Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Wisteria GmbH
Hechtstr. 43
82266 Inning, Germany
Email: support@puzzlepotato.com

2. Accessing our website (server log files)

Each time our website is accessed, your browser automatically transmits information to our server, which is temporarily stored in a log file. The following is recorded:

• the website accessed and the time of access
• the volume of data transferred in bytes
• the website previously visited (referrer)
• the browser and operating system used
• the IP address (anonymised where applicable)

This processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring a smooth connection, comfortable use of the website, and the evaluation of system security and stability.

3. Cookies

We use cookies and similar technologies. Strictly necessary cookies, in particular to manage your session, your shopping cart and to store your cookie settings, are used on the basis of § 25 (2) TDDDG and Art. 6 (1) (b) and (f) GDPR; no consent is required for them (for our cookieless reach measurement, see section 4).

We only set statistics and marketing cookies (see sections 5 to 7) if you have consented via our cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Your consent is voluntary and not required to use the shop; you can withdraw it at any time with effect for the future via “Cookie settings” in the footer. A complete list of all cookies used, including storage periods, can be found on our “Cookie Policy” page.

4. Reach measurement (cookieless)

To determine the load and usage of our shop, we carry out our own cookieless reach measurement (page views, the number of visitors per day and of concurrently active visitors, and the most viewed pages). For this, your browser generates a random identifier that is held only in the memory of the respective browser tab; no cookies are set and no data is stored on your device. So that we count you as a visitor only once per day, we derive a daily changing, irreversible key from your IP address and your browser identifier (user agent); it exists only in our server's memory and is not stored.

We also process your approximate location, which our network provider Cloudflare (see section 19) determines from your IP address: the country and, where known, the city, with coordinates rounded to about 10 km. We keep the city and coordinates only while you are active on our website and delete them no later than 15 minutes afterwards; we use them to show the visits currently in progress on a map. For each page view we store, without any link to your person, only the page viewed, the country and the time, and delete these details after 91 days. If you come to our shop from elsewhere, we also count, per day and country, where visits came from. We derive the source from the name of the website that referred you (such as google.com, without the address of the individual page), from the campaign tags in the link and from whether the link came from an ad; all we store is the number of visits per source, without any link to your person. If you are signed in to your customer account, we assign the ongoing visit to your account for this time; for business customers, this lets our staff see who is currently active in the customer portal.

We do not store the IP address itself for reach measurement. To limit abuse, we merely count in our server's memory how many page views arrive from one IP address on the same day, and discard this count at the latest when the day changes. We do not combine this with other data sources and do not track you across devices. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the statistical evaluation and in ensuring the stable operation of our offering.

5. Google Analytics 4

If you have consented, we use Google Analytics 4, a web analytics service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies (_ga and _ga_*, stored for 2 years each) and processes pseudonymous identifiers (client and session ID) as well as device and usage data to evaluate how our shop is used. After a purchase we also transmit, server-side, a purchase event with client/session ID, order number and cart data to Google Analytics (Measurement Protocol) to attribute the purchase to the session; this, too, only happens if consent has been given.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without consent, Google Analytics is not loaded. Google processes this data on our behalf as a processor under the Google Data Processing Terms (Art. 28 GDPR). Data may be transferred to Google LLC in the USA; the transfer rests on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified (the UK Extension and the Swiss-U.S. DPF apply to the UK and Switzerland). Where the DPF does not apply in an individual case, the transfer is based on your consent (Art. 49 (1) (a) GDPR); the USA may then not provide an equivalent level of data protection, and authorities may access data without you having effective legal remedies. You can withdraw your consent at any time via “Cookie settings” in the footer. Further information: https://policies.google.com/privacy.

