GiveawayShark
← Back to overview

Privacy Policy

Privacy Policy under the GDPR
The operator of this website takes the protection of your personal data very seriously.
Personal data on this website is processed exclusively within the framework of applicable data protection provisions, in particular the General Data Protection Regulation (GDPR) and the German Act on Data Protection and Privacy in Telecommunications and Digital Services (TDDDG).
You can generally use our website without providing personal data. Where processing of personal data is required in an individual case, it is carried out exclusively on a legal basis or on the basis of your express consent.
This Privacy Policy informs you about the nature, scope, and purpose of the processing of personal data, as well as about the rights to which you are entitled.
We have taken appropriate technical and organizational measures to ensure the most complete protection possible of the personal data processed through this website. Nevertheless, internet-based data transmissions may generally have security gaps, so absolute protection cannot be guaranteed.

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
Lorenz Scheithauer
Friedrich-Engels-Str. 3
15741 Bestensee
Germany
Email: gewinnhai@gmail.com

2. Collection and Storage of Personal Data When Visiting the Website

When you access our website, the browser you use automatically transmits information to our website's server. This information is temporarily stored in so-called server log files.

The following data is collected in particular:

  • IP address (truncated or anonymized)
  • date and time of access
  • name and URL of the file accessed
  • the website from which access occurs (referrer URL)
  • browser used and, if applicable, operating system
  • name of the access provider

This data is processed for the following purposes:

  • ensuring a smooth connection setup
  • ensuring system security and stability
  • technical administration of the website

This data is not merged with data from other sources.
Legal basis:
Art. 6(1)(f) GDPR (legitimate interest)

3. Cookies

Our website uses cookies. Cookies are small text files that are stored on your device by your browser. In addition to cookies, we use the browser's local storage (localStorage) in a few places. Which entries these are specifically – with name, purpose, duration, and legal basis – is listed by name in Section 14.

a) Necessary cookies
These cookies are technically required to ensure the operation of the website. Without these cookies, the website cannot function properly.
Legal basis:
Section 25(2) No. 2 TDDDG
Art. 6(1)(f) GDPR

b) Optional cookies (statistics and advertising)
Cookies used for analysis, statistics, or advertising purposes are set only after your express consent.
Legal basis:
Section 25(1) TDDDG
Art. 6(1)(a) GDPR
Consent is given via a cookie consent banner and can be withdrawn at any time.

4. Advertising with Google AdSense

This website uses Google AdSense, an online advertising service provided by
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google AdSense uses cookies and similar technologies (e.g., local storage or so-called web beacons) to display advertisements and measure their performance.

In doing so, the following data may be processed in particular:

  • IP address (usually truncated)
  • device and browser information
  • pages visited
  • approximate location data
  • interactions with advertisements

Information generated by Google AdSense may be transmitted to and stored on Google's servers. This may also result in the transfer of personal data to third countries, in particular the United States.
Google processes this data on the basis of the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR.

In addition to advertisements, this website is financed through so-called affiliate links. They are identifiable by labels such as "Go to shop" or "Go to offer" and are marked as advertising. If you buy something from the partner store after clicking, we receive a commission from the store. This does not change the price for you — you pay the same amount as you would without our link.

Such links lead through this website's own redirect page. The click is counted and you are then forwarded to the partner store; no user profile is created for this purpose. What data the partner store itself collects is governed by its own privacy policy — we have no insight into or access to that.

Affiliate programs have no influence on the selection or ordering of the entries shown on this website.

5. Web Analytics with Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics 4 is used only after your express consent and serves the statistical evaluation of the use of our website, for example page views, time spent on the site, and visitor origin.

In doing so, the following data may be processed in particular:

  • IP address (truncated)
  • device and browser information
  • pages visited and time spent
  • origin of the visit

Cookies are set for this purpose. Your IP address is truncated before it is stored.
Information generated by Google Analytics may be transmitted to and stored on servers of Google LLC in the United States. This may also result in the transfer of personal data to third countries.
Google processes this data on the basis of the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR and under the EU-U.S. Data Privacy Framework.

Google Analytics is only loaded if you have given consent via our consent banner (Google Funding Choices, TCF v2.2) for the purposes of "store and/or access information on a device" and "measure content performance."
Without this consent, Google Analytics is not loaded and no data is transmitted to Google.
Legal basis:
Art. 6(1)(a) GDPR
Section 25(1) TDDDG

The retention period for usage data collected by Google Analytics is limited in the settings of the Google Analytics property; after this period expires, Google automatically deletes the user-related data.

You can withdraw or adjust your consent at any time via the "Cookie Settings" link.

6. Consent and Google Consent Mode v2

Google AdSense is used only after your express consent via our cookie consent tool.
As a certified Consent Management Platform (CMP), we use Google Funding Choices — a solution provided by Google and certified under IAB TCF 2.3 for managing consent for users in the EEA, the United Kingdom, and Switzerland.
We use Google Consent Mode v2 for the technical implementation of your consent decisions.

