Privacy policy

1. Controller

The controller for data processing on this website is: Komoxa Digital, Inhaber: Kourosh Shafizadeh, Zimmerseestraße 30, 63477 Maintal, Deutschland, support@pricizo.com. We have not appointed a data protection officer because there is no legal obligation to do so.

2. In short

Pricizo processes only the data needed to operate and secure the site and to provide the features you ask for. We set no cookies for advertising. Apart from technically necessary cookies (see 14), only two things happen solely with your consent: tracking by the partner network (see 9) and statistics with Google Analytics (see 14). We embed no third-party content (fonts, maps, videos, social buttons) and build no advertising profiles.

3. Visiting the website (server logs)

When you visit, our server processes technically necessary data: IP address, date and time, requested address, response status, amount of data and browser identifier (user agent). The purpose is secure and stable operation. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operation and security). The web server's access logs are rotated automatically and deleted after 14 days at the latest. Hosting provider: OVH SAS, Roubaix, France (data processing agreement under Art. 28 GDPR).

4. Protection against attacks and abuse

To protect against attacks, automated scraping and abuse we record suspicious requests (IP address, requested path, browser identifier, type of incident) and may block addresses temporarily. For rate limits we briefly store a salted hash of the IP address. Legal basis: Art. 6(1)(f) GDPR. Security events are deleted after 30 days, request counters after 24 hours, blocks 30 days after they end.

5. Customer account

For an account we store your email address, your password only as a secure hash, your chosen language, the time you confirmed your email and the time of your last sign-in. We send a confirmation email (and, if needed, a password-reset email). Legal basis: Art. 6(1)(b) GDPR (the user relationship). The data stays until you delete your account. If you have not signed in for 24 months, we delete the account; one month before, we inform you once by email (only if your address is confirmed). If you sign in before then, the account stays.

If you choose a delivery country we store it as a strictly necessary cookie “pz_country” (12 months, the country code only). We use it only to show offers that are delivered to your country.

When you sign in we set a technically necessary session cookie (valid up to 14 days) that only recognises you as the signed-in user. No consent is required for this under § 25(2) no. 2 TDDDG.

6. Two-factor authentication (optional)

If you turn it on we store the secret for your authenticator app encrypted and recovery codes only as hashes until you turn it off or delete your account (Art. 6(1)(b) and (f) GDPR – account security).

7. Watchlist and price alerts

We store the products on your watchlist and your price alerts (target price) for you until you remove them or delete your account. For price-alert emails we ask for a separate, explicit consent (Art. 6(1)(a) GDPR) and verify your address with a confirmation link (double opt-in). As proof we store the time and text version of the consent. If you delete your account (or it is deleted for inactivity), we keep this proof for 3 more years: purpose, decision, time and text version, without your email address, only with a check value (hash) calculated from it. The legal basis for this is Art. 6(1)(f) GDPR (proving the consent in case of claims). You can withdraw it at any time in your account or via the unsubscribe link in every email; withdrawal applies for the future. These emails contain only the price alert, no advertising.

8. Sending email

If you write to us by email (for example to the address in the legal notice), we process your sender address, subject, content and time to answer your request (Art. 6(1)(b) or (f) GDPR). Our mailbox is operated by mailbox.org, a service of Heinlein Hosting GmbH, Schwedter Straße 9a, 10119 Berlin, Germany, as a processor under Art. 28 GDPR (a data processing agreement is in place). Processing takes place in data centres in Germany. We delete the emails once your request is dealt with, unless statutory retention duties (for example for business correspondence) require us to keep them.

We send emails (confirmation, password reset, price alerts, replies to enquiries) through an email provider we have engaged. It acts as a processor under Art. 28 GDPR strictly on our instructions; a data processing agreement is in place. Recipient address, subject and content are processed. Legal basis: Art. 6(1)(b) GDPR (account and security emails) or your consent (Art. 6(1)(a) GDPR) for price-alert emails (see 7). If the provider or one of its sub-processors processes data outside the EU/EEA (for example in the USA), the transfer takes place only on the basis of an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework) or the EU standard contractual clauses (Art. 44 et seq., Art. 46 GDPR) with the supplementary measures required. You can obtain a copy of the safeguards on request. After sending we delete the content from our queue; we keep metadata (time, type of email) for 90 days.

9. Clicks on offers and affiliate links

When you click “Go to offer”, we redirect you to the merchant through our server and store a record: offer, time, page type, displayed price and a daily-changing hash created with a secret salt (not your IP address). Purposes are statistics, quality control and fraud detection (Art. 6(1)(f) GDPR); you may object (see 11). We delete raw records after 90 days; only aggregated figures remain.