6. Google Ads

If you have consented, we use Google Ads (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to measure the success of our ads (conversion measurement) and for remarketing. Cookies such as _gcl_au and _gcl_aw (3 months each) and IDE (13 months) are set to recognise whether you reached us via an ad and whether a purchase followed. After a purchase we also transmit a pseudonymised (SHA-256-hashed) form of your email address to Google (“Enhanced Conversions”) to attribute the purchase to the ad; the hashing takes place in your browser and the email address itself is never sent to Google. This, too, only happens with your consent to Google Ads.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer. For the processing of advertising data in its own systems, Google is an independent controller; Google's controller-controller data protection terms apply in that respect. Data may be transferred to Google LLC in the USA; the transfer rests on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified (the UK Extension and the Swiss-U.S. DPF apply to the UK and Switzerland). Where the DPF does not apply in an individual case, the transfer is based on your consent (Art. 49 (1) (a) GDPR); the USA may then not provide an equivalent level of data protection, and authorities may access data without you having effective legal remedies. Further information: https://policies.google.com/privacy.

Google Customer Reviews: after an order you can, if you wish, open the "Google Customer Reviews" programme on the order confirmation page. Only with that click is a Google module (Google Ireland Ltd.) loaded and your order number, email address, delivery country and estimated delivery date sent to Google; if you agree inside the module, Google emails you after delivery asking for a review. Google may place and read cookies or similar technologies (such as web beacons) in your browser to do this; you can delete or block cookies at any time in your browser settings. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); it is voluntary, and without your click no data is transferred to Google. Google is independently responsible for the further processing; for the transfer to the USA the above applies.

7. Meta Pixel and Conversions API

If you have consented, we use the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) to measure the success of our advertising on Facebook and Instagram and to build audiences (custom audiences). The pixel sets cookies (_fbp, _fbc and fr, stored for 3 months each) and records your interactions with our shop. After a purchase we also transmit, server-side via the Meta Conversions API, a pseudonymised (SHA-256-hashed) form of your email address, the _fbp/_fbc cookie IDs and order data (e.g. order value and currency) to Meta to attribute the purchase to the ad; this, too, only happens if consent has been given.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without marketing consent, neither the pixel is loaded nor does the server-side transmission take place. For the collection and transmission of this data we are joint controllers with Meta (Art. 26 GDPR); the arrangement for this is Meta's Controller Addendum. Under it, Meta is responsible in its own right for the subsequent processing of the data. Data may be transferred to Meta Platforms Inc. in the USA; the transfer rests on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Meta Platforms Inc. is certified (the UK Extension and the Swiss-U.S. DPF apply to the UK and Switzerland). Where the DPF does not apply in an individual case, the transfer is based on your consent (Art. 49 (1) (a) GDPR); the USA may then not provide an equivalent level of data protection, and authorities may access data without you having effective legal remedies. You can withdraw your consent at any time via “Cookie settings” in the footer. Further information: https://www.facebook.com/privacy/policy.

8. Where orders come from (campaign attribution)

To understand which pages and campaigns lead to orders, we note the following during your visit, without storing anything on your device for it: the page through which you entered our shop (without any appended parameters), the domain of the website you came to us from, the campaign parameters of the address you opened (UTM parameters, e.g. source, medium and campaign name) and a short code we use to mark links and recommendations on our own pages. When you add an item to your cart or place an order, we store this information with the cart and the order, together with the type of device (smartphone, tablet or computer), which we derive from the information your browser sends with every page request. If you later order from the same cart, we attribute the order to this origin. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to see which advertising and which content lead to purchases. We delete this information 14 months after the order; on a cart, after an order or after 90 days without changes.

If you have consented to statistics cookies, we additionally store the campaign parameters, the entry page and the origin of a visit that began through a campaign or such a marked link in your browser for up to 90 days. If you order on a later visit within this period, we attribute the order to that first campaign (“first-touch” attribution). The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer.

If you have consented to Google Ads and came to us through a Google ad, we also transmit the click identifier that Google appends to the address you opened (gclid, gbraid or wbraid) when you order, and store it with the order so that we can attribute the purchase to the ad. We do not store the click identifier on your device ourselves for this; with your consent, Google stores it in the cookie _gcl_aw (see section 6). On the order, we delete it 90 days after the order. The legal basis is your consent (Art. 6 (1) (a) GDPR).

