Privacy Policy

Please find Webgains' GDPR and website (incl. cookies) privacy policies below

Webgains Privacy Policy: General Data Protection Notice
Webgains Privacy Policy: Webgains.com – Cookies

Data protection instructions for data processing within the business activities of Webgains  

Webgains provides what is known as an affiliate marketing platform. Advertisers can register with this Webgains platform and submit online advertising (“ads”). In parallel, “publishers” also register with Webgains. Their task is to take the advertising content placed by the advertisers and disseminate it on the Internet. They might do this, for example, on their own websites or in their newsletters. The task of Webgains is to bring advertisers and publishers together, record the orders brokered for the advertisers and to handle the remuneration for the publishers. In addition, the advertisers must pay a sales-based remuneration to Webgains.  

A case study: a publisher has a blog on the theme of e-bikes, in which they discuss the latest developments. They register as a publisher with Webgains, receive access to the advertising submitted for e-bikes and incorporate the advertising provided into their blog. If a visitor to the blog clicks on this advertising, they will be taken to the advertiser. There the visitor can look at the details of the advertised item and potentially buy it. On behalf of the advertisers, Webgains records publishers’ brokerage activities and produces appropriate reports for each advertiser. Webgains receives details of a publisher’s brokerage activities from the advertiser so that it can invoice its own services and the publisher’s brokerage services on the basis of this data.  

The data-processing activities on which the business activity is based have been optimised with respect to the GDPR and developed in a privacy-friendly way. See below for more details. 

I. Who is the “controller” with responsibility for the processing of the personal data?
What is the scope in which the processing of the personal data takes place? 

Use of the Webgains affiliate marketing platform, along with the subsequent data processing associated with the display of advertising and the later purchase of the advertised items, entails various responsibilities from a data-protection perspective. Not only the publishers but also the advertisers, as well as Webgains as the operator of the platform, work partly on their own responsibility and partly as part of a “joint control” pursuant to Art. 26 GDPR. 

1. On the publisher

In the first instance, each publisher is itself responsible for the operation of the website/blog on which it displays the advertising. With regard to the forwarding of an interested party’s data after clicking on the website, there is a joint responsibility pursuant to Art. 26 GDPR with the relevant advertiser whose ads have been placed on the publisher’s publication. Both parties have made an agreement pursuant to Art. 26 GDPR and inform each other about the scope of the data processing pursuant to Art. 12 et seqq. GDPR.   

2. On the shop operator/advertiser

Once the advertiser’s landing page/website or online shop has been accessed, the advertiser is itself responsible for the data processing in the first instance. Webgains provides the affiliate marketing platform to the advertiser. This platform enables advertisers to process the queries brokered by publishers. For example, it documents the cases in which there has been a purchase of a product after a brokerage activity by a publisher. The advertiser is responsible under data protection law for these data processing actions – including storing cookies once an affected party, or “data subject”, has given their consent. Webgains becomes active on behalf of the advertiser as the “processor” (see Art. 28 GDPR). The advertiser informs the affected parties, or “data subjects”, of these data processing actions separately on its website. In addition, data subjects receive further information here on how to contact the advertiser. 

3. On the data processing by Webgains

The following data processing actions by Webgains take place under Webgains’ own data protection responsibility. The controller – unless otherwise specified – is:

Webgains Limited, 1st Floor South, The Quorum, Bristol, BS1 3AE 

You can find further details of the company on the Company Details page at https://www.webgains.com/public/en/webgains-company-details/ 

In the event of questions about the processing of your personal data as part of the affiliate marketing platform or on the subject of data protection, please contact support@webgains.com. 

You can contact the data protection officer, Dr. Stefan Drewes, at datenschutz@webgains.de 

Webgains has signed data protection contracts with both the advertiser and the publisher concerning the use of the affiliate marketing platform. Advertisers are required to pay a remuneration to Webgains for the use of the platform. This remuneration also includes the amount due to the publisher. Under contract law, Webgains is required to pay the publisher its commission for successful brokerage activities and to calculate in advance the due amount of this commission. In order to calculate the remuneration for the sales brokered by a publisher, the advertiser sends details to Webgains on signature of contract. These must include the following:

  • a reference number that represents a purchaser/a purchase; 
  • a reference number that enables the brokered transaction to be associated with the publisher; 
  • contractual and billing data (product, value, currency and the like); 
  • automatically transferred data about the Internet-user’s end device (browser, operating system and the like). 

