Privacy Policy

1. Who We Are (Data Controller)

TinyGeniusPlay ("we", "us", "our") is the data controller responsible for this website. Our contact details are listed in our Impressum.

For data protection enquiries, please contact us at: privacy@tinygeniusplay.com

2. What Data We Collect

We may collect the following categories of personal data:

• Usage data: pages visited, time spent, referring URLs, browser type, device type, IP address (anonymised where possible).
• Cookie data: your cookie consent preferences stored in your browser's localStorage.
• Contact data: if you contact us via email, we retain your email address and message content.
• Affiliate click data: when you click an Amazon affiliate link, Amazon may set cookies on your device (see Section 4).

We do not collect names, postal addresses, or payment information directly.

3. Why We Collect It (Legal Basis — Art. 6 GDPR)

We process personal data on the following legal bases under Article 6 GDPR:

• Art. 6(1)(f) — Legitimate interests: to operate and improve this website, prevent fraud, and ensure security.
• Art. 6(1)(a) — Consent: for analytics and marketing/affiliate tracking cookies, where you have given explicit consent via our cookie banner.
• Art. 6(1)(c) — Legal obligation: to comply with applicable laws (e.g. tax, commercial law).

4. Third Parties

Amazon Associates Programme

TinyGeniusPlay participates in the Amazon Associates Programme for amazon.de and amazon.co.uk. When you click an affiliate link, Amazon may place cookies on your browser to track purchases and attribute commissions. Amazon's privacy policy is available at amazon.de Privacy Notice.

Vercel (Hosting)

Our website is hosted on Vercel. Vercel processes server logs that may include IP addresses. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

Analytics (if enabled)

With your consent, we may use analytics tools to understand how visitors use our site. Analytics are only activated after you accept analytics cookies via our cookie banner.

5. International Data Transfers

Amazon operates servers in the United States and other countries outside the European Economic Area (EEA). When you click an Amazon affiliate link, your data may be transferred to Amazon's US servers. Amazon relies on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal mechanism for such transfers. Vercel also uses SCCs for any data transferred outside the EEA.

6. Retention Periods

• Cookie consent preferences: stored locally in your browser for up to 12 months, after which consent is re-requested.
• Server/access logs: retained by Vercel for a limited period per their data retention policy.
• Email correspondence: retained for up to 3 years from the last communication.
• Amazon affiliate tracking cookies: governed by Amazon's own retention policy (typically up to 90 days for purchase attribution).

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate data.
• Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten").
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time via the Cookie Settings in the footer.
• Right to lodge a complaint: you have the right to complain to a supervisory authority (see Section 9).

To exercise any of these rights, contact us at privacy@tinygeniusplay.com.

8. Cookie Information

We use the following categories of cookies:

You can manage your cookie preferences at any time using the Cookie Settings option in the footer or via the cookie banner shown on your first visit.

9. Contact Us & Supervisory Authority

For data protection requests or complaints, please contact: privacy@tinygeniusplay.com

If you believe your rights have not been respected, you have the right to lodge a complaint with the competent supervisory authority. In Germany, this is the relevant state Datenschutzbehörde (data protection authority). A list of German supervisory authorities is available at bfdi.bund.de.

10. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.