Privacy.

The controller responsible for processing personal data on the website searchfor.org within the meaning of the General Data Protection Regulation (GDPR) is:

The managing directors authorised to represent the company and the register details are listed in the imprint. For questions about data protection and to exercise your rights, you can reach us at the email address above or by post.

searchfor.org is a search engine financed by advertising. You use it without an account: there is no registration, no contact form, no newsletter and no payment.

• When you open the website, we process technically necessary data such as your IP address. We delete the server logs after 14 days.
• We do not store your search terms in a database and do not link them to your clicks.
• If you click on a shop tile or an ad, we record the click to settle our commission with the affiliate network. Links in the ordinary search results lead directly to the website, not via us.
• We use Google Analytics only with your consent. You can withdraw it at any time in the cookie declaration at the end of this page.

We process personal data only where a legal basis permits it. For cookies and similar technologies, the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. For each processing operation we state the basis we rely on:

• Your consent (Art. 6(1)(a) GDPR), for Google Analytics; storing information on your device and accessing it is then based on § 25(1) TDDDG.
• A legal obligation (Art. 6(1)(c) GDPR), for example to prove your consent.
• Our legitimate interests (Art. 6(1)(f) GDPR), above all in operating the website securely and quickly, in providing the search and in settling our advertising revenue. We name the specific interest for each processing operation.
• Cookies that are strictly necessary are set without consent on the basis of § 25(2) no. 2 TDDDG.

We use service providers who process data on our behalf and according to our instructions (processors, Art. 28 GDPR), for example for hosting. Other recipients, such as the affiliate networks, process data under their own responsibility. We name the recipients or categories of recipients in the sections below.

Some recipients are located outside the EU and the European Economic Area, in particular in the USA. A transfer there is permitted under Art. 44 et seq. GDPR if the European Commission has found that the country ensures an adequate level of data protection (adequacy decision, Art. 45 GDPR) or if appropriate safeguards exist, such as the European Commission’s standard contractual clauses (Art. 46 GDPR). For the USA, the adequacy decision covers only companies certified under the EU-U.S. Data Privacy Framework.

For recipients outside the EU we state what the transfer is based on, or that there is no adequacy decision. In countries without an adequate level of data protection, authorities may be able to access data without you having effective legal remedies against it.

We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations require. We state the periods, or the criteria for them, for each processing operation.

You have the following rights against us regarding the personal data concerning you:

• Access to the data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability for data we process by automated means on the basis of your consent (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR, see the next section)

To exercise them, simply contact us at the address given under Controller. As you use the website without an account, we can usually link stored data such as clicks to a person only if you give us additional details, for example your IP address and the time of your visit (Art. 11 GDPR).

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of the processing carried out before the withdrawal. The easiest way to change or withdraw your cookie consent is the cookie declaration at the end of this page.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Heilbronner Straße 35, 70191 Stuttgart, Germany
Online complaint: https://www.baden-wuerttemberg.datenschutz.de/beschwerde/

You are under no statutory or contractual obligation to provide us with personal data. Without the technically necessary data, in particular your IP address, we cannot display the website to you. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

The connection between your browser and our website is encrypted with TLS, as shown by “https://” in your browser’s address bar. This prevents unauthorised parties from reading the data transmitted, such as your search terms.

We run our website and our databases on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the data as our processor (Art. 28 GDPR). The legal basis is our legitimate interest in operating the website securely and reliably (Art. 6(1)(f) GDPR).

The main server and the databases are located in Germany. Our CDN provider routes visitors from North, Central and South America to a Hetzner server in Ashburn (Virginia, USA) so that the website loads faster there. That server processes their requests; its server logs and caches stay on the server itself, while it stores click data in our database in Germany.

The US location is operated by the subsidiary Hetzner US LLC as a sub-processor of Hetzner. This server collects the data directly from visitors who access the website from the Americas; as a rule, it does not process requests from Europe. Hetzner US LLC is not certified under the EU-U.S. Data Privacy Framework; there is therefore no adequacy decision for this processing. More information: https://www.hetzner.com/legal/privacy-policy/.

Our domain is resolved by the DNS service of bunny.net, and all requests to our website pass through the content delivery network (CDN) of bunny.net, operated by BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. The CDN receives requests on servers close to the visitor, forwards them to our server in Germany or in the USA and tells us the country derived from your IP address. To do this, bunny.net processes your IP address and the data of your request.