No additional personal data, and in particular no name and no contact details (address etc.), are sent to Webgains. The advertiser provides Webgains only with the details required for the fulfilment of the intended data processing purposes. This transfer is made on the basis of Art. 6 (1) (1) (f) GDPR in order for Webgains to be able to meet its contractual obligations. 

The advertiser and Webgains are jointly responsible, within the meaning of Art. 26 GDPR, for this transmission of the data that results from the brokered conclusion of contract.  

Furthermore, Webgains produces a report on the basis of the data transferred. This is intended to enable publishers to optimise their own sales activities. Webgains also produces recommendations both for advertisers, with regard to potentially suitable publishers, and for publishers, with regard to potentially suitable products. The data processing actions on which the reports and the recommendations are based are carried out on the basis of Art. 6 (1) (1) (f) GDPR. The legitimate interest consists in optimising business activities. The report is also provided in joint responsibility with the relevant publisher and advertiser. 

In addition, Webgains processes the accrued data for its own purposes outside the joint responsibility: Webgains processes the data transferred by the advertiser for statistical purposes. This includes an anonymised evaluation of the data in order to make a capacity plan. In addition, data is evaluated to identify and investigate any offences or impermissible use of the affiliate marketing platform (anti-fraud and abuse measures). This data processing also takes place on the basis of Art. 6 (1) (1) (f) GDPR. 

Three years after the transfer, the data transferred to Webgains is erased unless there are legal retention obligations that prohibit this. Webgains must regularly provide such data during audits by financial auditors – as well as for audits by the financial authorities (German Tax Code [AO]/Commercial Code [HGB]). In such cases, first the compulsory-retention data is locked; then, after the legally applicable deletion term expires – usually ten years – it is permanently erased.  The legal basis for the processing of the personal data is Art. 6 (1) (1) (b), (c), (f) GDPR. 

II. To which recipients does Webgains send your data?

Webgains works with service providers (known as “processors”) and will be happy to name these to you on request. The most important service providers used by Webgains are: 

  • Webgains Ltd., UK, for the management of the application and for IT support 
  • Other Webgains companies in certain EU member states and in the UK in the case of advertising campaigns displayed across the EU 
  • Amazon Web Services EMEA SARL, Luxembourg, as hosting provider 
  • Pulsant Ltd., as hosting provider  
  • Other EU-based service providers for technical support  

III. Data processing outside EU / EEA

Webgains works with service providers outside the EU/EEA. These service providers are based in the UK, which is recognised by the EU Commission as equivalent.

IV. Your rights as a data subject

As a party affected by the data processing, or “data subject”, you have the following rights. Because of the agreements Webgains has made with the publishers and advertisers, you can also assert your rights as a data subject to Webgains with regard to the processes encompassed in the joint responsibility. If you want to make use of these rights, please contact: support@webgains.com

  • Right of access pursuant to Art. 15 GDPR 
  • Right of rectification pursuant to Art. 16 GDPR 
  • Right to erasure of your data pursuant to Art. 17 GDPR 
  • Right to restriction of processing pursuant to Art. 18 GDPR 
  • Right to data portability pursuant to Art. 20 GDPR 

At any time and without having to state reasons, you may object to any processing of personal data for advertising purposes that is undertaken on the basis of legitimate interests. 

In addition, pursuant to Art. 21 (1) GDPR you have the right to raise an objection at any time to the processing of your personal data, for reasons connected with your particular situation, on the basis of Art. 6 (1) (1) (f) GDPR. In this case, reasons must be given for the objection. 

V. Right to complain to a supervisory authority

If you believe that your data has been processed in contravention of data protection law, you have the right pursuant to Art. 77 (1) GDPR to complain to a data protection supervisory authority. 

VI. Use of an automated decision-making process

In accordance with Art. 22 (1) and (4) GDPR, there is no automated decision-making – including profiling. 

Declaration valid as of: 23 May 2022  

Webgains Privacy Policy: Cookies

This privacy policy describes the processing of personal data in the context of the use of the Webgains website. It also contains information about the rights you have and how to contact Webgains.