With the click you leave Pricizo. The merchant and the partner network (AWIN AG, Berlin, Germany) process data under their own or partly joint responsibility and may set cookies or similar technologies to attribute the purchase to Pricizo (tracking). On your first visit the cookie banner asks you (“Accept all” = with tracking, “Necessary only” = without tracking; in the settings the “Partner tracking” switch starts off); if you have not decided there, we ask before your first click on a tracking link whether you want to be forwarded with tracking or directly (without tracking) to the merchant. Forwarding with tracking happens only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you can withdraw it at any time with effect for the future by choosing direct forwarding under “Cookie settings” (link at the bottom of every page). We store your choice with a timestamp so we can prove it, and you can change it at any time. Awin’s privacy notice: https://www.awin.com/de/datenschutzerklarung.

10. Contact form

If you write to us through the contact form, we store your email address, the message, optionally your name, the page language and the time. We use the details only to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them six months after receipt. The message is kept in our administration area and is not passed on to third parties. To protect against abuse we briefly count submissions per address (without storing the IP address in plain text).

11. Recipients and third countries

Recipients are our processors: OVH SAS, Roubaix, France, for the server, database and backups (all data sits on one server we rent in a data centre in the EU); for our mailbox mailbox.org (Heinlein Hosting GmbH, Berlin; processing in Germany) and, for automated email delivery, the email provider named in section 8. OVH processes the data in the EU; for email delivery the statements on possible third-country transfers in section 8 apply. Beyond that, no transfer to third countries takes place, except for statistics with Google Analytics, which runs only with your consent (see 14). After a click on an offer, the merchant and the partner network receive data under their own responsibility (see 9). Data is not passed on for advertising.

12. Your rights

You have the right of access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20) and to object (Art. 21 GDPR) to processing based on legitimate interests. You can withdraw consent at any time (Art. 7(3)). In your account you can export your data as a file and delete your account yourself. Send requests to the email address in the legal notice or through the contact form. You may also complain to a data protection supervisory authority (Art. 77 GDPR), such as the one where you live or the one competent for our location: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

13. Obligation to provide data, automated decisions

You do not need to provide data to use the comparison. An account requires an email address. The Pricizo score rates an offer and makes no decision about you; there is no automated decision-making with legal effect.

14. Cookies

We ourselves set only cookies that are technically required for a service you have expressly asked for to work or to keep your decision stored. No consent is required for these under § 25(2) no. 2 TDDDG; the data processing rests on Art. 6(1)(b) or (f) GDPR. We set no cookies for advertising. The partner network’s tracking after a click on a merchant link (see 9) and statistics with Google Analytics (see below) need consent; the cookie banner asks for them on your first visit. Both options (“Accept all” and “Necessary only”) are equally easy; the necessary cookies cannot be deselected because the site does not work without them. You can change or withdraw your choice at any time under “Cookie settings”. In the production environment the names carry the prefix “__Host-”.

“pz_session”: recognises you as the signed-in user, up to 14 days, only after sign-in. “pz_country”: your chosen delivery country (country code only), 12 months, only if you choose a country. “pz_aff”: your decisions about tracking on merchant links and about statistics (random identifier and choices, no profile data), 12 months, only after you have decided. “pz_rc”: shows your recovery codes once, 10 minutes, only when you set up two-factor sign-in. In addition, your browser remembers in its session storage (“sessionStorage”, entry “pz-paused”) whether you paused the animation on the home page; the entry stays in your browser, is not sent to us and disappears when you close the tab.

Statistics with Google Analytics (only with your consent): if you allow “Statistics” in the cookie banner or under “Cookie settings”, we load Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before that, nothing is loaded from Google. Google then sets cookies in your browser (“_ga” and “_ga_” with our measurement ID, up to 13 months) and processes which pages you view, the time, device and browser details, your approximate location (country and region) and a random identifier; Google Analytics 4 does not store IP addresses. The purpose is to measure reach and improve Pricizo. Google signals and personalised advertising are switched off, and we do not link the data to you as a person. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google acts for us as a processor (Google’s data processing terms). Google LLC in the USA may access data; the transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where Google LLC is certified under it, and additionally on standard contractual clauses. The data in Google Analytics is deleted after 2 months. You can withdraw your consent at any time with effect for the future under “Cookie settings” (link at the bottom of every page); we then remove the Google cookies. Google’s privacy notice: https://policies.google.com/privacy.

After you consent to forwarding with tracking (see 9), the partner network may set its own cookies at the merchant. These cookies do not belong to Pricizo; see the network’s privacy notice for details. You can delete or block cookies at any time in your browser settings; without the cookie “pz_session” you cannot sign in.

15. Changes

We update this notice when features or the law change. Version: 8 November 2026.