Privacy notice

The controller for this website is BRIGHTREFERENCE - UNIPESSOAL LDA, Portugal (see the legal notice for its details). For anything about your personal data, write to [email protected].

Visiting the website. When a page is requested, our servers and our content-delivery provider process your IP address, the date and time, the address requested, the response, the referring page and browser and device details. We use this to deliver the page, keep the site secure, and find and fix errors. The basis is our legitimate interest in a working, secure website (Article 6(1)(f) GDPR). Logs are kept only as long as needed for those purposes, then deleted.

Error monitoring with Sentry. When an error occurs on the site, your browser or our server sends technical error data to Functional Software, Inc. (Sentry) so that we can detect and fix it: the address of the affected page, your browser and operating system, the error and its context. We have no IP address stored (sendDefaultPii is off) and send no user identifier. The data is stored in Sentry's EU data region (Frankfurt, Germany). The legal basis is our legitimate interest in a working, secure site (Art. 6(1)(f) GDPR).

Searching and browsing. The words you search for, and the market and language you choose, are used to return results. They appear in the page address and so in server logs. We do not store them in a database, link them to you or build a profile of you.

Product images and other third-party content. Product images on product, store and category pages are loaded directly from the servers of the content provider or merchant that supplies them, for example Icecat or a merchant's media server. Your browser sends them your IP address and browser details, as it does for any web request. We have no control over what they record. The basis is our legitimate interest in showing the product (Article 6(1)(f) GDPR).

Your choice about analytics. If analytics is switched on and you answer the consent dialog, we store your answer in one cookie called tb_consent so we can respect it (see the cookie notice). The cookie holds your answer and lasts six months. It is not set before you choose. An older answer about merchant links, from when we still asked about them, stays in the same cookie for as long as it lasts. The basis for remembering your choice is our legal obligation to respect it and our legitimate interest in doing so (Article 6(1)(c) and (f) GDPR).

Following a merchant link. Links to merchants are affiliate links for every visitor. When you follow one, the link goes through the affiliate network Awin before it reaches the merchant. After the click, Awin sets its own cookie and may process your IP address on its own domain, so that a purchase can be matched to Tallybuy and a commission paid; the merchant's site may store identifiers as well. Tallybuy itself sets no tracking cookie and does not receive this data about you. Legal basis: our legitimate interest in being paid for referrals, Article 6(1)(f) GDPR. Merchant links are marked as sponsored. See the affiliate links notice and the cookie notice.

Audience measurement with Google Analytics (only with your consent). If you accept analytics, we load Google Analytics 4, provided by Google Ireland Limited. The purpose is statistics on which pages are visited, so that we can improve the site. What is processed is a randomly assigned identifier of your browser (in the _ga cookie), visit times, pages viewed and events, the referring page, and browser, device and country or region-level location data. According to Google, IP addresses are neither logged nor stored in Google Analytics 4. Advertising features, Google signals and personalised advertising are switched off. The cookies _ga and _ga_<container-id> are set, each for up to two years; some browsers shorten that. Event data is kept in Google Analytics for at most 14 months. The legal basis is your consent (Article 6(1)(a) GDPR and section 25(1) of the German TDDDG). Without your consent the script is not loaded and nothing is sent to Google. You can withdraw consent at any time with effect for the future, through the Analytics settings link in the footer or on the cookie notice page; the cookies are then deleted and the script no longer loads.

Counting views and clicks (only with your consent). If you accept analytics, your browser also tells our own server when you open a product page and when you follow a link to a shop. We add one to a counter for that product and day. The counter holds numbers only: no IP address, no browser details, no cookie and no identifier is stored with it, so the totals cannot be traced to you. We read your browser's name once, in memory, to leave crawlers out, and do not keep it. Daily totals are deleted after 60 days. We use them to see which products are popular, and later to order product lists. The legal basis is your consent (Article 6(1)(a) GDPR and section 25(1) of the German TDDDG); if you decline or withdraw, nothing is counted for you.

Contacting us. If you write to [email protected], we process your email address and what you write to answer you or to check a correction. The basis is Article 6(1)(f) GDPR, or Article 6(1)(b) if you are asking about something you have agreed with us. We keep it as long as needed to deal with your request and any follow-up, then delete it unless a legal duty requires keeping it.

Google may process Google Analytics data in any country where Google or its sub-processors maintain facilities, notably the USA. Where no adequacy decision applies, the transfer rests on the European Commission's standard contractual clauses and, where Google is certified, on the EU-US Data Privacy Framework. This concerns only visitors who accepted analytics; the transfer rests on their consent and the safeguards named. Cloudflare, Inc. is based in the United States. Transfers to it rely on the EU-US Data Privacy Framework where it is certified, or on the European Commission's standard contractual clauses. The same applies to Functional Software, Inc. (Sentry), also based in the United States, although the data is stored in the EU. Awin belongs to a group with companies outside the EEA, and merchants and image servers may also be located outside the EEA; for those, the recipient's own privacy notice applies.

If what we process changes, we update this notice before the change starts. The date at the top shows the latest version.