Privacy Policy

Last updated: July 14, 2026

This Privacy Policy explains how Germany Unpacked, operated by Tayfun Cortis, collects, uses, stores, and protects personal data when you visit germayunpacked.com or interact with the services available through the website.

We take the protection of your personal data seriously. Personal data is any information relating to an identified or identifiable natural person. We process personal data in accordance with the General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act (“BDSG”), the German Telecommunications Digital Services Data Protection Act (“TDDDG”), and other applicable data protection laws.

This Privacy Policy applies to visitors from Germany, the European Union, the European Economic Area, and other countries. Depending on your place of residence, additional statutory privacy rights may apply.

1. Data Controller

The controller responsible for the processing of personal data through this website is:

Tayfun Cortis
Germany Unpacked
Johannisplatz 4
04103 Leipzig
Germany

Telephone: +49 1522 8228432
Email: tc.geschaeftlich@gmail.com
Website: germayunpacked.com

“Controller” means the person who determines the purposes and means of processing personal data.

No data protection officer has been appointed because there is currently no statutory obligation to appoint one.

2. General Principles of Data Processing

We process personal data only where there is a lawful basis for doing so.

Depending on the relevant processing activity, we may rely on the following legal bases:

  • Consent, pursuant to Article 6(1)(a) GDPR;
  • Performance of a contract or pre-contractual measures, pursuant to Article 6(1)(b) GDPR;
  • Compliance with a legal obligation, pursuant to Article 6(1)(c) GDPR;
  • Protection of vital interests, pursuant to Article 6(1)(d) GDPR;
  • Performance of a task carried out in the public interest, pursuant to Article 6(1)(e) GDPR; or
  • Our legitimate interests or the legitimate interests of a third party, pursuant to Article 6(1)(f) GDPR, provided that such interests are not overridden by your interests, fundamental rights, or freedoms.

Where access to or storage of information on your device requires consent under applicable telecommunications and digital-services privacy law, we request consent before using the relevant technology. Strictly necessary technologies may be used without consent where legally permitted.

Where processing is based on consent, you may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

3. Visiting the Website and Server Log Files

When you access this website, certain information may be transmitted automatically by your browser to the server on which the website is hosted.

This information may include:

  • Your IP address;
  • The date and time of access;
  • The requested page or file;
  • The amount of data transferred;
  • The referring website;
  • Your browser type and browser version;
  • Your operating system;
  • Your internet service provider;
  • Device information; and
  • Technical error and security information.

This information is processed to:

  • Deliver the website and its content;
  • Maintain website stability and functionality;
  • Diagnose technical problems;
  • Prevent fraud, attacks, and misuse;
  • Protect our systems and visitors; and
  • Establish, exercise, or defend legal claims.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, stable, and efficient operation of the website and the prevention of unlawful activity.

Server log data is normally deleted or anonymised after it is no longer required for operational or security purposes. Data may be retained for longer where a security incident, suspected misuse, or legal obligation requires further storage.

4. Hosting by Automattic / WordPress.com

This website is hosted using services provided by:

Automattic Inc.
60 29th Street #343
San Francisco, CA 94110
United States of America

Automattic provides the technical infrastructure required to operate and deliver this website. In connection with the hosting and operation of the website, Automattic may process personal data including:

  • IP addresses;
  • Server log information;
  • Browser and device information;
  • Date and time of access;
  • Requested pages and files;
  • Referrer information;
  • Security and diagnostic information;
  • Cookie and technical identifier information;
  • Comment data, where comments are enabled; and
  • Other information technically required to provide, secure, maintain, and improve the hosting services.

The processing is necessary to make the website available, ensure its stability and security, prevent fraud and abuse, diagnose technical problems, and protect the website against unauthorised access and cyberattacks.

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable, and efficient provision of this website. Where hosting services are required for the performance of a contract or to take steps at your request before entering into a contract, Article 6(1)(b) GDPR may additionally apply.

Automattic may process personal data on our behalf as a data processor. Where required, the processing is governed by a data processing agreement pursuant to Article 28 GDPR.

Because Automattic is based in the United States and operates internationally, personal data may be processed in or transferred to countries outside the European Union and the European Economic Area, including the United States.

Where required by law, such transfers are protected by an applicable adequacy decision, the EU–US Data Privacy Framework where the recipient and processing are covered by it, the European Commission’s Standard Contractual Clauses, or other appropriate safeguards under Chapter V GDPR.

Automattic may also use affiliated companies and subprocessors to provide its services. Further information about Automattic’s processing of data relating to visitors of websites hosted or supported by its services is available in Automattic’s privacy notices.

