Privacy Policy

1. Controller

The controller responsible for processing personal data under the GDPR is:

For questions about data protection or to exercise your rights, write to us at support@choosl.net.

2. Scope and summary

This privacy policy applies to the websites choosl.net, choosl.de, choosl.fr and choosl.pl and to the public wishlist view at wishlist.choosl.net. The Choosl app has its own app privacy policy.

In short: the websites set no cookies, use no analytics, advertising or tracking services and load no content from third-party servers. We serve fonts and images from our own server.

3. Hosting and server log files

We run the websites, the wishlist view and our server api.choosl.net on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Hetzner processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

On every request the web server automatically records the following in log files: IP address, date and time, requested address, HTTP status code and amount of data transferred, the previously visited page (referrer), and browser and operating system (user agent).

We need this to deliver the pages securely and reliably and to detect and fend off attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We do not combine the log files with other data and delete them after 14 days at the latest, unless they are needed longer to investigate a specific security incident.

4. No cookies, no analytics

choosl.net, choosl.de, choosl.fr and choosl.pl are static pages. They set no cookies, store nothing in your browser and include no analytics, advertising or social media services. No content is loaded from third-party servers.

5. Links to app stores and other websites

The websites link to the Apple App Store, Google Play and the Data JT website. As long as you do not click such a link, no data is sent to these providers. When you click, you leave our pages, and the privacy terms of the respective provider, such as Apple or Google, apply from then on.

6. Public wishlists (wishlist.choosl.net)

In the Choosl app, parents can share their child's wishlist via a secret link. Anyone with the link can view the list at wishlist.choosl.net – without an account, without the app and without signing in.

What is shown

The child's first name as entered by the parents, the occasion and the wished-for products with image, title, price and a link to Amazon, plus the status (available, reserved, bought) and the name given by whoever reserved an item.

Reserving and marking as bought

To do this you enter a name; a first name or nickname is enough. The name and status are saved via our server api.choosl.net in the parents' wishlist data (in Google Cloud Firestore, see the app privacy policy) and are visible to the parents and to everyone who has the link. So that you do not have to type the name every time, the page remembers it in your browser's local storage (localStorage). You can delete it there at any time in your browser settings. The page sets no cookies.

Visits

When a wishlist is opened, we record the time of the latest visit on the list at most once a day – without any information about you. This tells us the list is still in use, so we do not delete it as inactive. As with the websites, server log files are created (see "Hosting and server log files").

Legal basis and retention

The legal basis is the legitimate interest in coordinating gifts – yours and that of the family sharing the list (Art. 6(1)(f) GDPR). Your name stays stored until the reservation is released or the parents delete the product, the child profile or their account.

Links to Amazon

If you open a product link, you switch to Amazon. The link contains our Amazon Associates tag so that Amazon can attribute a purchase to us. From then on, Amazon (Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg) processes data as an independent controller under its own privacy notice. As an Amazon Associate we earn from qualifying purchases.

7. Contact by email

If you write to us at support@choosl.net, we process your email address and the content of your message to handle your request. The legal basis is Art. 6(1)(b) GDPR where it concerns your use of Choosl, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the message once your request has been dealt with, unless statutory retention obligations require otherwise (Art. 6(1)(c) GDPR).

8. Your rights

You have the following rights regarding your personal data:

• access to the data we hold (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.
• withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

An informal email to support@choosl.netis enough. So that we never hand data to the wrong person, we may ask you to identify yourself, for example via your account's email address.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement.

The authority competent for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

10. Changes to this policy

We update this privacy policy when our processing changes, for example when we add features. The version published here applies; the date at the top shows when it was last updated.