Privacy Policy

Last updated: July 26, 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is PingBacks GmbH (see our Imprint for full contact details). For any questions regarding this privacy policy, please contact us at privacy@pingbacks.example.

2. What Data We Collect

We collect and process the following categories of personal data:

  • Account data: name, email address, hashed password, company name (for provider accounts)
  • Usage data: API requests, transaction history, points balances, login timestamps
  • Technical data: IP address, browser type, device information, cookies
  • Communication data: support requests and correspondence

3. Purpose and Legal Basis of Processing

We process personal data for the following purposes, in accordance with Art. 6 GDPR:

  • Providing and operating the PingBacks loyalty platform (Art. 6(1)(b) GDPR — contract performance)
  • Maintaining an audit-proof transaction ledger for legal and accounting compliance (Art. 6(1)(c) GDPR)
  • Improving our services and preventing fraud or abuse (Art. 6(1)(f) GDPR — legitimate interest)
  • Sending service-related communications and, where consented, marketing emails (Art. 6(1)(a) GDPR)

4. Data Sharing

We share data with hosting providers participating in the loyalty network strictly to the extent necessary to process point transactions (earn, balance, redeem). We may also share data with processors who support our infrastructure (e.g. hosting and email delivery), bound by data processing agreements under Art. 28 GDPR. We do not sell personal data to third parties.

5. Data Retention

We retain account and transaction data for as long as the account is active and, thereafter, for the periods required by applicable statutory retention obligations (e.g. commercial and tax law), typically up to 10 years for financial records.

6. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you (Art. 15 GDPR)
  • Request rectification of inaccurate data (Art. 16 GDPR)
  • Request erasure of your data, subject to legal retention obligations (Art. 17 GDPR)
  • Request restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing based on legitimate interest (Art. 21 GDPR)
  • Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at privacy@pingbacks.example.

7. Cookies

We use essential cookies required for authentication and session management. We do not use third-party tracking or advertising cookies without your consent.

8. Data Security

We implement appropriate technical and organizational measures, including encryption in transit, hashed credentials, and access controls, to protect personal data against unauthorized access, loss, or misuse.

9. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via the platform or by email.