Data processed for hosting purposes is retained for as long as necessary to provide and secure the website, comply with legal obligations, prevent abuse, resolve disputes, and establish, exercise, or defend legal claims.

5. WordPress

This website uses WordPress as its content management system.

WordPress and installed WordPress plugins may process technical data required to display and operate the website. Depending on their configuration, WordPress components may use cookies or similar technologies, process IP addresses, maintain login sessions, detect spam, or support website security.

The legal basis for processing that is strictly necessary to operate and secure the website is Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional provision of our online service.

Any non-essential WordPress functionality, cookies, or third-party integrations that require consent will only be activated after consent has been provided through our consent management system, unless another lawful basis applies.

6. Cookies and Similar Technologies

We use cookies and similar technologies, such as local storage, pixels, tags, scripts, and device identifiers.

Cookies are small text files stored on your device when you visit a website. Some cookies are deleted when you close your browser. Others remain stored until they expire or are deleted manually.

We distinguish between the following categories:

6.1 Strictly Necessary Cookies

These cookies and technologies are necessary for the website to function correctly, securely, or as requested by you. They may be used, for example, to:

  • Store your cookie preferences;
  • Protect the website against attacks;
  • Maintain technical sessions;
  • Provide core website functions; or
  • Balance website traffic.

Where legally permitted, strictly necessary technologies are used without consent.

The legal basis for any associated processing of personal data is Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional provision of the website.

6.2 Statistics and Analytics Cookies

Statistics technologies help us understand how visitors use the website. They may collect information such as viewed pages, session duration, approximate location, device type, browser type, interactions, and referral sources.

In the European Union and European Economic Area, these technologies are only activated after you provide consent through the consent banner.

The legal basis is Article 6(1)(a) GDPR. Where device storage or access requires consent, your consent also constitutes the relevant permission under Section 25(1) TDDDG.

6.3 Marketing and Affiliate Cookies

Marketing and affiliate technologies may be used to attribute referrals, clicks, leads, purchases, or other actions to Germany Unpacked. These technologies may enable affiliate networks and merchants to recognise that you reached their website through one of our affiliate links.

In the European Union and European Economic Area, marketing and affiliate cookies or similar non-essential technologies are only used after you provide consent, where such technologies are placed or accessed through our website.

The legal basis is Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

6.4 Managing Your Cookie Preferences

We use a consent management solution provided through Complianz.

When you first visit the website, you may be asked to choose which categories of cookies and similar technologies you accept. You can accept, reject, or configure non-essential technologies.

Your consent choice may be stored so that the website can remember your preferences. This storage is necessary to document and respect your decision.

You may withdraw or change your consent at any time through the cookie settings or “Manage Consent” function available on the website. Withdrawal applies only to future processing.

Your browser may also allow you to block or delete cookies. Blocking strictly necessary cookies may impair parts of the website.

For detailed information about the individual cookies and technologies currently detected on this website, including their providers, purposes, and storage periods, please refer to the separate Cookie Policy generated or maintained through Complianz.

7. Complianz Consent Management

We use the Complianz Privacy Suite for WordPress to manage cookie preferences and consent.

Complianz may process or store:

  • Your consent or rejection decision;
  • The date and time of your decision;
  • Consent categories selected by you;
  • Technical information necessary to display the correct consent settings;
  • A consent identifier; and
  • Information about the version of the consent notice presented to you.

This processing is necessary to obtain, record, and respect consent decisions and to demonstrate compliance with applicable privacy laws.

The legal bases are Article 6(1)(c) GDPR, where processing is necessary to comply with legal obligations, and Article 6(1)(f) GDPR. Our legitimate interest is to manage website technologies lawfully and document visitors’ privacy choices.

Consent information is stored for as long as reasonably necessary to demonstrate compliance, resolve disputes, and ensure that your preferences remain effective.

8. Google Analytics

Subject to your consent, this website uses Google Analytics, a web analytics service provided by a company of the Google group.

Depending on the visitor’s location and the applicable contractual structure, the relevant service provider may include:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics helps us understand how visitors interact with the website. For this purpose, Google Analytics may process information such as:

  • Your IP address;
  • Device and browser information;
  • Approximate geographic location;
  • Language settings;
  • Referring website;
  • Pages visited;
  • Date and time of visits;
  • Duration of sessions;
  • Click and scrolling behaviour;
  • Technical identifiers;
  • Conversion and event data; and
  • Information about interactions with website content.

Google Analytics may use cookies and similar technologies to recognise a browser or device and generate reports about website use.