Depending on your location, your request may be received by a server outside the EU; for visits from the EU these are usually servers in Europe. bunny.net acts as our processor (Art. 28 GDPR) and, according to its own information, stores access logs only temporarily.

The legal basis is our legitimate interest in fast, secure and resilient delivery of the website (Art. 6(1)(f) GDPR). More information: https://bunny.net/privacy/.

Each time our website is accessed, our web server automatically stores the following information in log files:

• IP address
• Date and time of access
• The request, i.e. the address accessed, including any search term entered
• HTTP status code
• Referrer (the page visited before), if your browser sends it
• User agent (information about the browser and operating system)

We use this data to deliver the website, fix faults and detect and fend off attacks. The legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). The logs are rotated daily and deleted after 14 days.

We log technical errors so that we can fix them. For errors relating to redirects to shops (see Clicks on shop links), these logs may contain your IP address, your user agent, the address accessed and the referrer. We delete them after 3 to 14 days, depending on the type. The legal basis is our legitimate interest in the error-free operation of the website (Art. 6(1)(f) GDPR).

To protect the search, the redirects and the site icons against automated mass requests and click fraud, we count requests per IP address (for IPv6 partly per /64 network) in a cache on the respective server. If a limit is exceeded, we temporarily reject further requests. The counters expire automatically after 24 hours at the latest.

When you search for the first time, we also set the cookie “sf_v” (see Necessary cookies). It contains, encrypted, only the time of that search. Search requests without this cookie, for example from programs that do not store cookies, or with a cookie younger than 30 minutes are subject to tighter limits. This keeps the search available when a very large number of automated requests arrive. The cookie is not linked to your IP address or any other information and is deleted after 30 days.

The legal basis is our legitimate interest in the security and availability of the website and in preventing fraud (Art. 6(1)(f) GDPR).

Cookies are small text files stored by your browser. Without your consent, we set only cookies that are strictly necessary to provide the functions you have requested (§ 25(2) no. 2 TDDDG). Apart from the consent cookie of Cookiebot (see Consent management with Cookiebot), these are exclusively the following cookies of our own domain:

We set the cookies for the cause, the language and the country only when you make a choice yourself. We set the search protection cookie when you search for the first time. The legal basis for the related processing is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR).

In addition, the page stores a short technical flag for an animation in your browser’s session storage (sessionStorage). It contains no information about you and is deleted as soon as the page has read it, or at the latest when you close the tab. If you close the note “Search straight from your address bar” next to the search results, your browser keeps this choice in its local storage (localStorage, entry “sf-default-search-closed”) so that the note does not come back; it contains no information about you, and you can delete it in your browser at any time. You can delete or block cookies in your browser at any time; some functions of the website may then not work as intended.

To obtain and manage your consent, we use Cookiebot by Usercentrics A/S, Havnegade 39, 1058 Copenhagen K, Denmark. Your browser loads the Cookiebot script from Usercentrics servers on every page view, and on this page also the cookie declaration. The script shows the cookie banner and blocks Google Analytics until you have consented. In the process, Usercentrics receives your IP address and information about your browser.

Cookiebot stores your decision in the “CookieConsent” cookie in your browser and as a record with Usercentrics on servers in the EU; Usercentrics deletes these records after 12 months. To determine your country, Usercentrics may have your IP address processed by Akamai Technologies, Inc. (USA), which is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). Usercentrics acts as our processor (Art. 28 GDPR).

The legal basis is our legal obligation to obtain consent and to be able to prove it (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR); the “CookieConsent” cookie is strictly necessary (§ 25(2) no. 2 TDDDG). All cookies with their provider and lifetime, and the option to change your consent, can be found in the cookie declaration. More information: https://www.cookiebot.com/en/privacy-policy/.

When you search, we process your search term, the country the results should apply to (your choice, or the country derived from your IP address) and the language of the website in order to show you suitable search results.

We do not store your search term in a database and do not link it to later clicks. As part of the address accessed, it appears in the server log files, possibly in the error logs and, with your consent, in Google Analytics. The legal basis is our legitimate interest in showing you the search results you requested (Art. 6(1)(f) GDPR).

So that we can show shops and ads that match your search, we match your search term and the language of the website against our shop catalogue. We do not use any information about you for this. The legal basis is our legitimate interest in financing the website through relevant advertising (Art. 6(1)(f) GDPR).