I. Who is responsible for the processing of personal data?

Responsible for this website and the associated processing of personal data is:

– Webgains Limited, 1st Floor South, The Quorum, Bristol, BS1 3AE

Further information on the company can be found in the imprint, available at: https://www.webgains.com/public/en/webgains-company-details/

If you have any questions about the processing of your personal data within the framework of this website or about data protection, please contact support@webgains.com.

The data protection officer Dr. Stefan Drewes can be reached as follows: datenschutz@webgains.de.

II. Which data is processed for what purpose when visiting the website?

1. Processing of data when accessing the website

When you access our website, the following information of a general nature (so-called log file data) is automatically collected:

Date and time of access; IP address; website from which our website was accessed; websites accessed through our website; page(s) visited on our website; information about the browser type and version used; operating system.

The temporary storage of this data is technically necessary for the correct delivery of our website. The data is also mandatory when using the Internet and when calling up a website.

We store the log file data to ensure the functionality and security of the information technology systems. For these purposes, our legitimate interest lies in the storage of log file data. We store the data that we collect when accessing the website (log file data) for 14 days in order to detect and analyse any attacks against our website. The legal basis for the processing of personal data is Art. 6 para. 1 sentence 1 lit. f GDPR.

2. Processing of data when using the contact form or for e-mail inquiries

If you use the contact form available on our website or send us an enquiry via the e-mail addresses provided, we will collect your data for the processing and answering of your request. We store your requests and the associated data provided for evidence purposes for a period of two years. The legal basis for data processing is  Art. 6 para. 1 sentence 1 lit. f GDPR.

3. Notes on data security

We use appropriate technical and organisational measures to protect your personal data stored by us from access by third parties, loss or misuse and to enable a secure data transfer. The transmission of the personal data entered by you takes place with the secure standard SSL (Secure Socket Layer). You can recognise a secure SSL connection by the URL https://… as well as the lock symbol in the address bar of your browser.

We must point out that due to the structure of the Internet, unwanted data access by third parties may occur. It is therefore also your responsibility to protect your data against misuse through encryption or in any other way. Without appropriate protective measures, data transmitted unencrypted in particular, even if this is done by e-mail, can be read by third parties.

III. Your rights as a data subject

As a data subject, you are entitled to the following rights. If you wish to exercise these rights, please contact us:

  • Right to information according to Art. 15 GDPR
  • Right to rectification pursuant to Article 16 GDPR
  • Right to erasure of your data pursuant to Article 17 GDPR
  • Right to restriction of data processing pursuant to Article 18 GDPR
  • Right to data portability according to Art. 20 GDPR

You can object to the processing of personal data for advertising purposes at any time without giving reasons.

In addition, pursuant to Article 21 (1) GDPR, you have the right to object at any time to the processing of your personal data on the basis of Article 6 (1) (f) GDPR for reasons arising from your particular situation. In this case, the objection must be justified.

IV. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data violates data protection law, you have the right to complain to a data protection supervisory authority in accordance with Article 77 (1) GDPR.

V. Existence of automated decision-making

Automated decision-making in accordance with Article 22 (1) and (4) GDPR – including profiling – does not take place.

VI. Integration of third-party service offerings

1. Integration of Google TAG Manager

For the delivery of online advertising and the integration of external partners, we use the Google Tag Manager of the service provider Google Ireland Limited. This allows us to control the delivery of online advertising. This tool works without cookies, but requires the transmission of IP addresses to Google. The anonymisation of the IP address before forwarding to Google has been activated by us. The legal basis for data processing is Art. 6 para. 1 s. 1 f) GDPR.

2. Integration of Google Maps

On this website we use the Google Maps, an product of the company Google Ireland Limited. This serves the purpose of showing you interactive maps directly on the website, making it easy to find the locations indicated by us on the website and the convenient use of the map function.

This application is retrieved directly from Google’s servers, so that the company receives the IP address currently assigned to you. By visiting the website, Google receives the information that you have accessed the corresponding subpage of our website. Whether and to what extent or over what period of time the IP address is stored by Google and used internally is beyond our knowledge. The legal basis for the integration of this service is Art. 6 para. 1 sentence 1 lit. a GDPR.

If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that Google will use your IP address and store it for profiling.