9. Consent log (cookie consents)

We log your decision in the cookie banner (consent or rejection) server-side so that we can demonstrate it (Art. 7 (1) GDPR). We store a pseudonymous consent ID generated in your browser, your decision per category, the version of the consent text, the time, the page accessed, a truncated (not complete) IP address and the browser identifier (user agent). The legal basis is Art. 6 (1) (c) GDPR (duty to demonstrate consent) in conjunction with Art. 6 (1) (f) GDPR. The log is retained for 13 months and then deleted.

10. Customer account and registration

You can create a customer account with us. The data collected for this (e.g. name, email address, billing and delivery address) is processed to perform the contract and manage your account on the basis of Art. 6 (1) (b) GDPR. You can have your customer account deleted at any time by contacting us.

For business customers (B2B) we additionally process the VAT identification number to assess tax liability. Sign-in to the customer account is passwordless via a one-time code sent by email.

10a. Leaderboard

In your customer account you can take part in our leaderboard: you choose a nickname and upload a picture of each puzzle box you have solved, which our team checks and approves or rejects. We first scan every picture for viruses. We do not store the uploaded file itself but two square copies made from it: one of up to 1200 pixels, which only you and our team see, and one of 256 pixels for the leaderboard. In doing so we remove all metadata embedded in the picture, such as the place where it was taken (GPS). The virus scan and this processing run on our own server. We also compare every picture automatically with those already submitted, using a greyscale copy of 64 pixels that we keep for this: an identical one is rejected at once, and a very similar one is shown to our team for comparison.

On the public leaderboard we show your nickname, your rank, your level (the number of your approved boxes), your approved pictures in the small size and when you uploaded them, and, if you gave a country, its flag. On other pages of our shop, such as the hint pages, we show the first three places with their flag but without the nickname, each with one of its approved pictures, chosen anew every day. Anyone can view the leaderboard, and search engines may index it. We never show your name or your email address there.

If you wish, you can give a country and, within it, a city or postal code, or tap your place on a map. From the city or postal code we determine a position accurate to about 11 km, using a place directory on our server; a place you tap is rounded to about 11 km in your browser already, and we determine the country from it. While you type a city or postal code, we suggest matching places and postal codes from that directory; what you type goes to our server for this and is stored only when you save. The map you tap on comes from our own server, not from a map service. We show your approved boxes at that position as a dot on a world map; if you gave only a country, they count for that country. A dot shows only the country and how many boxes were solved there, never your nickname and never the name of the place. As a suggestion you can take over with one tap, we show you the country and city that Cloudflare determines from your IP address (see section 19), and open the map in that area; we store only what you take over and save.

We email you when you reach a new level or when we do not approve a picture. With a rejection our team may add a note; it appears in the email and next to the box in your customer account. We record your changes and our decisions in the history of your customer account.

If you untick “Show my nickname and pictures on the public leaderboard”, your entry, your pictures and your dots on the map disappear from all public pages at once; in your customer account your boxes still count. If you delete a picture, we remove both copies at once. Pictures already fetched may remain in caches for up to an hour. You can change your nickname, country and city at any time, and remove the country and city. We keep pictures until you delete them or replace them with a new one, and your nickname and other details as long as your customer account exists or until you ask us to delete them. When your customer account is deleted, we delete your participation with all its pictures.

The legal basis is Art. 6 (1) (b) GDPR: we process this data to let you take part in the leaderboard, which you chose to do. Being shown publicly is the purpose of taking part and is therefore preselected; whether it happens is up to you, with the tick box. We base the virus scan, the picture comparison and the place suggestion on Art. 6 (1) (f) GDPR; our legitimate interest lies in the security of our systems, a fair leaderboard and easy entry.

11. Order processing

To process your order we process the order, billing and delivery data you provide. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). Where statutory retention obligations apply (e.g. under commercial and tax law), we store the relevant data on the basis of Art. 6 (1) (c) GDPR for the duration of those periods (generally up to ten years).