To show results and shops for your country, on every request we derive from your IP address the country from which you are visiting the website, using a country database on our server or the country information from our CDN provider. Your IP address is not passed on to any further third party for this. We use the country only for the request in question and record it when you click on a shop link.

We take the language from your browser’s language setting. If you choose the country or language yourself, your choice applies (see Necessary cookies). The legal basis is our legitimate interest in content that suits your country and language (Art. 6(1)(f) GDPR).

We serve the small icons (favicons) next to search results and shops from our own server; your browser does not connect to any third party for them. If we do not have an icon yet, our server fetches it from Google’s favicon service (t0.gstatic.com) and transmits only the name of the website concerned. We cache the icons on our server; they contain no information about you.

We usually serve shop logos from our server as well. If a shop’s logo is not stored with us, your browser loads it directly from the image server recorded in the shop catalogue; like any server delivering an image, it then receives your IP address and information about your browser. The legal basis is our legitimate interest in a clear presentation (Art. 6(1)(f) GDPR).

We finance searchfor.org through affiliate links: shop tiles and ads lead to the shop via our redirect address searchfor.org/go and an affiliate network. The shop may pay us a fee through the network for the click or a subsequent purchase; this does not change the price you pay. Links in the ordinary search results lead directly to the website concerned, not via our redirect.

When you click on a shop link, we store:

• Time, target shop, target address and affiliate network
• A random click ID
• Your full IP address
• Your user agent and further information from your browser: browser, operating system, device type, the languages set and the client hints sent by the browser
• The country determined and the domain of the page you came from (without the rest of the address)
• An identifier calculated from the IP address, user agent and date, which stays the same for one day only

We pass the click ID to the affiliate network in the link. The network uses it to attribute a later purchase to our click; we do not transmit any further data about you to the network. The network receives your IP address and information about your browser directly from your browser, as does every website you visit.

We use the click data to settle and check our commissions with the networks and to detect click fraud and automated clicks. The legal basis is our legitimate interest in financing our service and in preventing fraud (Art. 6(1)(f) GDPR).

We store the click data in our database on Hetzner servers in Germany. Until then, usually for a few minutes, it is held in a cache on the respective server. We delete it as soon as it is no longer needed to settle and check the commissions.

Redirects that we reject, for example via invalid links, are logged with the same information and the address accessed. The same periods apply to them.

During the redirect, the affiliate network and the shop set cookies or similar identifiers on their own domains to attribute a purchase to your click and to calculate the commission. The networks and shops are themselves responsible for the processing on their servers. What data they process, how long they store it and how you can object is explained in their privacy policies.

You can prevent these cookies by blocking third-party cookies in your browser or by deleting the cookies after your visit. A commission may then not be attributed to us; this has no consequences for your purchase.

We work with several affiliate networks through which we settle our commissions with the shops. Which network you reach when you click depends on the shop. The networks receive your data directly from your browser when you click on a shop link; from us they receive only the click ID.

Some networks are located outside the EU: in the United Kingdom, the USA, Hong Kong and China, and Malaysia. For the United Kingdom there is an adequacy decision of the European Commission (Art. 45 GDPR); for the other countries there is none, and the networks in the USA are not certified under the EU-U.S. Data Privacy Framework. According to their own information, some networks base transfers on appropriate safeguards such as standard contractual clauses (Art. 46 GDPR).

With your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is loaded only after you have consented via the cookie banner.

Google Analytics sets cookies that recognise your browser pseudonymously across several visits, and records information about your use of the website: pages viewed, on search results pages including the search term that is part of the address, as well as page titles, referrer, interactions, time and duration of the visit and information about the browser, operating system, device and screen. Google derives your approximate location from your IP address; according to its own information, Google does not store the IP address itself for users in the EU. We use the reports to improve the website.

Google processes the data as our processor (Art. 28 GDPR). Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR); Google has also agreed to standard contractual clauses (Art. 46 GDPR). Event data is deleted after 14 months at the latest. The cookies and their lifetime of up to two years are listed in the cookie declaration.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future in the cookie declaration. More information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/12017362.

We update this privacy policy when our website, the services we use or the law change. The version published here applies. The German version is binding; the English version is a translation.

Last updated: 7 November 2026