Further information on data protection at Google can be found under: http://www.google.de/intl/de/policies/privacy/

VII. Our Cookie Policy

1. General information on the use of cookies

Our website uses cookies. Cookies are small text files that are stored on your device and stored by your browser. They serve to make our offers more user-friendly, effective and secure. We use both temporary cookies, which are automatically deleted when you close your browser (“session cookies”), as well as persistent (permanent) cookies.

You have the choice whether you want to allow the setting of cookies. You can make changes in your browser settings. In principle, you have the choice whether you want to accept all cookies, be informed when cookies are set or reject all cookies. If you opt for the last variant, it is possible that you will not be able to use our website in full. You can change individual settings in the cookie settings.

When using cookies, a distinction must be made between the strictly necessary cookies and against cookies for further purposes (measurement of access figures, advertising purposes).

2. Strictly necessary cookies when using the website

We use session cookies on our websites, which are absolutely necessary for their use. This includes cookies that allow us to recognise you while you visit the site as part of a single session. These session cookies contribute to the secure use of our offer.

3. Use of cookies with your consent

Below you will find an overview of the cookies that we use with your consent given at the beginning of your use of the website. With each presentation of the use, you will also find an opt-out option. These are cookies to record the usage behavior of our website as well as cookies that are used for advertising purposes.

a. Use of cookies to record usage behaviour (tracking)

The use of tracking cookies enables us to recognise users when they access our website again and thus assign usage processes to an internally assigned code number (pseudonym). This allows us to record repeated accesses to our website and analyse them in a coherent manner.

Specifically, the following tracking cookies are used:

Tracking by Google Analytics

On this website we use the web analysis service Google Analytics of the service provider Google Ireland Limited commissioned by us. This tool uses “cookies”, which are text files that are stored on your computer, to help the website analyse how users use the site. We have activated IP anonymisation on this website. As a result, your IP address will be shortened and anonymised. On our behalf, our service provider will collect information about your recent visits to our website or how you interact with our website and will use this information to evaluate your use of the website and to compile reports on website activity.

The data collected by the web analysis service is partly stored and processed by our service provider in the USA. Your data will only be transferred to the USA with your express consent.

We use the web analytics service to analyse the use of our website and thus better understand how visitors use our website so that we can make it even more intuitive. Legal basis for the storage of the cookie and the further evaluation of the collected data over a period of six months is the consent given, Art. 6 para. 1 sentence lit. a GDPR. You can revoke your consent at any time with effect for the future in our cookie settings (cookie button at the bottom of the page).

Google Ads Tracking

We use the Google Ads, another product of Google Ireland Limited, to draw attention to our attractive offers with the help of advertising media (Google Ads) on external websites. These advertising media are delivered by Google via “ad servers”. Ad server cookies are used, which enable the evaluation of performance parameters such as ad impressions, clicks and conversions. In this way, we can determine how successful the individual advertising measures are in relation to the data of the advertising campaigns. If you access our website via a Google ad, Google Ads will store a cookie in your PC. The following analysis values are usually stored for this cookie:

  • Unique Cookie ID
  • Number of Ad Impressions Per Placement (Frequency)
  • Last Impression (Relevant for Post-View Conversions)
  • OptOut information (marking that the user no longer wants to be addressed)

These cookies allow Google to recognise your Internet browser. If a user visits certain pages of an Ads customer’s website and the cookie stored on their computer has not yet expired, Google and the Ads customer can recognise that the user clicked on the ad and was redirected to this page. Each Ads customer is assigned a different cookie. Cookies can therefore not be tracked via the websites of Ads customers. We ourselves do not collect or process any personal data in the aforementioned advertising measures. We only receive statistical evaluations from Google. Based on these evaluations, we can see which of the advertising measures used are particularly effective. We do not receive any further data from the use of advertising material, in particular we cannot identify the users on the basis of this information. The legal basis for the storage of the cookie by Google is the consent given (Art. 6 para. 1 sentence 1 lit. a GDPR).

We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our state of knowledge:

By integrating “tracking tools”, Google receives the information that you have accessed the corresponding website of our website or have clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider will find out and store your IP address. Further information on data protection at Google can be found here: https://policies.google.com/privacy?hl=en-US

b. Use of cookies for advertising purposes

We use cookies for marketing purposes, for example to tailor advertising to the interests of a website visitor. They are also used to limit the frequency of the ad and to measure the effectiveness of an ad. This records which websites and which articles have been clicked. This allows us to collect information about usage habits in order to control interest-based advertising. This information is shared with third parties. In these cases, the cookies are regularly set directly by the advertising partner.