In doing so, the following consent signals are processed in particular:

  • ad_storage
  • analytics_storage
  • ad_user_data
  • ad_personalization

Depending on your selection, these signals are activated or deactivated.
Without your consent, no advertising cookies are set and no personalized advertising is served.
Legal bases:
Art. 6(1)(a) GDPR
Section 25(1) TDDDG

7. Withdrawing Your Consent

You can withdraw or change your consent at any time with effect for the future.
For this purpose, a corresponding "Change Cookie Settings" link is available on our website.

8. Disclosure of Data

Your personal data is generally not transmitted to third parties, unless:

  • this is required by law, or
  • you have expressly consented.

9. Your Rights as a Data Subject

You have the right:

  • pursuant to Art. 15 GDPR, to request information about your processed personal data
  • pursuant to Art. 16 GDPR, to request the correction of inaccurate data
  • pursuant to Art. 17 GDPR, to request the deletion of your data
  • pursuant to Art. 18 GDPR, to request the restriction of processing
  • pursuant to Art. 20 GDPR, to request data portability
  • pursuant to Art. 7(3) GDPR, to withdraw any consent given at any time
  • pursuant to Art. 77 GDPR, to lodge a complaint with a data protection supervisory authority

10. Data Security

We use SSL or TLS encryption during your visit to the website and employ appropriate technical and organizational security measures to protect your data against unauthorized access, loss, or manipulation.

For advertising and measurement services that require consent, GiveawayShark uses Google's consent interface. Via the "Cookie Settings" link in the footer, visitors can reopen, adjust, or withdraw their selection at any time. Technically necessary functions of the website are not affected by this.

12. Favorites

On the pages for giveaways, coupons, and deals, you can save individual entries to a personal favorites list using the "Save" button. The exact same procedure applies to all three content types: the list stays exclusively in your browser and never reaches our server at any point.

12.1 Without an Account: Exclusively in Your Browser

Without an account, this list is stored exclusively in your browser (localStorage, key gh_merkliste_v2; an earlier version may also leave gh_merkliste_v1 present) and is never transmitted to our server at any point. Only the identifiers of the entries you have saved are stored – no names, no email addresses, no other personal data.

What such an identifier is: a short string consisting of a letter for the content type and an identifying value. g stands for a giveaway, followed by its sequential number (example: g1910). c stands for a coupon and d for a deal, each followed by 12 hexadecimal characters calculated from the store's abbreviation and the entry's title. The list contains nothing beyond these strings and the time they were saved – in particular, no information about when, how often, or for how long you viewed a page.

Even visiting the "Favorites" page does not transmit your list: the page loads a directory of titles of giveaways, coupons, and deals, and only your browser then selects the ones you have saved from it. This directory runs in only one direction – from the server to your browser. No identifier is sent to us as part of the address (query parameter) or by any other means. Our server logs therefore do not show which giveaways, coupons, or deals you have saved.

Legal basis: Storage takes place under Section 25(2) No. 2 TDDDG without consent, because it is strictly necessary for a service you have expressly requested – the favorites list is created only when you click "Save" yourself, and it consists exclusively of this input. A consent dialog therefore does not appear for this.

Deletion: You can remove individual entries again using the same button. You can delete the entire list by clearing your browser's site data for this website. Since this data never reaches us, no request to us is necessary for this.

There is no second case. Until August 20, 2026, this list could move into a user account upon sign-in and from then on be kept on our server. The user account has been removed; the favorites list now always stays in your browser.

14. Overview: Cookies and Local Storage in Detail

This overview names every entry that GiveawayShark itself places on your device – without consent, because it is strictly necessary for a function you have expressly requested (Section 25(2) No. 2 TDDDG). However, not requiring consent does not mean not requiring disclosure: you should know what is on your device, so we inform you about it here pursuant to Art. 13 GDPR. No consent dialog appears for any of these entries, and none of them measures your behavior or serves advertising.