We use this information to:

  • Measure website traffic;
  • Understand which content is useful to visitors;
  • Improve the structure and performance of the website;
  • Identify technical problems;
  • Evaluate referral sources; and
  • Make editorial and commercial decisions regarding the website.

In the European Union and European Economic Area, Google Analytics is activated only after you provide consent through the consent banner.

The legal basis is Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

We intend to configure Google Analytics using appropriate privacy settings. These may include IP-related privacy protections, limited data retention, restrictions on advertising personalisation, and the use of Google Consent Mode. However, the precise data processed depends on the website’s current Google Analytics and consent configuration.

Google may process data on servers located outside the European Union or European Economic Area, including in the United States. Where personal data is transferred internationally, such transfers may be based on an adequacy decision, including participation in the EU–US Data Privacy Framework where applicable, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

You may prevent Google Analytics from being activated by rejecting statistics cookies in the consent banner. You may also withdraw your consent at any time through the cookie settings.

Additional information about Google’s processing practices and privacy controls is available in Google’s privacy and analytics documentation.

9. Affiliate Links and Affiliate Marketing

Germany Unpacked participates in affiliate marketing programmes.

Some links on this website are affiliate links. When you click an affiliate link and subsequently purchase a product, book a service, request an offer, register, or complete another qualifying action, we may receive a commission or other remuneration from the relevant merchant or affiliate network.

The use of an affiliate link does not normally increase the price you pay, unless this is expressly stated.

Our affiliate partners include, in particular:

  • AWIN;
  • CHECK24; and
  • Other affiliate networks, platforms, advertisers, merchants, travel providers, financial service comparison providers, and commercial partners.

Our list of partners may change over time.

9.1 Data Processed When Affiliate Links Are Used

When you click an affiliate link, the affiliate network or merchant may receive information such as:

  • Your IP address;
  • The date and time of the click;
  • The page on which the affiliate link appeared;
  • Technical information about your device and browser;
  • A click, campaign, publisher, or transaction identifier;
  • Cookie or similar tracking identifiers;
  • Referrer information;
  • Information about a subsequent purchase, booking, lead, or other qualifying action; and
  • The value or category of a transaction.

Affiliate tracking is generally used to determine whether a visitor was referred by Germany Unpacked and whether a commission is payable.

We do not normally receive your full payment details from the affiliate merchant. We may receive aggregated reports or transaction information associated with a pseudonymous tracking identifier.

9.2 AWIN

We participate in affiliate programmes operated through the AWIN network.

Depending on the applicable contractual entity and location, AWIN services may be provided by an AWIN group company, including:

AWIN AG
Landsberger Allee 104 BC
10249 Berlin
Germany

AWIN may use cookies, tracking links, device information, click identifiers, transaction identifiers, and other technologies to document referrals, leads, and sales.

When you follow an AWIN affiliate link, AWIN and the relevant advertiser may process information required to attribute the transaction and prevent fraud.

Where AWIN tracking technologies are placed or accessed through our website and require consent, they are activated only after consent has been provided.

The legal basis is Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

After you leave our website, AWIN and the relevant advertiser may process data under their own responsibility and according to their own privacy policies.

9.3 CHECK24

This website may contain affiliate links, widgets, comparison links, or other commercial references to CHECK24 services.

When you click a CHECK24 link, you are redirected to a CHECK24 website or service. CHECK24 may process personal and technical data under its own responsibility, including information necessary to identify the referral, operate its comparison services, prevent fraud, and process enquiries or transactions.

The exact CHECK24 entity responsible for processing may depend on the product category or comparison service you use, such as travel, insurance, energy, telecommunications, loans, or other services.

Any contract, booking, comparison request, or other transaction completed on a CHECK24 website is governed by the privacy information and contractual terms provided by the relevant CHECK24 entity.

Where CHECK24-related tracking technologies are placed or accessed through our website and require consent, they are activated only after consent has been provided.

The legal basis is Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

9.4 Other Affiliate Partners

We may also work with other affiliate networks and merchants.

When you click an affiliate link, you leave our website and enter the website of the relevant third party. The third party may process data as an independent controller according to its own privacy policy.

Because affiliate programmes and merchants may change, the current destination and partner are generally identifiable from the link, button, product reference, or destination page.

Where required, the relevant affiliate service will also be listed in our cookie settings or Cookie Policy.

9.5 Legal Basis for Affiliate Activities

Where affiliate tracking uses cookies or similar non-essential technologies on our website, processing is based on your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

The placement of clearly identifiable affiliate links and the processing of aggregated commission information may also be based on Article 6(1)(f) GDPR. Our legitimate interests are financing the website, measuring the commercial effectiveness of our content, preventing fraud, and operating a sustainable publishing service.