Specifically, the following cookies are set:

Use of Google Remarketing

In addition to AdWords tracking, we also use Google Remarketing. This is retargeting, thus encompassing the delivery of interest-based advertising on other advertising spaces outside our offer. Through this application, after visiting our website, you can be shown advertisements about the services / products previously viewed on our website when visiting other websites. The cookie stored in your browser is used for recognition. For example, Google may record interest in certain products based on your previous visit to our website and use it for the targeted display of advertising on other websites. A combination of the data collected in the context of remarketing with your personal data, which may be stored by Google, does not take place by Google according to its own statements. In particular, according to Google, pseudonymisation is used in remarketing.

The use serves to be able to provide you with interest-based advertising and to advertise our products in a targeted manner. Google has submitted to the EU-US Privacy Shield. The legal basis for the storage of the cookie is the consent given (Art. 6 para. 1 sentence 1 lit. a GDPR). The further evaluation of the collected data over a period of up to two years is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR.

If you do not want advertisements tailored to your interests to be displayed, you can deactivate cookies in your browser or inform Google of this for the future at the following link: https://www.google.com/settings/ads/onweb/

Facebook Pixel / Custom Audience

On our website we have integrated the Facebook pixel of Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. When accessing our website, a redirect to Facebook takes place via a Re-Direkt. The following data can be forwarded:

  • http header information (such as the IP address, information about the browser used, country-specific data, e.g. the language)
  • Unique Cookie ID
  • Information about events on the page (such as page view information or buttons clicked)
  • Time

Facebook can mark the device you are using with a cookie and a unique identifier or read out any existing cookie. If you are logged into Facebook, this data can be used to display targeted advertising for us on the Facebook pages. The legal basis for the storage of the cookie and the forwarding of the data to Facebook Ireland Limited is the consent given in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

We are jointly responsible with Facebook Ireland Limited for the collection and transmission of the above data. For this reason, we have concluded a joint responsibility agreement with Facebook in accordance with Article 26 GDPR, which defines the responsibilities for fulfilling the obligations under the GDPR. You can retrieve this under https://www.facebook.com/legal/controller_addendum.  Facebook has been designated as the point of contact for data subject inquiries regarding the data collected via the Facebook Pixel. Therefore, we would like to ask you to contact Facebook’s data protection officer directly with regard to your rights as a data subject: https://www.facebook.com/help/contact/540977946302970.

Against the background of the fact that we do not have access to the data collected about you within the framework of the Facebook Pixel, Facebook only has the direct access to the necessary information and can also immediately take any necessary measures and provide information. Should our support nevertheless be required, we are at your disposal.

When using the Facebook pixel, we cannot rule out the possibility that Facebook may also process the data in the USA. A transfer of your data to the USA will only take place after your express consent. You can revoke your consent at any time in our cookie settings.

The further processing and evaluation of the collected data is the responsibility of Facebook. Further information on data protection at Facebook in general and more detailed information on the handling of the data collected within the framework of the Facebook Pixel, such as the legal basis for Facebook’s processing, can be found in Facebook’s data policy at: https://www.facebook.com/about/privacy

You can change your Facebook settings for advertising here: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen 

Using the LinkedIn Insight Tag

On our website we use the LinkedIn Insight Tag of the LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. When you access our website, you are redirected to LinkedIn via a Re-Direct. The following data can be forwarded:

  • Unique Cookie ID
  • Accessed website
  • Time

LinkedIn can mark the device you are using with a cookie and a unique identifier or recognise any existing cookie. If you are logged into LinkedIn, this data can be used to display targeted advertising for us on the LinkedIn pages. The data is also processed by LinkedIn in the USA. A transfer of your data to the USA will only take place after your express consent. The legal basis for the storage of the cookie and forwarding of the data to LinkedIn is the consent given (Art. 6 para. 1 sentence 1 lit. a GDPR). You can revoke your consent at any time in our cookie settings. The further evaluation of the collected data is the responsibility of LinkedIn.

Further information and LinkedIn’s privacy policy can be found at: https://www.linkedin.com/legal/privacy-policy?trk=lithograph_footer-privacy-policy

Status of the declaration: 01.09.2021