Privacy Policy getmy.anybill.de

Introduction

The following information is intended to give you an overview of how your personal data is processed on our website https://getmy.anybill.de (referred to below as the website). We also want to inform you about your rights under data protection law. We always process your personal data in accordance with the General Data Protection Regulation (referred to below as the GDPR) and all applicable national data protection provisions.

1 Controller

The controller within the meaning of the GDPR is:

anybill GmbH
Türkenstraße 95
80799 Munich, Germany
E-mail: datenschutz@anybill.de
https://anybill.de/de/legal/imprint

2 Data protection officer

You can reach our data protection officer as follows:

Kertos GmbH
DPO: Dr. Kilian Schmidt
Address: Klosterhofstraße 6, 80331 Munich, Germany
E-mail: dsb@kertos.io

You can contact our data protection officer directly at any time with questions or suggestions regarding data protection and to exercise your rights.

3 Provision of the website

3.1 General information

If you use our website for information purposes only, we collect only the data that your browser transmits to our server (in what are known as server log files). Each time a page is accessed, our server records a range of general data and information. This general data and information is stored in the server log files. The following information is recorded:

user agent
URL
time of the server request
IP address

3.2 Purpose of processing

We do not draw any conclusions about you personally from this general data and information. The purposes we pursue include in particular:

ensuring a smooth connection to the website,
ensuring convenient use of our website,
investigating misuse or fraud,
analysing network problems,
evaluating system security and stability, and
other administrative purposes.

3.3 Legal basis

The legal basis for this processing is our legitimate interest within the meaning of Art. 6 (1) sentence 1 lit. f GDPR. We have a legitimate interest in being able to provide our offering in technically sound form.

3.4 Storage period

For security reasons (for example to investigate misuse or fraud), log files are stored for a maximum of 7 days and then deleted. Data that needs to be retained for evidentiary purposes is kept until the matter in question has been finally resolved.

4 Digital retrieval of a receipt

4.1 General information

You have the option of retrieving a digital receipt on our site. For this purpose, all the details we are required to make available to you in order to meet our receipt issuing obligation are recorded. Instead of a paper receipt, these categories of data are made available on our site in the form of a digital receipt.

Using a QR code, you can receive the receipt as a PDF, send it to your e-mail address or add it to a supported app. We also process the receipt data in order to improve our products and services.

On the basis of the receipt data alone, we are not able to establish a link to an identifiable person within the meaning of the GDPR. Receipt data includes:

the retailer's company details
the retailer's address
items purchased
quantity per item
price per item
tax rates per item
discount on an item
basket total
tax rates with amounts
discount on the purchase total
coupons redeemed
coupons issued

If you paid for your purchase electronically, the following data is also recorded:

the primary account number (PAN) of your credit or debit card in masked form
card expiry date
card sequence number
date of payment

If you send the receipt to your e-mail address, we also process your e-mail address.

4.2 Purpose of processing

The purpose of processing is to provide a digital receipt.

4.3 Legal basis

The legal basis for processing your personal data is the performance of a contract and the implementation of pre-contractual measures pursuant to Art. 6 (1) sentence 1 lit. b GDPR, as well as our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR. We have a legitimate interest in being able to provide our offering in technically sound form and in improving our products and services.

4.4 Storage period

As a rule, we store your personal data until the purpose of processing no longer applies. Please note that your personal data contained in merchant payment receipts, which are created at the checkout by the retailer's payment service provider in the case of a card payment, must be stored for 10 years due to statutory requirements under the German Commercial Code and the German Fiscal Code.

5 Registering a bank or credit card for digital receipt delivery

5.1 General information

You have the option of receiving your receipt without scanning the QR code on the checkout customer display: at participating retailers you can register your bank or credit card and, when you pay with the registered card, receive your receipt directly at your e-mail address. This is a voluntary option for receiving your digital receipt.

To register your card with the respective retailer for the first time, the last 4 digits of your bank or credit card and your e-mail address are required.

After registration, the hash value of your transaction data (in particular the primary account number, PAN) of the registered card is stored for each receipt and linked to your e-mail address. We receive the PAN from the payment service provider of the participating retailer. This data is used to assign receipts to the e-mail address so that your receipt can be delivered to you.

5.2 Purpose of processing

The purpose of processing is to provide a digital receipt.

5.3 Legal basis

The legal basis for processing your personal data is the performance of a contract pursuant to Art. 6 (1) sentence 1 lit. b GDPR.

5.4 Storage period

6 Use of third-party services

We use third-party services on our website. In doing so, we transfer data to third countries, meaning countries outside the European Union. We only transfer data to third countries where an adequate level of data protection or appropriate safeguards within the meaning of Art. 44 to 49 GDPR are in place. You have the right to request a copy of the appropriate safeguards we have put in place.

6.1 Microsoft Azure

We use Microsoft Azure.

Provider: Microsoft Ireland Operations Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland
Purpose: Storing digital receipts and providing the web service.
Legal basis: Legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR. The legitimate interest corresponds to our purpose of processing.
Storage period: We delete your personal data as soon as it is no longer required for the purpose for which it was collected.
Third-country transfer: Data is transferred to the USA. We have concluded the European Commission's standard data protection clauses with Microsoft. Microsoft has also implemented additional protective measures.

6.2 Datadog

We use Datadog.

