Privacy policy

Responsible for data processing on this website under Art. 4 (7) GDPR is Julian Pachernegg, sole proprietor and operator of savebackcards.com (details in the imprint):

No data protection officer has been appointed; the conditions of Art. 37 GDPR are not met. The controller handles data protection requests personally.

Every time a page or file is requested, the web server (nginx) writes a line to its access log — and, if the request fails, to its error log:

• your IP address
• date and time of the request
• the requested address (URL), including everything after the “?” — for example your answers in the Card Finder or the calculator (section 3)
• the HTTP status code and the amount of data transferred
• the page you came from (referrer), if your browser sends it
• your browser’s identification (user agent)

Purpose: delivering the website, keeping it secure (detecting attacks and abuse) and fixing errors. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is a secure, working website. Storage: the logs are rotated daily and deleted automatically after 15 days at the latest. We do not combine them with other data or build profiles from them. The application behind the web server does not record IP addresses.

Both tools send your answers (such as country of residence, monthly card spending, currency and preferences) to our server as part of the page address so that it can compute the result. The application does not save the answers and cannot link them to you. Because they are part of the address, they appear in the server log described in section 2 and are deleted with it. The free-text field for preferred assets is meant for coin names — please do not enter personal information there. Legal basis: Art. 6 (1) (f) GDPR (providing the function you asked for).

The result is a ranked list of cards, not a decision with legal or similarly significant effect on you; there is no automated decision-making under Art. 22 GDPR.

To see which comparisons are useful and which outbound links are used, the application counts how often a card is shown (per card, page placement and day) and stores each click on a “Get the card” button with the card, the link type, the placement and the time. These counts contain no IP address, no cookie, no device or user identifier and cannot be traced back to a person. The request that reports a count passes through the server log like any other request (section 2).

This website sets no cookies and stores nothing in your browser (no local storage). It loads no scripts, fonts, maps, videos or other content from third parties — the fonts are served from our own server. There are no analytics, advertising or social media tools. That is why there is no consent banner.

“Get the card” buttons lead through a short redirect on our server (/go/…) to the issuer’s website or to an affiliate partner. From that point on, the issuer’s or partner’s privacy policy applies. Affiliate links can contain campaign and partner identifiers, and the partner programme may set cookies on its own website to attribute a sign-up to us. We only ever receive and store aggregated figures (such as the number of sign-ups and the commission), never your name or other personal details. Which buttons use affiliate links is explained in our affiliate disclosure.

If you write to us, we process your e-mail address, your name if you give it, and the content of your message in order to answer you. Legal basis: Art. 6 (1) (f) GDPR (answering your enquiry). We delete the correspondence once it has been dealt with, unless statutory retention obligations apply.

The website and its database run on a virtual server operated by Contabo GmbH, Welfenstraße 22, 81541 München, Germany, on our behalf as a processor under Art. 28 GDPR. Your data stays in the European Union. E-mails reach us through our e-mail provider. We do not pass data to anyone else, do not sell it and do not transfer it to countries outside the EU/EEA.

• access to the data we hold about you (Art. 15 GDPR)
• rectification (Art. 16) and erasure (Art. 17)
• restriction of processing (Art. 18) and data portability (Art. 20)
• objection to processing based on Art. 6 (1) (f) on grounds relating to your particular situation (Art. 21)

Contact us using the details in section 1. We cannot recognise you in the server log without additional information (Art. 11 GDPR); if your request concerns log entries, please tell us your IP address and the time of your visit.

You also have the right to lodge a complaint with a supervisory authority, in Austria the Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, www.dsb.gv.at.

We update this policy when the processing changes. The version published here applies; the date at the top shows when it was last changed.