Clicking an affiliate link is voluntary. You may access the merchant’s website directly instead of using our affiliate link.

10. Comments

Comments may be enabled on certain articles or pages.

When you submit a comment, we may process:

  • The name or display name you provide;
  • Your email address;
  • Your website address, where provided;
  • The content of your comment;
  • Your IP address;
  • The date and time of submission;
  • Browser and device information;
  • Moderation information; and
  • Information used to identify spam or abusive content.

We process this information to:

  • Publish and manage comments;
  • Facilitate discussion;
  • Respond to comments;
  • Detect spam, unlawful content, and abuse;
  • Protect the website and other visitors; and
  • Establish, exercise, or defend legal claims.

The legal basis for publishing a comment is Article 6(1)(a) GDPR where your submission constitutes consent to publication.

Security, moderation, and anti-abuse processing is based on Article 6(1)(f) GDPR. Our legitimate interests are protecting the website, maintaining constructive discussions, preventing spam, and enforcing our rights.

Comments may remain published for as long as the associated article or discussion remains available. Technical and moderation information may be retained for as long as necessary to prevent abuse, comply with legal obligations, or defend legal claims.

Please do not include sensitive personal data, confidential information, or personal information about other people in a public comment.

You may request deletion or anonymisation of your comment by contacting us. Statutory retention obligations and overriding legal grounds may limit our ability to comply with a deletion request.

If an external anti-spam service or commenting plugin is used, that service must be added to this Privacy Policy and the consent configuration where applicable.

11. Links to Instagram and Other Social Media

This website may contain links to our profile or content on Instagram.

A standard external link does not necessarily transmit information to Instagram until you click it. When you click the link, you leave Germany Unpacked and access a service operated by Meta.

Depending on your location, Instagram may be provided by:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4
Ireland

When you visit Instagram, Meta may process information such as your IP address, device information, browser information, account information, interactions, and the page from which you were referred. If you are logged in to Instagram, Meta may associate your visit with your account.

Meta processes this data under its own responsibility and according to its own privacy terms. We do not control the scope, purposes, or retention of personal data processed by Instagram.

Unless expressly indicated otherwise, the website currently uses ordinary links rather than automatically loaded Instagram plugins or embedded feeds.

If Instagram embeds, pixels, plugins, or similar technologies are added in the future, this Privacy Policy and the consent configuration must be updated before or when those technologies are introduced.

12. External Websites

This website contains links to third-party websites.

Once you follow an external link, the operator of the destination website is responsible for its own processing of personal data. We do not control third-party websites, their security measures, their cookies, or their privacy practices.

We recommend reviewing the privacy policy of every third-party service before providing personal data or completing a transaction.

The presence of a link does not mean that we control or endorse all data processing performed by the linked website.

13. Recipients of Personal Data

We may disclose personal data to the following categories of recipients where necessary:

  • Hosting and infrastructure providers;
  • IT service providers;
  • Website administrators and technical contractors;
  • Analytics providers;
  • Consent management providers;
  • Affiliate networks and merchants;
  • Security and anti-spam providers;
  • Legal, tax, and accounting advisers;
  • Public authorities, regulators, courts, or law enforcement bodies;
  • Parties involved in legal proceedings; and
  • Potential successors in connection with a business transfer, restructuring, or sale.

Service providers acting on our behalf receive personal data only to the extent necessary to perform their services and are contractually required to protect it where applicable.

We do not sell personal data in the conventional sense of selling customer databases. Affiliate tracking and advertising technologies may nevertheless qualify as “sale,” “sharing,” or targeted advertising under certain non-European privacy laws. Where applicable, we provide the legally required choices through our consent management system.

14. International Data Transfers

Some service providers, affiliate partners, or technology companies may process personal data outside Germany, the European Union, or the European Economic Area.

Countries outside the European Economic Area may not provide the same level of data protection as the European Union.

Where personal data is transferred to a third country, we rely on an appropriate legal transfer mechanism where required, such as:

  • An adequacy decision adopted by the European Commission;
  • The EU–US Data Privacy Framework, where the recipient is validly certified and the framework applies;
  • Standard Contractual Clauses approved by the European Commission;
  • Binding corporate rules;
  • Your explicit consent in the limited circumstances permitted by law; or
  • Another legally recognised derogation or safeguard.

Where appropriate, we assess whether supplementary technical, contractual, or organisational measures are required.

You may contact us to request further information about the safeguards used for relevant international transfers.

15. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

The relevant retention period depends on factors including:

  • The purpose of processing;
  • The nature and sensitivity of the data;
  • Applicable statutory limitation periods;
  • Tax, commercial, and accounting obligations;
  • Security and fraud prevention requirements;
  • Whether consent has been withdrawn;
  • Whether an objection has been raised; and
  • Whether the data is needed for legal claims.

Consent records may be retained for a period sufficient to demonstrate compliance.

Server and security logs are generally retained for a limited period unless an incident requires further investigation.

Comment data may remain available while the comment or associated content is published.

Affiliate and accounting records may be retained in accordance with statutory tax and commercial recordkeeping requirements.

When personal data is no longer required, it is deleted, anonymised, or restricted as required by applicable law.

16. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against:

  • Accidental or unlawful destruction;
  • Loss;
  • Alteration;
  • Unauthorised disclosure;
  • Unauthorised access; and
  • Other unlawful forms of processing.

These measures may include encrypted transmission, access controls, secure passwords, software updates, backups, firewalls, anti-spam measures, and restrictions on administrative access.

However, no method of internet transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security.

17. Your Rights Under the GDPR

Where the GDPR applies, you may have the following rights:

17.1 Right of Access

You may request confirmation as to whether we process personal data concerning you and, where applicable, receive access to that data and further information about the processing.

17.2 Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete personal data.

17.3 Right to Erasure

You may request deletion of your personal data where the statutory requirements are met.

The right to erasure may be restricted where processing remains necessary, for example, to comply with legal obligations, exercise freedom of expression and information, or establish, exercise, or defend legal claims.

17.4 Right to Restriction of Processing

You may request restriction of processing where the statutory requirements are met.

17.5 Right to Data Portability

Where processing is based on consent or a contract and carried out by automated means, you may have the right to receive personal data you provided in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

17.6 Right to Object

You have the right to object, on grounds relating to your particular situation, at any time to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR.

We will then stop processing the relevant data unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is required for the establishment, exercise, or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time. Following such an objection, the data will no longer be processed for direct marketing.

17.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time with effect for the future.

You can withdraw cookie consent through the cookie settings available on the website.

17.8 Right Not to Be Subject to Certain Automated Decisions

You may have the right not to be subject to a decision based solely on automated processing, including profiling, where the decision produces legal effects concerning you or similarly significantly affects you, subject to statutory exceptions.

We do not currently use automated decision-making that produces such legal or similarly significant effects.

17.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority.

You may contact the supervisory authority responsible for your place of residence, place of work, or the place of the alleged infringement.

The supervisory authority responsible for the controller’s establishment in Saxony is generally:

Saxon Data Protection and Transparency Commissioner
Sächsische Datenschutz- und Transparenzbeauftragte
Germany

You may also contact us first so that we can attempt to address your concern directly.

18. Exercising Your Rights

To exercise your privacy rights, contact:

Tayfun Cortis
Email: tc.geschaeftlich@gmail.com

Please describe your request clearly and identify the processing activity concerned.

We may request additional information where reasonably necessary to verify your identity and prevent unauthorised disclosure or deletion of personal data.

We will respond within the periods required by applicable law. In complex cases or where multiple requests are received, the statutory response period may be extended where legally permitted.

The exercise of data protection rights is generally free of charge. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, particularly because of its repetitive character, as permitted by law.

19. Children’s Privacy

This website is intended for a general audience and is not specifically directed at children.

We do not knowingly request personal data directly from children. Visitors should not submit comments or other personal information unless they have the legal capacity to do so or the required consent of a parent or legal guardian.

If you believe that a child has provided personal data to us unlawfully, please contact us so that we can investigate and, where appropriate, delete the information.

20. No Requirement to Provide Personal Data

You are generally not legally or contractually required to provide personal data merely to browse the publicly available content of this website.

Certain technical data is processed automatically because it is necessary to deliver the website securely.

Where a feature requires personal data, failure to provide the required information may mean that the relevant feature cannot be used. For example, a comment cannot be published without the information required by the comment form.

21. Changes to This Privacy Policy

We may update this Privacy Policy where:

  • Our website or services change;
  • We introduce or remove technology providers;
  • Our affiliate partnerships change;
  • Legal requirements change;
  • Regulatory guidance changes; or
  • Our data processing practices change.

The current version will be published on this website. The “Last updated” date at the top indicates when this Privacy Policy was most recently revised.

Where required by law, we will obtain renewed consent before materially changing processing that is based on consent.

We recommend reviewing this Privacy Policy periodically.

22. Contact

For questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data, contact:

Tayfun Cortis
Germany Unpacked
Johannisplatz 4
04103 Leipzig
Germany

Telephone: +49 1522 8228432
Email: tc.geschaeftlich@gmail.com
Website: germayunpacked.com