Provider: Data Dog Inc., 620 8th Avenue, Floor 45, New York, NY 10018, USA
Purpose: Enabling technical logging on the website
Legal basis: Legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR. The legitimate interest is the sound provision of our website.
Storage period: We delete your personal data as soon as it is no longer required for the purpose for which it was collected. For the purpose of providing the services, this is the case once the respective session has ended.
Third-country transfer: Data is transferred to the USA. We have concluded the European Commission's standard data protection clauses with Datadog. Further information on Datadog's transfer impact assessment is available here. More information on Datadog's privacy policy is available here.

6.3 Friendly Captcha

To protect our website against automated attacks and spam (for example via forms), we use the Friendly Captcha service provided by Friendly Captcha GmbH, Germany. When certain pages are accessed, a computational task is sent to the visitor's device and must be solved automatically. This proof-of-work check helps to distinguish real users from bots.

As part of this process, technical information (for example connection, environment and interaction data) is transmitted to Friendly Captcha's servers. This data is evaluated solely for spam prevention and system security. Natural persons are not identified and the data is not used for marketing purposes. IP addresses are anonymised by hashing, no cookies are set and no data is permanently stored in the browser.

A content delivery network (CDN) operated by JSDelivr is used to provide the program code (run in part by fastly.com, bunny.net and cloudflare.com). For technical reasons, this may involve the IP address being transmitted to the CDN operators. This transmission serves solely to deliver static content (for example JavaScript files) and is a necessary element of operating the website.

The integration takes place without tracking and without setting cookies. No consent banner or separate consent is therefore required for the use of JSDelivr.

The legal basis for this processing is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in the security and integrity of our website and in fast, stable delivery of its content.

Further information can be found in Friendly Captcha's privacy policy: https://friendlycaptcha.com/legal/privacy-end-users/

6.4 Apple Wallet / Apple Pay (Apple JavaScript SDKs)

On our website we use functional components provided by Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA, in order to offer you the "Add to Apple Wallet" function. This function makes it possible to add digital content such as tickets or loyalty cards directly to your Apple Wallet.

For this purpose, an Apple JavaScript SDK required for the display and technical function of the button is loaded when the relevant page is opened. This establishes a connection to Apple's servers, which in particular transmits the device's IP address. This serves solely to provide the function technically; the data is not used for analytics, tracking or advertising purposes.

No consent required: the integration takes place on the basis of Art. 6 (1) lit. f GDPR (legitimate interest in providing wallet functions conveniently and integrated with the platform).

Further information on data protection at Apple is available at: https://www.apple.com/legal/privacy/en-ww/

7 Sharing your e-mail address with retailers

7.1 General information

When you receive your receipt via the website, you can sign up for e-mail communication with a retailer or with anybill (for example a newsletter). The personal data involved in this process comprises personal details (such as name, gender or date of birth) and contact details (such as e-mail address). Once you opt for e-mail communication with a retailer or with anybill, the data is processed and stored by anybill in accordance with its data protection policies and made available to the retailer. The retailer's own privacy notice applies in addition.

7.2 Purpose of processing

The purpose of processing is the use of personal and contact details by anybill or the retailer to get in touch with you for personalised advertising.

7.3 Legal basis

The legal basis for this processing is your consent within the meaning of Art. 6 (1) sentence 1 lit. a GDPR. Consent can be given via a checkbox below the e-mail address field on the website after you have received your digital receipt.

7.4 Storage period

As a rule, we store your personal data until the purpose of processing no longer applies. In the case of newsletters, this is when you withdraw your consent to the processing of personal data for receiving newsletters from individual retailers, for example by opting out. Retailers are instructed to delete your e-mail address in the event of a withdrawal.

8 Joint controllership

Where we are joint controllers with other companies pursuant to Art. 26 GDPR in connection with providing a digital receipt, we jointly determine the purposes and means of processing for the following processing operations:

4. Digital retrieval of a receipt

Under joint controllership, you can exercise your rights as a data subject (9. Your rights) both against us and against the other company concerned. You can find out whether we are a joint controller with a particular company from the privacy notice relating to that specific collaboration (for example in the privacy policy of an app that we offer together with another company).

9 Your rights

9.1 Right to confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

9.2 Access (Art. 15 GDPR)

You have the right to obtain from us, free of charge and at any time, information about the personal data stored about you, as well as a copy of this data, in accordance with statutory provisions.

9.3 Rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data concerning you. You also have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.

9.4 Erasure (Art. 17 GDPR)

You have the right to request that we erase personal data concerning you without undue delay, where one of the grounds provided for by law applies and where the processing or storage is not necessary.

9.5 Restriction of processing (Art. 18 GDPR)

You have the right to request that we restrict processing where one of the statutory conditions is met.

9.6 Data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, where the processing is based on consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR or Art. 9 (2) lit. a GDPR, or on a contract pursuant to Art. 6 (1) sentence 1 lit. b GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

In addition, when exercising your right to data portability pursuant to Art. 20 (1) GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

9.7 Objection (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of processing in the public interest pursuant to Art. 6 (1) sentence 1 lit. e GDPR or on the basis of our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR.

This also applies to profiling based on these provisions within the meaning of Art. 4 (4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

In individual cases we process personal data for direct marketing purposes. You may object at any time to the processing of personal data for the purposes of such advertising. This also applies to profiling insofar as it is connected with such direct marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for those purposes.

You also have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you that we carry out for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

9.8 Withdrawal of consent under data protection law

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

9.9 Complaint to a supervisory authority

You have the right to lodge a complaint about our processing of personal data with a supervisory authority responsible for data protection.

10 Validity and changes to this privacy policy

This privacy policy is currently valid and dated 14 August 2026.

As we develop our website and our offerings further, or as legal or regulatory requirements change, it may become necessary to amend this privacy policy. You can access the current version of the privacy policy here at any time.