  • gh_gemeldet_ + coupon number (cookie)
    Purpose: remembers that you have already reported for a specific coupon whether the code worked, so the same feedback is not counted more than once. Only the value 1 is stored. See Section 16.
    Duration: 30 days.
    Protection: HttpOnly, SameSite=Lax.
    Legal basis: Section 25(2) No. 2 TDDDG; Art. 6(1)(f) GDPR (protecting the count against duplicate submissions).
  • gh_merkliste_v2 (local storage, localStorage; an earlier version may additionally leave gh_merkliste_v1)
    Purpose: your favorites list – the identifiers of the saved giveaways, coupons, and deals. This entry is never transmitted to us at any point (Section 12.1).
    Duration: until you delete it; it does not expire on its own.
    Legal basis: Section 25(2) No. 2 TDDDG for storage on your device. No further processing takes place on our part, because the data never reaches our server.
  • gh_consent_v1 (local storage, localStorage)
    Purpose: records how you decided in the consent dialog, so that the decision applies on your next visit and the dialog is not shown to you again on every page load. The state (granted or declined), the version of the dialog, and the time are stored.
    Duration: until withdrawn or until you delete it.
    Legal basis: Section 25(2) No. 2 TDDDG; Art. 7(1) GDPR. A declining decision in particular must be stored – otherwise we could not honor it.
  • gh_hist, gh_hist_idx, gh_last_dir, gh_nav_intent (session storage, sessionStorage)
    Purpose: remember, within your browser tab, which pages of this website you have visited and in what order. This determines whether you are currently moving forward or backward – only this way can the page transition in the correct direction and the back path lead correctly. Only addresses on this website and a position number are stored, no input and no identifier of your person.
    Duration: until you close the browser tab. The session storage is then deleted by the browser itself; it does not survive a restart and is not transmitted to us.
    Legal basis: Section 25(2) No. 2 TDDDG (strictly necessary for the display you requested). No processing takes place on our part, because the data never reaches our server.
  • gh:navStack and gh:scroll: + address of the respective page (session storage, sessionStorage)
    Purpose: the same purpose as the previous entry, implemented by the back component: gh:navStack holds the most recently visited addresses on this website (at most 20), so the back button has a meaningful target. gh:scroll: remembers, per list page, how far you had scrolled, so that after going back you are at the same position and not at the top.
    Duration: until you close the browser tab.
    Legal basis: Section 25(2) No. 2 TDDDG. These entries also never leave your device.

Strictly separate from this: cookies that require consent. Google AdSense, Google Analytics 4, and Google's consent dialog (Funding Choices) set their own cookies and comparable identifiers. These are set only after your express consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); the details are in Sections 4, 5, 6, and 11. You can withdraw this consent at any time via the "Cookie Settings" link. The technically necessary entries listed above are not affected by this – they are not advertising cookies and cannot be opted out of without disabling the associated function.

16. Feedback on Coupon Codes

On coupon pages, you can report with a single click whether a code worked or not. This feedback is anonymous and requires neither an account nor contact details.

What is stored: only two counters on the respective coupon — how many times "worked" and how many times "didn't work" was reported. There is no free-text field, nothing about you is stored, and the individual report is not tied to any person.

Protection against abuse: So that a single source cannot skew the counters, we compute a check value from the IP address and store it as an empty marker file in the server's temporary directory — not in the database and with no further content. The check value is derived using a secret key (HMAC-SHA256) that is not stored in the database, and is derived separately per function so that the same person cannot be linked across different functions of the website. The IP address itself is not stored. This gives rise to two limits:

  • a repeat-submission block per coupon and source for 30 days — the same period as for the gh_gemeldet_ cookie (Section 14). It also applies if the cookie has been deleted;
  • a rate limit of at most 10 reports per source within 10 minutes, which catches rapid attempts to try out many different coupons.

Both limits are deliberately set generously, because an entire corporate network, mobile carrier, or Wi-Fi hotspot can sit behind a single IP address; the goal is to stop a script, not to lock out two people on the same network. The marker files become moot once the period has expired.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable data and in protection against automated abuse) in conjunction with Art. 32 GDPR.

17. Currency and Amendment of This Privacy Policy

This Privacy Policy is currently in effect and dated 2025.
Further development of our website or changes in the law may make an update necessary.

18. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) may give you additional rights regarding your personal information. The CCPA/CPRA's mandatory obligations generally apply only to businesses that meet certain thresholds — for example, handling the personal information of roughly 100,000 or more California consumers or households per year, or deriving 50% or more of annual revenue from selling or sharing personal information (Cal. Civ. Code § 1798.140(d)). A personal website of this size and nature is unlikely to meet those thresholds. Regardless, as a matter of policy we honor the following for California residents who contact us:

  • Right to know what personal information we have collected about you, consistent with Section 2 of this Privacy Policy (server log data) and, where you have consented, Sections 4–6 (advertising and analytics cookies).
  • Right to delete personal information we hold about you, subject to the limits described in this Privacy Policy (for example, favorites-list data described in Section 12 never reaches our server in the first place, so there is nothing on our side to delete).
  • Right to correct inaccurate personal information we hold about you.
  • Right to opt out of the sale or sharing of personal information. Advertising cookies (Google AdSense) and analytics cookies (Google Analytics 4) are off by default and are only activated after your explicit consent, as described in Sections 3–6 and 11; you can withdraw that consent at any time via Cookie Settings.
  • Right to non-discrimination for exercising any of these rights.

To exercise any of these rights, contact us using the details in Section 1. We may need to verify your identity before responding.

19. CAN-SPAM Act Notice

GiveawayShark does not send newsletters or other marketing emails; the account and newsletter functions that previously existed on this website have been removed entirely (see Section 12 for the current, account-free favorites feature). The only email traffic between you and us is initiated by you — for example, when you write to the address in Section 1. The coupon-code feedback described in Section 16 does not involve email at all.

Should this website begin sending commercial or marketing email in the future, we will comply with the CAN-SPAM Act of 2003, including: accurate "From," "To," and routing information; a subject line that is not misleading; clear identification of the message as an advertisement where required; our valid physical postal address; and a clear, working way to opt out of future messages, honored within the time the law requires.