12. Disclosure to shipping service providers

To deliver the ordered goods, we pass on your delivery data to the shipping company commissioned with the delivery, insofar as this is necessary for the delivery. The legal basis is Art. 6 (1) (b) GDPR. Depending on the order, this may be one of the following companies:

• DHL / Deutsche Post AG
• DPD Deutschland GmbH
• United Parcel Service Deutschland S.à r.l. & Co. OHG (UPS)
• General Logistics Systems Germany GmbH & Co. OHG (GLS)
• Hermes Germany GmbH

13. Payment processing

Card payment via Stripe

When paying by credit card or comparable means of payment, processing is carried out by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The data required for the payment is transmitted directly to Stripe. The legal basis is Art. 6 (1) (b) GDPR. Further information can be found in Stripe's privacy policy.

Payment via PayPal

When paying via PayPal, processing is carried out by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. The payment data is transmitted directly to PayPal. The legal basis is Art. 6 (1) (b) GDPR. PayPal's privacy terms additionally apply.

Payment by bank transfer (prepayment)

When paying by bank transfer, we process the data required to reconcile the payment. No data is passed on to a payment service provider in this case; the payment is made via your bank.

14. Invoicing, accounting and archiving

To fulfil our tax and commercial-law obligations, we process order and invoice data in our accounting and tax system (DATEV format) and archive invoices in an audit-proof manner. Archiving is carried out in encrypted form on storage operated by us or on our behalf (Nextcloud). The legal basis is Art. 6 (1) (c) GDPR in conjunction with statutory retention obligations.

15. Order management and inventory (ERP)

To process orders, manage stock and inventory, and control shipping, we use an enterprise resource planning system (LingXing). The order and delivery data required for this is transmitted to that system. The legal basis is Art. 6 (1) (b) and (f) GDPR (performance of a contract and efficient order processing).

16. Email dispatch (transactional emails)

As part of order processing we send transaction-related emails (e.g. sign-in codes, order and shipping confirmations, invoices). The legal basis is Art. 6 (1) (b) GDPR.

17. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about products and offers. Subscription uses the double opt-in procedure: after you sign up, we send you an email with a confirmation link; only after you click that link do we add you to the mailing list. If you sign up with the box at checkout when placing an order, the delivery country decides: where this procedure is required or recommended, for example in Germany, Austria and Italy, we also send you a confirmation link; for other delivery countries we add you to the mailing list straight away. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR.

To document your consent, we log the time of sign-up and of confirmation, the IP addresses used, and the wording of the consent. You can unsubscribe from the newsletter at any time, for example via the unsubscribe link at the end of every newsletter email; the withdrawal of your consent takes effect for the future. Our newsletters measure opens and clicks; details and your right to object are in section 17a.

17a. Measuring newsletter opens and clicks; sending

We measure whether and when our newsletters are opened and which links in them are clicked. For this, every newsletter email contains an invisible image (tracking pixel), and its links carry a random identifier assigned only to your subscription. When your email program loads the image or you click a link, it sends our server that identifier, the time, your IP address and your program's identifier (user agent). We evaluate the IP address and user agent only at the moment of the request: to tell automated retrievals (such as preloading by Apple Mail Privacy Protection or by virus scanners) apart from real opens and clicks, and to recognise the kind of email program and device (such as "Apple Mail" or "mobile"). Only that result is stored, neither the IP address nor the user agent.

We use the data to (1) see how many recipients open a newsletter and which content they click, and align content and sending frequency with that, (2) attribute orders you place with the same email address within 5 days after clicking in a newsletter to that newsletter campaign, and (3) mark your subscription as "inactive" if you have received at least three newsletters and have not opened or clicked any of them for 90 days, and then email you less or stop. We do not build profiles for advertising outside our newsletters, and we do not pass the data to third parties.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to measure the effect of our newsletters, to improve them and not to send them to recipients who no longer read them. You can object to the measurement at any time (Art. 21 GDPR): via the "Stop tracking" link in every newsletter email or by email to support@puzzlepotato.com. You then keep receiving the newsletter, without a tracking pixel and without personal links; we delete the opens and clicks recorded so far. Unsubscribing from the newsletter also ends the measurement.

We delete individual open and click events after 180 days; after that we keep only aggregated campaign figures not linked to you, and the date of your last activity for as long as you are subscribed. After you unsubscribe or object, we delete your events within 30 days.

