All codes verified at checkout within the last 7 days · Code Guarantee
VS VoucherStub
Legal

Privacy Notice

Standard notice. Last updated: October 2026.

1. Controller

Grundner Media GmbH, Kaiserdamm 97, 14057 Berlin, Deutschland. Amtsgericht Berlin-Charlottenburg, HRB 171673 B. Managing directors: Mathias Grundner, Christian Grundner. Email: [email protected]. Phone: +49 30 7634 0288.

2. Data protection officer

Datenschutzbeauftragter / Data protection officer: contact via [email protected].

3. Scope

This notice applies to all personal data processed through voucherstub.com and the editorial operations of Grundner Media GmbH. It is written in English for reader clarity; the German version is available on request and prevails in case of substantive conflict.

4. Data we collect

  • Server access logs — IP address, URL requested, HTTP status, timestamp, user-agent. Retained for 14 days for security and operational purposes, then purged. Lawful basis: GDPR Art. 6(1)(f) — legitimate interest in a stable and secure service.
  • Cookie choice token — a single first-party local-storage entry recording whether you accepted or declined the cookie banner. Stored on your device only.
  • Email address, if you subscribe — if you submit your email into the "codes to your inbox" form, we store the email, the destination platform you were viewing, the submission timestamp, your IP and user-agent. Lawful basis: GDPR Art. 6(1)(a) consent, revocable at any time by unsubscribe link in each email. Retention: until you unsubscribe or 36 months of inactivity, whichever comes first.
  • Affiliate click attribution — when you click a "Get Code" button and are redirected to a destination marketplace, the affiliate network of the destination marketplace writes a first-party cookie on their domain containing an opaque publisher identifier. VoucherStub does not read or receive any personal data from this attribution process. Lawful basis: GDPR Art. 6(1)(f).
  • Contact form submissions — name, email, topic, message content. Retained 24 months for support history. Lawful basis: GDPR Art. 6(1)(b) and 6(1)(f).

5. What we do not collect

  • No analytics cookies, no Google Analytics, no Meta pixel, no advertising cookies.
  • No cross-site tracking, no browser fingerprinting.
  • No profiling under GDPR Art. 22.
  • No data sold to third parties.

6. Recipients and processors

  • Hetzner Online GmbH, Gunzenhausen, Germany — infrastructure hosting within the EU/EEA.
  • Cloudflare, Inc., San Francisco, USA — CDN and web application firewall. Data transfer under Standard Contractual Clauses plus the EU-US Data Privacy Framework.
  • Postmark (ActiveCampaign LLC) — transactional and marketing email delivery, under SCCs.
  • Impact Radius, CJ Affiliate, Partnerize — affiliate attribution networks of the respective ticket marketplaces. We do not transmit personal data; attribution is a redirect handled on the destination platform's side.

7. International transfers

Primary infrastructure sits in Germany. Where transfers to the US occur (Cloudflare, Postmark), they are under the EU-US Data Privacy Framework and SCCs. Our transfer impact assessment is available on request.

8. Your rights under GDPR

Articles 15–22 GDPR grant you access, rectification, erasure, restriction, portability, objection and the right to lodge a complaint with a supervisory authority. The competent authority for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany. Exercise rights by email to [email protected]. We respond within 30 days.

9. Children

This site is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has submitted personal data through our forms, email [email protected] and we will delete it.

10. Changes

Material changes are posted on this page at least 15 days before they take effect. Prior versions are available by email.