Privacy policy
Information under Art. 13 GDPR on taking part in the First Readers Club
1. Controller
The controller responsible for processing your personal data on this page, in the messenger chat and on your personal tester page is:
Business Wizards SRL
Bulevardul Dacia 133
020056 Bukarest
Rumänien
Represented by: Giuseppe Pignatello
Email: [email protected]
For questions about data protection and any request regarding your rights, contact us at the email address above.
2. What data we process, why and on what legal basis
Visiting this page
When you open the page, we process your IP address, date and time, the address you opened including the details from the ad link (source, campaign, ad, Meta click ID “fbclid”), the page you came from, your browser identifier (user agent) and the approximate country derived from your IP address. This creates a sign-up code that lets us match your sign-up in the messenger to the ad you came from. We do not set cookies for this. The approximate country and your browser language also decide which language the page opens in. If you choose a language at the top yourself, your browser only stores that choice in a cookie (“frc_lang”, one year).
Purpose: providing and securing the page and measuring which ads lead to sign-ups. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is running the page securely and measuring ad performance without cookies.
Signing up and taking part in the messenger
If you sign up via Telegram, we process your messenger identifier (on Telegram your user ID, display name and username), your language, the messages in the chat, the topics you choose, your Amazon country, whether you accept or decline books, and the sign-up code.
Purpose: running the test reader programme (invitations to suitable books, reminders, questions and answers). The legal basis is Art. 6(1)(b) GDPR (taking part at your request).
Tester page, proof of purchase and feedback
For your personal tester page we create a secret link that expires after a while. There and in the chat we process your acceptances, your proof of purchase (screenshot or PDF of the Amazon order with order number, title, price, date and the other details on it), screenshots of your review, your star rating, your feedback on the book and which reading copies you downloaded.
Proofs of purchase are read with AI support and automatically checked against the assigned book (title, price, date, marketplace, proofs submitted twice). If everything clearly matches, the refund is released; in cases of doubt a person checks it. If a proof does not match, we ask you for a new one. You can ask at any time for a person to check your proof and you can state your point of view.
Purpose: running the test reader programme and preventing abuse. The legal basis is Art. 6(1)(b) GDPR, and for checking for duplicate proofs Art. 6(1)(f) GDPR (legitimate interest: fraud prevention).
Payout
For the refund we process your name, the amount, currency, the payout method you choose and, if needed, your email address. The payout is provided by the payment service Tremendous (redemption link with a gift card or another method of your choice).
The legal basis is Art. 6(1)(b) GDPR; we keep payout records because of statutory commercial and tax obligations (Art. 6(1)(c) GDPR).
If you give us an email address, we use it for messages about your participation (for example the payout). The legal basis is Art. 6(1)(b) GDPR. You can unsubscribe at any time via the link in every email.
3. Recipients
Your data only goes to those who need it for the purposes above. Service providers working on our behalf are bound by contract under Art. 28 GDPR.
- Hosting and technical service providers in Germany (servers, database, running the application).
- Telegram as messenger service: the chat with you runs via Telegram; Telegram processes the messages as a provider in its own right under its own terms.
- Email delivery service providers for messages to your email address.
- Providers of AI-supported image and text analysis that read proofs of purchase and screenshots.
- The payment service Tremendous (Tremendous Inc., New York, USA) for the payout; when redeeming, Tremendous’s own terms also apply.
- Tax advisers, authorities and courts, where we are legally required to share data.
4. Transfers to third countries
Some recipients are based outside the EU or EEA or process data there (for example Tremendous in the USA, Telegram, providers of the AI analysis). We base such transfers on an adequacy decision of the European Commission (Art. 45 GDPR, e.g. the EU-US Data Privacy Framework) or on standard contractual clauses (Art. 46(2)(c) GDPR); you can request a copy of the safeguards. Where neither exists, we only transfer data as far as necessary for your participation (Art. 49(1)(b) GDPR), for example to Telegram, which you choose yourself for taking part.
5. How long we keep data
- IP address from the page visit: deleted at the latest after 7 days.
- Other details of the sign-up code: as long as we need them to evaluate our ads.
- Participation data (chat, topics, tester page, proofs, feedback): as long as you take part. If you unsubscribe (for example with “stop” in the chat), we stop messaging you; on request we delete your data unless a retention obligation applies.
- Payout data: until the statutory retention periods end (up to ten years).
6. Obligation to provide data
Taking part is voluntary; there is no legal or contractual obligation to provide data. Without a messenger identifier we cannot invite you, though, and without proof of purchase we cannot refund you.
7. Your rights
You have the right to
- access your data (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- withdraw consent with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing before the withdrawal,
- lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live or work.
Right to object (Art. 21 GDPR)
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. An informal message to us is enough.
Last updated: 09.11.2026
Back to the start page