The links in our newsletters that lead to our shop also carry a campaign tag that is the same for all recipients (e.g. utm_campaign); under section 8 this shows us how many visits and orders came through a campaign in total. We also receive notices from our email provider about undeliverable emails and spam complaints and remove such addresses from the list. The legal basis for this is also Art. 6 (1) (f) GDPR; our legitimate interest is an up-to-date, deliverable mailing list.

Sending: we send the newsletter via Amazon Simple Email Service (SES) of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, from its Frankfurt am Main data centre (region eu-central-1). AWS processes your email address and the content of the newsletter emails on our behalf under a data processing agreement (Art. 28 GDPR). Tracking pixels and links run through our own servers, not through AWS. Access by the US parent Amazon Web Services, Inc. cannot be entirely ruled out; any such transfer then relies on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Amazon Web Services, Inc. is certified, and additionally on the EU Standard Contractual Clauses in the AWS data processing agreement.

18. Contacting us

If you contact us by email or via a contact form, we process the data you provide in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR (where the enquiry relates to a contract) or Art. 6 (1) (f) GDPR. We keep our correspondence with customer service so that we can follow up earlier concerns, check warranty and goodwill cases and answer similar enquiries better (Art. 6 (1) (f) GDPR); business emails must be kept for six years in any case (§ 257 HGB, § 147 AO). We delete it no later than six years after the end of the calendar year in which the email concerned was received or sent, unless it is needed longer for pending proceedings or a tax assessment that is not yet final. Your rights under section 20, such as erasure, remain unaffected.

For emails to our customer service we use an AI assistant: Claude by Anthropic PBC (USA), as our processor (Art. 28 GDPR). It translates emails written in other languages and suggests replies to consumers' enquiries to our staff. A person reads and sends every reply; there is no automated decision within the meaning of Art. 22 GDPR.

To suggest a reply, the assistant receives the content of your emails and of our earlier correspondence, your name, photos you send us and, where they exist, your orders with us (number, date, items, amount, shipping status and tracking) as well as the newsletter status of your email addresses with your discount codes. To answer similar enquiries better, it can draw on earlier customer-service conversations as examples. To translate, it receives only the subject and text of the email concerned.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR; our legitimate interest is answering enquiries quickly, completely and in your language. We base the transfer to the USA on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR), which form part of our data processing agreement with Anthropic; you can request a copy. Anthropic does not use the data to train its models and deletes it within 30 days, unless its systems detect a breach of its usage policies, in which case it keeps the data for up to two years.

19. Hosting and delivery (Cloudflare)

Our website and the associated systems are hosted by a provider within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Processing is carried out to provide our online offering on the basis of Art. 6 (1) (f) GDPR.

Delivery and protection by Cloudflare

Our website is delivered via the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”). Every request passes through Cloudflare's servers, which protect our offering against attacks (such as overload attacks) and cache content such as images so that it loads faster. In doing so, Cloudflare processes the technical data of each request, in particular your IP address, the requested address, the time and your browser identifier, and determines your approximate location (country, region and city) from the IP address, which it passes on to our servers; section 4 describes what we use it for.

When you sign in to your customer account, sign up for the newsletter or apply as a business customer, we also use Cloudflare Turnstile to detect automated entries (bots). The Turnstile script is only loaded once such a form is displayed; in particular your IP address, your browser identifier and technical characteristics of the connection are then transmitted to Cloudflare.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in providing our offering securely, quickly and protected against abuse. Insofar as Turnstile accesses information on your device, this is strictly necessary for securely providing the service you requested (§ 25 (2) no. 2 TDDDG). Cloudflare processes the data on our behalf on the basis of a data processing agreement (Art. 28 GDPR). Data may be transferred to Cloudflare, Inc. in the USA; the transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Cloudflare is certified (for the UK/Switzerland, the UK Extension and the Swiss-U.S. DPF apply), and additionally on the EU Standard Contractual Clauses. Further information: https://www.cloudflare.com/privacypolicy/.

20. Your rights

Under the GDPR you have the following rights:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of a given consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal message to the contact details above is sufficient.

21. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA).