded in the source code of a website. They are used to perform certain functions or collect data as soon as a page is loaded, or a specific action is performed.
To the extent you use our Platforms from Europe, storing information on end devices (desktops, cell phones, tablets, etc.) – e.g., by setting cookies – and retrieving information from end devices ("Tracking") is generally only permitted if the end device user has given their prior consent or if such storage or retrieval is absolutely necessary for the provision of a digital service (e.g., website). Where necessary, we therefore ask you on our Platforms whether you wish to give such consent.
You can also set your browser to inform you about the use of Tracking Technologies. In addition, you can delete, deactivate, manage, or prevent the use of Tracking Technologies at any time via the corresponding settings in your browser. Please check with your browser provider for more information. Please note that if you deactivate Tracking Technologies, our Platforms may not be displayed optimally, and some functions may no longer be available for technical reasons.
Profiling refers to any form of automated processing of personal data that consists of using personal data to evaluate certain aspects of a natural person, in particular to analyze or predict aspects of that natural person such as work performance, economic situation, personal preferences, interests, reliability, behavior, or movements (see Art. 4 No. 4 GDPR).
We sometimes use profiling methods based on your visits to our Platforms and other interactions, as well as content you upload to us, in order to personalize features and content and make suggestions to you (e.g., groups or deals you may be interested in). However, we do not intend to use your data for automated decision-making.
Depending on the Platform, data is generally stored (locally or in clouds) on servers belonging to us and/or our service providers (see Part A, Section IX) in the EU (in particular Germany and Ireland) and the USA. Part A, Section X applies to storage in third countries.
For individual processing operations carried out by us, we specify below how long the data is stored by us and when it is deleted or blocked. Unless an explicit storage period or deletion period is specified below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies, unless a longer period is permitted or required by applicable law or our retention policies.
For example, storage may continue beyond the specified period in the event of an (imminent) legal dispute with you or other legal proceedings, or if storage is required by legal regulations to which we are subject. When the storage period prescribed by law expires, the personal data may be blocked or deleted, unless further storage by us is necessary and there is a legal basis for this, or (physical) deletion is technically impossible or unreasonable.
The foregoing does not affect our authority to anonymize data and use it in this anonymized form (i.e., without identifying features).
As with any large company, various domestic and foreign service providers act as processors for us in order to conduct our business transactions. These processors act on our instructions and are contractually obliged to comply with all data protection regulations.
Processors working in connection with our Platform Offers are, in particular, IT service providers (e.g., cloud providers), CRM partners (such as Braze, Salesforce), and payment service providers.
We transfer your personal data to third parties (e.g., business partners or service providers) if this is necessary for the purpose of providing our Platforms and Platform Offers, if we are contractually or legally obliged or entitled to do so, or if you have given your prior consent. We will inform you about the respective details of the transfer below in the relevant sections.
Third parties who receive data may be based outside the European Economic Area (EEA) and/or your country of residence. The European Commission certifies that some third countries have data protection standards comparable to those of the EEA through so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). Comparable data protection has been certified in particular for companies in the United States of America that are certified under the Data Privacy Framework (DPF) Program.
In other third countries to which personal data may be transferred, however, there may not be a consistently high level of data protection. Where this is the case, where required by applicable law, we ensure that data protection is adequately guaranteed. This can be achieved, for example, through binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data, certificates, or recognized codes of conduct.
As a User, you are generally under no legal or contractual obligation to provide us with your personal data. However, we may only be able to provide certain Platform Offers to a limited extent or not at all if you do not provide the necessary data. We will inform you during the input process if the provision of personal data is required for the respective function or application ("mandatory field" = "*"). If the data is required, failure to provide it will result in the function or application in question not being provided. If you do not provide optional data, we may not be able to provide our Platform Offers in the same form and to the same extent.
You can assert your rights as a Data Subject with regard to your processed personal data at any time using the contact details provided in Part A, Section II. As a Data Subject, you have the right:
To request information about your data processed by us in accordance with Art. 15 GDPR;
Pursuant to Art. 16 GDPR, to request the immediate correction of inaccurate data or the completion of your data stored by us;
Pursuant to Art. 17 GDPR, to request the erasure of your data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
To request the restriction of the processing of your data in accordance with Art. 18 GDPR, unless the accuracy of the data is disputed by you or the processing is unlawful;
To receive your data that you have provided to us in a structured, commonly used and machine-readable format or to request its transfer to another controller in accordance with Art. 20 GDPR;
To object to the processing pursuant to Art. 21 GDPR, provided that the processing is based on Art. 6(1)(e) or (f) GDPR. This is particularly the case if the processing is not necessary for the performance of a contract with you. Unless it is an objection to direct marketing, we ask you to explain the reasons why we should not process your data as we have done when exercising such an objection. In the event of your justified objection, we will examine the situation and either stop or adjust the data processing or point out to you our compelling legitimate grounds on the basis of which we will continue the processing;
In accordance with Art. 7(3) GDPR, your consent given once (even before the GDPR came into force, i.e. before May 25, 2018) – i.e. your voluntary, informed, and unambiguous declaration of intent, made clear through a statement or other unequivocal confirmatory action, that you consent to the processing of the relevant personal data for one or more specific purposes – at any time, if you have given such consent. As a result, we will no longer be allowed to continue processing data based on this consent in the future; and
Pursuant to Art. 77 GDPR, to lodge a complaint with a data protection supervisory authority about the processing of your personal data in our company, for example with the data protection supervisory authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) [Bayerische Datenschutzbehörde], Promenade 27, 91522 Ansbach, +49 (0) 981 53 1300, e-Mail: [email protected].
This Privacy Policy is current as of October 2025. Due to the further development of our Platforms or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy.
You can participate in our Cashback Programs via the Coupons.com Website or the Coupons.com App and, as a member, receive cashback and take advantage of other cashback offers when purchasing goods or services from companies, with whom we cooperate (hereinafter "Partner Companies"). In addition, we offer the purchase of Gift Cards that we obtain from Partner Companies or other intermediaries, and you can also receive cashback for purchasing these on our Platform. You can then redeem the Gift Cards with the respective providers. In addition, we offer you information on further savings opportunities and other offers that allow you to save money when shopping online with our Partner Companies. These include, in particular, discount codes, voucher codes, promo codes, promotional codes, special promotions, or deals. We summarize these offers under the heading "Smart Shopping."
Further information on Smart Shopping is available at https://www.coupons.com/ and the associated subpages.
When you use the Smart Shopping service we offer via the Coupons.com Website or the Coupons.com App, the following data is collected, stored, and processed, depending in part on your user behavior:
"Server log files": The provider of the pages automatically collects and stores information in so-called server log files (log files), which your browser automatically transmits to us. These are:
Browser type and browser version;
Operating system used;
Referrer URL;
Host name of the accessing computer;
Time of the server request;
Full IP address.
"Chatbot data": If you contact us via our chatbot support tool, we process the personal data you provide. This may include:
Your email address (if you provide it or if it is already linked to your account);
The content of your messages and any information you voluntarily provide to us;
Technical metadata such as browser type, operating system, IP address, and time of the request.
"Registration data": When you register on our Platform and create a User Account, the data transmitted in the process is processed:
If you register with your email address and a password, we process your email address to create and verify your User Account and to contact you if necessary. Your password is stored exclusively in encrypted form;
If you register via a social login service (e.g., Google, Facebook, Apple), we receive your email address from the respective provider and, depending on your settings with the provider, possibly additional information such as your first and last name. The scope of the data transmitted depends on the privacy settings you have selected and the privacy policy of the respective provider.
"Payment data": As part of the payment process (e.g., when purchasing Gift Cards), you must provide your account details and verify your identity using a two-factor authentication process. For this purpose, we process the following data:
First and last name;
(Mobile) phone number;
Billing address;
Payment method details (e.g., credit card number)
"Payout data": As part of the payout process, you must provide your account details and verify your identity using a two-factor authentication procedure. We process the following data for this purpose:
First and last name;
(Mobile) phone number;
Address;
Bank details: name of the account holder, IBAN, BIC
PayPal information: email address or phone number.
"User communication data": To communicate with you, we use the following data (for marketing purposes only if you sign up for our marketing communication services (newsletter, push notifications)):
Email address (only optional for push notifications);
Device tokens (for push notifications);
IP address;
Time of registration and confirmation of registration;
General device information (e.g., device type and operating system version);
Identification data (e.g., session IDs, cookie IDs, web browser used, email client);
Location of the device of the User;
Views and clicks in the newsletter;
Views and clicks on push notifications and in-app messages.
"Survey data": If you provide us with feedback on your own initiative or as part of one of our surveys, we process data that you provide to us in surveys or on your own initiative.
"Order data": When you place an order with our Partner Companies, we process the following data :
Content and value of the purchase made;
Amount of our commission;
Order number;
Date and time of the transaction.
"Competition data": If you participate in a competition, prize draw, or similar promotional campaign organized by us, we process the following data, depending on the specific nature of the competition:
First and last name;
Email address;
Phone number;
IP address;
Company account information;
In the event of a win and subject to the type of the price additionally: Copy of both sides of your identity card or passport; address; IBAN for the bank transfer.
For Tracking Technologies, see Part B, Section VI.
The personal data referred to in Part B, Section II is processed for the purposes described below. Insofar as the processing is based on Art.6(1)(f) GDPR, these purposes also represent our legitimate interest.
"Server log files":
Collection and evaluation of technical usage data to identify security-relevant patterns and to prevent fraud and abuse (legal basis: Art. 6(1)(f) GDPR);
Improvement of the quality of the various functions of the website (legal basis: Art. 6(1)(f) GDPR);
Statistical analysis of the use of the website and its various functions (legal basis: Art. 6(1)(f) GDPR).
"Chatbot data": Processing of customer inquiries (legal basis: Art. 6(1)(f) GDPR).
"Registration data":
Creation of a User Account for the processing of services offered and provided via the Platforms and verification of the email address for setting up the User Account (legal basis: Art. 6(1)(b) GDPR);
Prevention of misuse by third parties (legal basis: Art. 6(1)(b) and (f) GDPR);
Sending notifications and information about related service offers (legal basis: Art. 6(1)(f) GDPR, in the case of advertising use Art. 6(1)(a) GDPR);
Sending reminders and support messages (legal basis: Art. 6(1)(b) and (f) GDPR).
"Payment data": Processing the purchase of Gift Cards (legal basis: Art. 6(1)(b) GDPR).
"Payout data": Processing the payout of purchased cashback (legal basis: Art. 6(1)(b) GDPR).
"User communication data":
Sending notifications or other notices in connection with transactions (e.g. reminders with respect to incomplete transactions) (legal basis: Art. 6(1)(b) GDPR);
Sending newsletters and push notifications as well as other notices, and for the provision of location-based services, if you give your consent (legal basis: Art. 6(1)(a) GDPR).
"Survey data": Conducting and evaluating surveys, implementing your feedback to improve our Platform Offers (legal basis: Art. 6(1)(a), (f) GDPR).
"Order data": Billing our commissions to our Partner Companies (legal basis: Art. 6(1)(f) GDPR).
"Competition data": Implementation of the advertising campaign (e.g., to verify eligibility, notify winners, send prizes, and/or publish the winners on our website) (legal basis: Art. 6(1)(b) GDPR).
Your data will be processed for as long as is necessary to achieve the above-mentioned processing purposes (see Part A, Section VIII). In addition to these general provisions, the following applies to the individual data categories:
"Server log files": We delete log data as soon as it is no longer required to achieve the purpose for which it was collected. Users' IP addresses are deleted or anonymized after 14 days at the latest.
"Chatbot data": Chatbot data remains with us until you request us to delete your User Account and the related data. Mandatory legal provisions – in particular retention periods – remain unaffected.
"Registration data": We store the data collected during the registration process for the duration of the registration. Registered Users have the option of changing the personal data provided during registration at any time in their User Account or having it completely deleted from our database. If you exercise this right, we will immediately delete the User Account and the personal data stored therein.
"Payment data": Payment data is only stored for as long as is necessary to execute and document the transaction and for any legally required retention periods.
"Payout data": The personal data collected during verification as part of the payout process is only stored for as long as is necessary for the execution, documentation, and any legally required storage.
"User communication data": We delete this data – subject to statutory retention obligations or any other relevant legal basis for data processing – as soon as the User withdraws their consent to the processing of marketing communication data, permanently deletes their User Account, or becomes inactive. Users are considered inactive if no transaction has occurred within the past two years and no login has taken place within the past six months.
"Survey data": We store this data until your User Account is permanently deleted.
"Order data": This data is retained until the deletion of the account or a corresponding deletion request and are anonymized thereafter.
"Competition data": Unless expressly stated otherwise, personal data collected by us in the context of promotional campaigns will not be stored for longer than is necessary to fulfill the purpose of the respective promotional campaign.
With regard to the storage period for Tracking Technologies, please refer to Part B, Section VI.
In addition to us and our responsible employees, the following categories of recipients may have access to your personal data:
Payment service providers: We work with external payment service providers to process payments (legal basis: Art. 6(1)(b) GDPR):
If you choose to make a payment via PayPal, we will transfer the necessary data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter: "PayPal") in order to process the payment. This usually includes your PayPal email address and the payout amount. PayPal acts as an independent controller in this processing. For more information, please refer to PayPal's privacy policy (https://www.paypal.com/webapps/mpp/ua/privacy-full).
Technical service providers: We sometimes use external technical service providers to provide certain functions and for payout processes, in particular two-factor authentication (2FA). For example, one-time passwords (OTP) are sent via SMS using the Amazon Simple Notification Service (SNS) provided by Amazon Web Services, Inc., which acts as a processor for us in accordance with Art. 28 GDPR.
CRM service provider: We use the "Braze" service from Braze, Inc., 330 W 34th Street, New York, NY 10001 (hereinafter "Braze"), a platform for customer interaction. Braze processes data on the use of our mobile and web applications (e.g., behavioral and transaction data) as well as information from Users who have signed up for marketing communications to enable the targeted display and delivery of newsletters (transactional and marketing-related), push notifications, in-app messages, web pushes, and content cards. Braze acts as a processor for us in accordance with Art. 28 GDPR and is certified under the EU-U.S. Data Privacy Framework. For more information about data protection at Braze, please refer to Braze's privacy policy (https://www.braze.com/company/legal/privacy).
Chatbot tool: We use the Intercom chatbot, a service provided by Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105 (hereinafter "Intercom") to offer you real-time customer support. Intercom processes your data as a processor on our behalf in accordance with Art. 28 GDPR and in accordance with existing data processing agreements. Intercom is certified under the EU-U.S. Data Privacy Framework. For more information about data protection at Braze, please refer to Intercom's privacy policy (https://www.intercom.com/legal/privacy).
Partner Companies and Affiliate Networks: When you click on an offer provided on our Platforms or in our newsletter, we assign an identifier to that click, which consists of various pseudonymous characteristics (hash from browser properties and the current time). We pass this pseudonymous identifier (billing-related data) on to the Partner Company for which we provide the offer. If you then visit the website of the Partner Company in question and make a purchase or carry out another transaction there, the Partner Company can identify you as coming from our Platform and we receive our commission. We also work with so-called "Affiliate Networks", which mediate contact with Partner Companies and, if necessary, take care of the technical process and billing. In these cases, we pass on the pseudonymous identifier to the Affiliate Networks for the purpose of billing commissions (legal basis: Art. 6 (1)(f) GDPR). Furthermore, we only pass on data relating to you to Partner Companies with your express consent (legal basis: Art. 6(1)(a) GDPR).
For Third-Party Technologies, see Part B, Section VI.
When we share data on the basis of our legitimate interest, our interests correspond to the purposes described above.
For information on ensuring an adequate level of data protection when transferring data to third countries, see Part A, Section XII.
As already explained in Part A, Section VI, we automatically collect certain information about your use of our Platforms using Tracking Technologies employed either by us or by third-party providers. For more information about
Whether and which Tracking Technologies are used if you consent to this (legal basis: Art. 6(1)(a) GDPR or, with respect to Germany, § 25(1) TDDDG) or
Which Tracking Technologies are technically essential for the provision of our digital service and may also be used without your consent in accordance with, with respect to Germany, Section 25(2) No. 2 TDDDG,
How long the resulting information is stored, and
Details of the Third-Party Technologies used and the associated data processing
can be found in our Cookie Policy for the Coupons.com Website or the Coupons.com App . You can use our cookie consent tool to object to any use of Tracking Technologies that requires consent at any time and also to revoke any consent you may have given. Alternatively, you can also notify us that you wish to revoke your consent.
Insofar as we receive information via Tracking Technologies, this information is used or further processed for the following purposes:
Essentially, Tracking and the associated analysis are carried out to fulfill our contractual obligations towards our Users (legal basis: Art. 6(1)(b) GDPR), and to share data with Partner Companies and/or Affiliate Networks so that Users receive the Platform Offers they request.
We have a legitimate interest in using Tracking to ensure that Users do not use our Platforms to cause financial harm to affiliated merchants and providers (legal basis: Art. 6(1)(f) GDPR).
We also use Tracking to measure the success of our advertising campaigns and to optimize the display of advertisements (legal basis: Art. 6(1)(f) GDPR).
We use Tracking Technologies to determine and compile statistical indicators on the use of our Platform offers (legal basis: Art. 6(1)(f) GDPR).
We also use Tracking Technologies to display personalized advertising (legal basis: Art. 6(1)(f) GDPR).
If you are a California resident, the following provisions apply to our processing of your personal data about you.
1. Personal data we collect. The above Section B.II sets forth the personal data we collect. This includes the following categories of personal data:
Identifiers, such as real name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.
Personal data described in subdivision (e) of Cal. Civ. Code Section 1798.80, such as name, address, telephone number, credit card number, debit card number, or other payment information.
Commercial information, such as products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Internet or other similar network activity, such as information regarding your interaction with a website, application, or advertisement.
Geolocation data.
Inferences, such as a profile about your preferences, characteristics, and behavior.
We collect above categories of personal data from you, through automatic data collection, and from other sources and retain each category of personal data as described in Part A, Section VIII titled “Storage location and storage period” above.
2. How We Use Personal Data. For the business and commercial purposes for which we process personal data, please see Part B, Section III , Part C, Section III , and Part D, Section III , each titled “For what purpose and on what legal basis is this data processed?” above. Our uses of personal data include the following:
Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
Helping to ensure security and integrity to the extent the use of your personal data is reasonably necessary and proportionate for these purposes.
Debugging to identify and repair errors in our systems.
Short-term, transient use including contextual non-personalized advertising shown as part of your current interaction with us.
Providing services on our behalf, including maintaining or servicing accounts, providing customer service, fulfilling transactions, verifying identity information, processing payments, providing promotional competitions, and other services.
Conducting internal research to develop and demonstrate technology.
Conducting activities, including administering surveys, to verify, enhance, and maintain the quality or safety of the Platforms and their various functions.
We may also use the information we collect for our operational purposes, purposes for which we provide you additional notice, provided that such additional purposes are compatible with the context in which your personal data was collected, or with your consent.
3. Disclosures of Personal Data; Notice of Right to Opt-Out. Within the last 12 months, we have disclosed all or substantially all categories of personal data above for our business purposes. To learn more about the categories of entities to whom we disclose such information, please see Part B, Section V, Part C, Section V, and Part D, Section V, each titled “Is this data passed on to third parties?” above.
We do not sell personal data for monetary consideration, but like many companies that operate online, we share personal data for marketing purposes. As a result, we share, and in the past 12 months have shared, identifiers, commercial information, and inferences with our advertising partners for cross-context behavioral advertising. You have the right to opt-out of the sharing of personal data for cross-context behavioral advertising, see “Your California Privacy Rights” immediately below for more information. We do not sell or share, and in the past 12 months have not sold or shared, personal data of California consumers we know to be under 16 years of age.
By clicking on or otherwise seeking to use, redeem, or claim a Platform Offer, you expressly consent, accept and agree that we may share your personal data with Partner Companies and/or our Affiliate Networks, and to the use of Tracking Technologies for this purpose.
4. Your California Privacy Rights. You have certain rights related to your personal data, including:
The right to know what personal data we have collected about you, including the categories of personal data, the categories of sources from which your personal data is collected, the business or commercial purpose for collecting, selling, or sharing your personal data, the categories of third parties to whom we disclose your personal data, and the specific pieces of personal data we have collected about you.
The right to correct inaccurate personal data that we have collected about you.
The right to delete personal data that we have collected from you.
The right to opt out of the sharing of your personal data for cross-context behavioral advertising.
For rights to Know, Correct, or Delete, you may request to exercise these rights by emailing us at [email protected] or [email protected].
To exercise the Right to Opt-Out, you can click on the link in the footer of our website titled “Do Not Sell or Share My Personal Information” to deactivate cookies that may share your information for advertising purposes.
Our website also recognizes the Global Privacy Control (“GPC”) signal, which enables you to opt out of certain uses or disclosures of your information. If you notify us of your preference through GPC, we will treat such signal as a valid request to opt out of sharing or targeted advertising for the associated browser or device, and, if we are able to associate the device sending the signal to a specific account, we will apply the opt out request to the account as well. To learn more about GPC, you can visit https://globalprivacycontrol.org/.
As required or permitted under applicable law, we will take steps to verify your identity before acting on your request to exercise your rights. We may require you to provide information about yourself to verify your identity in response to exercising requests.
You may designate an authorized agent to make a request on your behalf. You may make such a designation by providing the agent with written permission to act on your behalf. We may require the agent to provide proof of that written permission, or may require you to verify your own identity, even if you choose to use an agent. If you are an authorized agent submitting a request on behalf of a California resident, please email us at [email protected].
You also have the right not to receive discriminatory treatment by us for the exercise of privacy rights conferred by applicable law. Please note, we do not process sensitive personal data for purposes that, under applicable law, require us to support the right to limit the use or disclosure of sensitive personal data.
If you are a resident of a U.S. state other than California with a comprehensive privacy law that applies to us, the following provisions apply to our processing of your personal data.
1. Targeted Advertising. We do not sell personal data for monetary consideration, but like many companies that operate online, we share personal data for marketing purposes. As a result, we share identifiers, commercial information, and inferences with our advertising partners for targeted advertising.
By clicking on or otherwise seeking to use, redeem, or claim a Platform Offer, you expressly consent, accept and agree that we may share your personal data with Partner Companies and/or our Affiliate Networks, and to the use of Tracking Technologies for this purpose.
2. Profiling and Sensitive Data. We do not process your personal data for the purpose of profiling in furtherance of decisions that produce legal or similarly significant effects under applicable law. Please also note personal data we process may include certain “sensitive data” as such term is defined under applicable law, in which case we will process your sensitive data in accordance with applicable law.
3. Your Privacy Rights. You may have the following rights, in each case to the extent set out in applicable law:
The right to confirm whether we process personal data about you and request access to such personal data (including, if applicable, in a portable and readily usable format) or certain information about how we process or disclose your personal data.
The right to correct inaccuracies in certain personal data we may hold about you.
The right to delete personal data we have collected from or about you.
The right to opt out of the processing of your personal data for targeted advertising.
For rights to Access, Correct, or Delete personal data, you may request to exercise these rights by emailing us at [email protected].
To exercise the Right to Opt-Out, you can click on the link in the footer of our website titled “Do Not Sell or Share My Personal Information” to deactivate cookies that may share your information for advertising purposes.
Our website also recognizes the Global Privacy Control (“GPC”) signal, which enables you to opt out of certain uses or disclosures of your information. If you notify us of your preference through GPC, we will treat such signal as a valid request to opt out of sharing or targeted advertising for the associated browser or device, and, if we are able to associate the device sending the signal to a specific account, we will apply the opt out request to the account as well. To learn more about GPC, you can visit https://globalprivacycontrol.org/.
If your rights request is denied, you may lodge an appeal with us. If you would like to appeal against our decision for your request, you may submit a request for appeal to [email protected] and note in the subject line that the communication is an appeal.
As required or permitted under applicable law, we will take steps to verify your identity before acting on your request to exercise your rights. We may require you to provide information about yourself to verify your identity in response to exercising requests.
You may designate an authorized agent to make a request on your behalf. You may make such a designation by providing the agent with written permission to act on your behalf. We may require the agent to provide proof of that written permission, or may require you to verify your own identity, even if you choose to use an agent. If you are an authorized agent submitting a request on behalf of a California resident, please email us at [email protected].
You also have the right not to receive discriminatory treatment by us for the exercise of privacy rights conferred by applicable law.